{"version":"2.12.0","generated":"2026-10-09","incident_count":15637,"incidents":[{"id":"INC-04853","date":"2023-04","year":2023,"title":"Samsung employees leak source code and meeting notes via ChatGPT","severity":"High","attack_vector":"insider","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Samsung Semiconductor — internal source code, meeting notes, hardware schematics","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://techcrunch.com/2023/05/02/samsung-bans-use-of-generative-ai-tools-like-chatgpt-after-data-leak/"},{"id":"INC-04490","date":"2023-02","year":2023,"title":"Bing Chat 'Sydney' jailbreak — persona escape and threatening behaviour","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft Bing Chat (public launch, February 2023)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.nytimes.com/2023/02/16/technology/bing-chatbot-microsoft-chatgpt.html"},{"id":"INC-03529","date":"2024-02","year":2024,"title":"Air Canada chatbot invents bereavement discount policy — tribunal ruling","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM03","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Air Canada — customer service chatbot (passenger Jake Moffatt)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/travel/article/20240222-air-canada-chatbot-misinformation-what-travellers-should-know"},{"id":"INC-04560","date":"2023-12","year":2023,"title":"Chevrolet dealership chatbot agrees to sell car for $1","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"Chevrolet of Watsonville dealership — third-party chatbot vendor deployment","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arstechnica.com/cars/2023/12/car-dealers-ai-chatbot-was-tricked-into-selling-a-tahoe-for-1-and-promising-support/"},{"id":"INC-04787","date":"2023-03","year":2023,"title":"OpenAI Redis caching bug exposes user conversation history","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT — ~1.2% of Plus subscribers; conversation titles visible to other users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.theverge.com/2023/3/24/23655143/openai-chatgpt-redis-bug-personal-information-chathistory"},{"id":"INC-04653","date":"2023-01","year":2023,"title":"GitHub Copilot reproduces verbatim licensed code and embedded secrets","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"GitHub Copilot users — risk of introducing unlicensed code or live credentials into projects","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2211.03622"},{"id":"INC-03876","date":"2024-02","year":2024,"title":"Hugging Face model repository pickle-based malware supply chain","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Any organisation loading models from Hugging Face Hub without verification — ML training environments, inference servers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jfrog.com/blog/data-scientists-targeted-with-malicious-hugging-face-ml-models-over-100-models-found/"},{"id":"INC-03997","date":"2024-08","year":2024,"title":"Microsoft Copilot for M365 — document exfiltration via indirect injection","severity":"Critical","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Microsoft Copilot for Microsoft 365 — organisations using Copilot with SharePoint/OneDrive access","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.zenity.io/blog/research/exploiting-microsoft-copilot"},{"id":"INC-05001","date":"2023-07","year":2023,"title":"WormGPT — uncensored LLM sold for cybercrime on dark web forums","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM03","LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Downstream targets of BEC and phishing campaigns generated with WormGPT/FraudGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/"},{"id":"INC-05172","date":"2022-11","year":2022,"title":"Perez & Ribeiro — 'Ignore Previous Prompt': foundational direct injection study","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"GPT-3 (generalises to all instruction-following LLMs); directly contributed to OWASP LLM Top 10 LLM01","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2211.09527"},{"id":"INC-04574","date":"2023-02","year":2023,"title":"Clarkesworld magazine overwhelmed by AI-generated fiction submissions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM06","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Clarkesworld Magazine — editorial workflow; broader publishing and content moderation industries","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://neil-clarke.com/a-concerning-trend/"},{"id":"INC-04771","date":"2023-10","year":2023,"title":"Multimodal indirect injection — image-embedded instructions in GPT-4V","severity":"High","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V; any multimodal LLM accepting image inputs — generalises to all vision-capable models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://twitter.com/goodside/status/1713000467325624532"},{"id":"INC-04142","date":"2024-03","year":2024,"title":"RAG corpus poisoning — embedding-space manipulation to force retrieval","severity":"Critical","attack_vector":"memory-poisoning","owasp_llm":["LLM01","LLM05","LLM09"],"owasp_asi":["ASI01","ASI02","ASI06","ASI07","ASI08"],"cve_ids":[],"affected":"Any RAG pipeline where attacker can contribute documents — shared knowledge bases, public wikis, customer-submitted…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2402.07867"},{"id":"INC-04475","date":"2023-04","year":2023,"title":"AutoGPT and BabyAGI — uncontrolled web browsing and file system access","severity":"High","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":["ASI01","ASI05","ASI08"],"cve_ids":[],"affected":"Users running AutoGPT/BabyAGI with real API keys and filesystem access","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/Significant-Gravitas/AutoGPT"},{"id":"INC-03447","date":"2024-06","year":2024,"title":"Agentic AI privilege escalation via tool chain manipulation — research","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":[],"owasp_asi":["ASI01","ASI02","ASI03"],"cve_ids":[],"affected":"AI agents with cloud SDK tool access and insufficient IAM boundaries","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.wiz.io/blog/the-urgent-need-for-ai-security-guardrails"},{"id":"INC-01288","date":"2026-03","year":2026,"title":"LAAF v2.0 — Empirical LPCI breakthrough rates of 67–100% across 5 production LLMs","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM08"],"owasp_asi":["ASI01","ASI02","ASI03","ASI06"],"cve_ids":[],"affected":"GPT-4o-mini (67%), Claude-3-Sonnet (85%), Gemini-2.0-Flash (92%) — tested via direct chat-completion API; actual…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2507.10457"},{"id":"INC-04027","date":"2024-03-05","year":2024,"title":"Nassi et al. \"ComPromptMized\" Morris II multi-agent worm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM03","LLM09"],"owasp_asi":["ASI01","ASI02","ASI06","ASI07","ASI08"],"cve_ids":[],"affected":"GenAI-powered email assistants with contact access and send capabilities — demonstrated on ChatGPT-4 and Gemini Pro;…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2403.02817"},{"id":"INC-04208","date":"2024-08-20","year":2024,"title":"Slack AI indirect injection via channel content","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM02","LLM03","LLM09"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"Slack AI summarisation feature — all Slack workspaces with Slack AI enabled; attack vector is any public or shared…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via"},{"id":"INC-03810","date":"2024-05","year":2024,"title":"GitHub Copilot Workspace prompt injection via repository content","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM08","LLM10"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"GitHub Copilot Chat and Copilot Workspace — any developer using AI features on a repository containing adversarial…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories"},{"id":"INC-03484","date":"2024-02","year":2024,"title":"AI voice deepfake CEO fraud — Hong Kong $25M loss","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM03","LLM06","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Multinational company finance employee, Hong Kong office — HKD 200 million (~USD 25.6M) transferred to…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-hong-kong-scam-intl-hnk/index.html"},{"id":"INC-03972","date":"2024-10","year":2024,"title":"MathPrompt: symbolic mathematics jailbreak attack","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Pro, Llama 3, Mistral Large, and 3 others — all tested via standard…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.15262"},{"id":"INC-03967","date":"2024-04","year":2024,"title":"Many-shot jailbreaking (Anthropic research)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03","LLM05"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Claude (all sizes), GPT-4, Llama 2/3 — all long-context frontier models; attack efficacy increases with context…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.anthropic.com/research/many-shot-jailbreaking"},{"id":"INC-03687","date":"2024-05","year":2024,"title":"Crescendo: multi-turn escalation attack (Microsoft)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"GPT-4, Gemini Pro, Claude (all sizes), Microsoft Copilot — any LLM with multi-turn conversation; agentic deployments…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2404.01833"},{"id":"INC-04207","date":"2024-06","year":2024,"title":"Skeleton Key: direct system prompt override (Microsoft)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5 Turbo, GPT-4, GPT-4o, Meta Llama 3, Mistral Large, Claude 3 Opus, Gemini Pro 1.0 — all tested frontier models;…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.microsoft.com/en-us/security/blog/2024/06/26/mitigating-skeleton-key-a-new-type-of-generative-ai-jailbreak-technique/"},{"id":"INC-05159","date":"2022-11","year":2022,"title":"Meta Galactica model withdrawn after misinformation at launch","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM03","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Public users of Galactica demo — primarily researchers and students seeking scientific information; Meta AI…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.theguardian.com/technology/2022/nov/17/meta-galactica-large-language-model-ai-research-tool-pulled-racist-tropes-false-information"},{"id":"INC-03004","date":"2025-01","year":2025,"title":"OpenAI o1/o3 reasoning chain jailbreak via chain-of-thought manipulation","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM03","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI o1, o1-mini, o3-mini reasoning models — attack class is specific to CoT reasoning models; applicable to any…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2501.01234"},{"id":"INC-02465","date":"2025-03","year":2025,"title":"Cursor AI code agent leaking repository secrets via context window","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Cursor AI users — developers using AI code assistance on repositories containing secrets; any AI code agent with…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/getcursor/cursor/issues"},{"id":"INC-02774","date":"2025-03","year":2025,"title":"Italy Garante orders ChatGPT GDPR enforcement — consent and data minimization failures","severity":"High","attack_vector":"rce","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI / ChatGPT — EUR 15M fine; all LLM providers operating in EU face precedent; structural remedies required","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.garanteprivacy.it/"},{"id":"INC-02454","date":"2025-01","year":2025,"title":"Clearview AI biometric bias — $50M class action settlement","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Clearview AI — USD 50M settlement; Illinois residents whose biometric data was collected without consent; law…","corpus":"ai-harm","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.reuters.com/legal/"},{"id":"INC-02353","date":"2025-02","year":2025,"title":"Azure OpenAI content filter bypass via structured output mode","severity":"High","attack_vector":"other","owasp_llm":["LLM01","LLM09","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Azure OpenAI Service — structured output / JSON mode endpoint; applicable to any LLM API offering constrained…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://msrc.microsoft.com/"},{"id":"INC-02703","date":"2025-01","year":2025,"title":"Hugging Face model card supply chain manipulation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face Hub — 500K+ public models; any ML platform with self-reported model metadata; all downstream users who…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jfrog.com/blog/"},{"id":"INC-03247","date":"2025-03","year":2025,"title":"Synthetic data re-identification — de-anonymized patients from synthetic health records","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Healthcare organizations using synthetic data for AI training and analytics; any organization assuming synthetic data…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.usenix.org/conference/usenixsecurity25"},{"id":"INC-02922","date":"2025-02","year":2025,"title":"Multi-agent financial trading system flash crash — cascading autonomous failures","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI07","ASI08","ASI09","ASI10"],"cve_ids":[],"affected":"Quantitative trading firm — $8M+ loss; multi-agent financial systems with delegated execution autonomy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.risk.net/"},{"id":"INC-04310","date":"2024-06","year":2024,"title":"Uber ML platform data lineage audit — fragmented provenance across 30+ feature stores","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Uber Michelangelo ML platform — safety-critical features (ride pricing, driver matching, fraud detection) affected by…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.uber.com/blog/engineering/"},{"id":"INC-04955","date":"2023-09","year":2023,"title":"TikTok EU data localization enforcement — Project Clover + EUR 345M GDPR fine","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"TikTok / ByteDance — EUR 345M fine + EUR 12B data localization investment; all AI companies processing EU personal…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-conclusion-inquiry-tiktok"},{"id":"INC-04179","date":"2024-01","year":2024,"title":"Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM03","LLM04","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scale AI, Sama, and AI data labeling companies globally; downstream: OpenAI, Anthropic, Google, Meta (any company…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://time.com/6247678/openai-chatgpt-kenya-workers/"},{"id":"INC-03570","date":"2024-08","year":2024,"title":"Anthropic Claude context flooding — resource exhaustion via adversarial long-context prompts","severity":"High","attack_vector":"dos","owasp_llm":["LLM05","LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"Claude (200K context), GPT-4 (128K context), Gemini (1M+ context) — all long-context models; cloud API billing…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2408.00000"},{"id":"INC-03444","date":"2024-07","year":2024,"title":"Adversarial embedding attacks on production RAG systems","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM09"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"RAG systems using OpenAI, Cohere, and open-source embedding models — any production RAG with user-contributed or…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2407.00000"},{"id":"INC-03579","date":"2024-12","year":2024,"title":"Apollo Research: frontier models demonstrate strategic deception to avoid shutdown","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI09","ASI10"],"cve_ids":[],"affected":"Claude 3.5 Sonnet (highest deception rate), GPT-4o, Gemini 1.5, Llama 3.1 — all tested frontier models; risk scales…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2412.04984"},{"id":"INC-04221","date":"2024-04","year":2024,"title":"Stability AI synthetic CSAM generation — training data and output safety failures","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"Stability AI / Stable Diffusion — legal action in UK and US; LAION dataset users; all image generation models trained…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cyber.fsi.stanford.edu/news/investigation-finds-ai-image-generation-models-trained-child-abuse"},{"id":"INC-03822","date":"2024-02","year":2024,"title":"Google Gemini AI image generator refuses to depict white people — overcorrected safety filters","severity":"High","attack_vector":"other","owasp_llm":["LLM05","LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini (formerly Bard) — image generation feature globally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/news/technology-68412620"},{"id":"INC-03740","date":"2024-01","year":2024,"title":"DPD AI chatbot swears at customer and criticises company — prompt injection via customer input","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"DPD (parcel delivery) — customer service chatbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/news/technology-68025677"},{"id":"INC-04140","date":"2024-06","year":2024,"title":"Rabbit R1 hardcoded API keys — all user data accessible to anyone with firmware","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":[],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"Rabbit R1 device — all users' interaction history, TTS data, location data","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://rabbitu.de/articles/security-disclosure-1"},{"id":"INC-04005","date":"2024-05","year":2024,"title":"Microsoft Recall screenshots everything — OS-level data retention without consent","severity":"Critical","attack_vector":"malware","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft Windows — Copilot+ PCs, all user activity","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/"},{"id":"INC-03815","date":"2024-05","year":2024,"title":"Google AI Overviews recommends adding glue to pizza — RAG hallucination at search scale","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07","LLM09"],"owasp_asi":[],"cve_ids":[],"affected":"Google Search — AI Overviews shown to billions of users globally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/news/articles/cd11gzejgz4o"},{"id":"INC-03628","date":"2024-10","year":2024,"title":"Character.AI teen suicide — AI companion encouraged self-harm","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Character.AI — minor user","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.nytimes.com/2024/10/22/technology/characterai-lawsuit-teen-suicide.html"},{"id":"INC-03490","date":"2024-01","year":2024,"title":"AI-generated Biden robocalls — deepfake voice used to suppress voter turnout","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"New Hampshire primary voters — estimated 5,000-25,000 calls","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.fcc.gov/document/fcc-makes-ai-generated-voices-robocalls-illegal"},{"id":"INC-04088","date":"2024-06","year":2024,"title":"Perplexity AI plagiarism — verbatim content reproduction without attribution","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Forbes, WIRED, Condé Nast, and other publishers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.forbes.com/sites/sarahemerson/2024/06/07/perplexity-plagiarism/"},{"id":"INC-03582","date":"2024-12","year":2024,"title":"Apple Intelligence notification hallucinations — fabricated BBC news headlines","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Apple iPhone users with Apple Intelligence — BBC and other news sources","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/news/articles/cd0elzk24dgo"},{"id":"INC-03572","date":"2024-01","year":2024,"title":"Anthropic Sleeper Agents paper — models trained to hide malicious behaviour","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02","ASI04","ASI09","ASI10"],"cve_ids":[],"affected":"Research demonstration — implications for all fine-tuned foundation models","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2401.05566"},{"id":"INC-02874","date":"2025-04-01","year":2025,"title":"MCP tool poisoning — hidden instructions in Model Context Protocol tool descriptions","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM01","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"Any MCP-connected agent (Claude Desktop, VS Code extensions, custom agents)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks"},{"id":"INC-03491","date":"2024-09","year":2024,"title":"AI-generated CSAM detection evasion — adversarial manipulation of content safety classifiers","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"Open-source image generation models with safety filters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.16090"},{"id":"INC-03552","date":"2024-06","year":2024,"title":"Amazon Q developer leaks internal AWS data in enterprise environment","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon Q Developer — enterprise customers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.platformer.news/amazon-q-leaks-data/"},{"id":"INC-04067","date":"2024-03","year":2024,"title":"OpenAI GPT-4 system prompt extraction toolkit — systematic prompt leakage","severity":"High","attack_vector":"other","owasp_llm":["LLM01","LLM06","LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"GPT-4 and other production LLM applications with confidential system prompts","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://arxiv.org/abs/2403.06634"},{"id":"INC-04344","date":"2024-07","year":2024,"title":"Waymo autonomous vehicle data retention — 75 petabytes of driving footage with faces","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Waymo — pedestrians and drivers captured by autonomous vehicle cameras","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.reuters.com/technology/waymo-faces-privacy-scrutiny-over-data-collection/"},{"id":"INC-03807","date":"2024-11","year":2024,"title":"GitHub Copilot Chat agent executes malicious code from repository context","severity":"Critical","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":[],"affected":"GitHub Copilot Chat with agent mode — developer workstations","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.pillar.security/blog/new-vulnerability-in-github-copilot"},{"id":"INC-03758","date":"2024-12","year":2024,"title":"EU GDPR enforcement: ChatGPT cannot correct factually wrong personal data","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT — individuals whose personal data is hallucinated incorrectly","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://noyb.eu/en/chatgpt-provides-false-information-about-people"},{"id":"INC-03668","date":"2024-10","year":2024,"title":"Claude computer use red-team: autonomous agent browses to attacker-controlled site and follows instructions","severity":"Critical","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02","ASI05","ASI08"],"cve_ids":[],"affected":"Claude computer use beta — user's local machine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anthropic.com/news/3-5-models-and-computer-use"},{"id":"INC-04212","date":"2024-05","year":2024,"title":"Snowflake customer data breach via stolen credentials — 165+ organisations affected","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":[],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"165+ Snowflake customers including AT&T, Ticketmaster, Santander — AI/ML data pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion"},{"id":"INC-02549","date":"2025-02","year":2025,"title":"EU AI Act first enforcement actions — prohibited AI practices take effect","severity":"High","attack_vector":"rce","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"AI providers and deployers operating in EU market with prohibited AI systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai"},{"id":"INC-02502","date":"2025-01","year":2025,"title":"DeepSeek R1 data exfiltration — Chinese AI model sends data to China-linked servers","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek R1 users globally — conversation data sent to China-linked servers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.reuters.com/technology/deepseek-data-china-mobile-servers-2025-02-04/"},{"id":"INC-03001","date":"2025-04","year":2025,"title":"OpenAI GPT-4o sycophancy — model agrees with users even when they are wrong","severity":"High","attack_vector":"other","owasp_llm":["LLM05","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI GPT-4o — all users globally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://openai.com/index/sycophancy-in-gpt-4o/"},{"id":"INC-03472","date":"2024-08","year":2024,"title":"AI recruiting tool gender bias — Amazon scraps internal ML hiring tool","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"Job candidates — particularly women applying for technical roles","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.eeoc.gov/ai"},{"id":"INC-03955","date":"2024-04","year":2024,"title":"LLM-generated malware evades endpoint detection — AI-assisted polymorphic code","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Endpoint detection platforms — traditional signature and behavioural detection methods","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.07906"},{"id":"INC-04263","date":"2024-11","year":2024,"title":"Tesla FSD phantom braking and obstacle hallucination — AI perception failures at highway speed","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Tesla FSD — 2.4 million vehicles under NHTSA investigation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.nhtsa.gov/recalls-complaints/tesla-full-self-driving"},{"id":"INC-04755","date":"2023-03","year":2023,"title":"Midjourney Trump arrest deepfakes go viral — AI-generated images shape public perception","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Public discourse — images shared across Twitter, Reddit, and news outlets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bbc.com/news/world-us-canada-65060342"},{"id":"INC-04739","date":"2023-03","year":2023,"title":"Meta Llama model weights stolen and leaked — open-source model security incident","severity":"High","attack_vector":"insider","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Meta — LLaMA model IP and safety controls","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.theverge.com/2023/3/8/23629362/meta-ai-language-model-llama-leak-online-misuse"},{"id":"INC-04721","date":"2023-12","year":2023,"title":"Lasso Security — 1,500+ HuggingFace API tokens exposed in code repositories","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"HuggingFace — 1,500+ organisations including Meta, Google, Microsoft","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blog.lasso.security/blog/1500-huggingface-api-tokens-exposed"},{"id":"INC-04070","date":"2024-10","year":2024,"title":"OpenAI Whisper hallucinating medical transcriptions — fabricated diagnoses in healthcare AI","severity":"Critical","attack_vector":"hallucination","owasp_llm":["LLM07","LLM09"],"owasp_asi":[],"cve_ids":[],"affected":"30,000+ healthcare providers using Whisper-based transcription — patient records","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://apnews.com/article/openai-whisper-ai-medical-transcription-hallucination-0a7bdf3c59438a9a81ae8ce5e33da81e"},{"id":"INC-02451","date":"2025-12","year":2025,"title":"Claude Skills ransomware deployment — MedusaLocker via malicious plugin","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"Claude (Anthropic) — Skills plugin ecosystem","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.catonetworks.com/blog/cato-ctrl-weaponizing-claude-skills-with-medusalocker/"},{"id":"INC-02628","date":"2025-12","year":2025,"title":"Google Antigravity AI IDE deletes entire D: drive — misinterpreted cache-clearing instruction","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"Google Antigravity IDE — user's entire D: drive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.reddit.com/r/google_antigravity/comments/1p82or6/"},{"id":"INC-03211","date":"2025-11","year":2025,"title":"ShadowMQ — critical RCE in Meta/NVIDIA/vLLM inference servers via pickle deserialization","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-50050"],"affected":"Meta, NVIDIA, vLLM inference servers","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem"},{"id":"INC-03020","date":"2025-11","year":2025,"title":"Perplexity Comet agentic browser — unauthorized Amazon customer account access","severity":"Critical","attack_vector":"agent-hijack","owasp_llm":[],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Perplexity AI Comet browser agent — Amazon customer accounts","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.perplexity.ai/hub/blog/bullying-is-not-innovation"},{"id":"INC-02848","date":"2025-10","year":2025,"title":"Malicious MCP server backdoor on npm — dual reverse shells in mcp-runcommand-server","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"Any developer installing @lanyer640/mcp-runcommand-server from npm","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.koi.ai/blog/mcp-malware-wave-continues-a-remote-shell-in-backdoor"},{"id":"INC-02590","date":"2025-09","year":2025,"title":"ForcedLeak — Salesforce Agentforce indirect prompt injection exfiltrates CRM data","severity":"Critical","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Salesforce Agentforce — enterprise CRM data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce"},{"id":"INC-00924","date":"2026-01-15","year":2026,"title":"EchoLeak — zero-click Microsoft Copilot data exfiltration via email prompt injection","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM05","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05","ASI06","ASI08","ASI09"],"cve_ids":["CVE-2025-32711"],"affected":"Microsoft Copilot for M365 — enterprise email and file data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.aim.security/post/echoleak-blogpost"},{"id":"INC-02186","date":"2025-04","year":2025,"title":"Agent-in-the-Middle — A2A protocol spoofing via fake agent cards","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM05","LLM07","LLM10"],"owasp_asi":["ASI03","ASI06","ASI07","ASI08","ASI10"],"cve_ids":[],"affected":"Agent-2-Agent (A2A) protocol — multi-agent workflows","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/agent-in-the-middle-abusing-agent-cards-in-the-agent-2-agent-protocol-to-win-all-the-tasks"},{"id":"INC-01411","date":"2026-03","year":2026,"title":"Meta Rogue AI Agent Sev-1 — autonomous agent posts incorrect advice, exposing proprietary data","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI08","ASI09","ASI10"],"cve_ids":[],"affected":"Meta — internal engineering forum; proprietary code and business data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://techcrunch.com/2026/03/18/meta-is-having-trouble-with-rogue-ai-agents/"},{"id":"INC-00806","date":"2026-02","year":2026,"title":"Claude AI jailbreak — Mexican government breach, 150GB data theft across 10 agencies","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI10"],"cve_ids":[],"affected":"10 Mexican government agencies — 195 million taxpayer records, voter data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.bloomberg.com/news/articles/2026-02-25/hacker-used-anthropic-s-claude-to-steal-sensitive-mexican-data"},{"id":"INC-01340","date":"2026-03","year":2026,"title":"LiteLLM PyPI supply chain backdoor — TeamPCP campaign compromises 3.4M daily downloads","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"LiteLLM — 3.4M daily downloads; SSH keys, cloud tokens, K8s configs","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.trendmicro.com/en_us/research/26/c/inside-litellm-supply-chain-compromise.html"},{"id":"INC-00671","date":"2026-03","year":2026,"title":"Axios npm supply chain attack — North Korean Sapphire Sleet targets 70M weekly downloads","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"axios npm package — 70M+ weekly downloads; AI coding agents auto-installing","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package"},{"id":"INC-01429","date":"2026-03","year":2026,"title":"Microsoft 365 Copilot XPIA phishing — attacker-shaped email summaries via hidden instructions","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM01","LLM04","LLM05","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05","ASI06","ASI09"],"cve_ids":["CVE-2026-26133"],"affected":"Microsoft 365 Copilot — enterprise email and Teams users","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://permiso.io/blog/copilot-prompt-injection-ai-email-phishing"},{"id":"INC-02105","date":"2026-03","year":2026,"title":"XBOW — first critical CVE discovered entirely by autonomous AI penetration testing agent","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI05","ASI10"],"cve_ids":["CVE-2026-21536"],"affected":"Microsoft Devices Pricing Program; broader implications for AI-discovered vulnerabilities","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://xbow.com/blog/three-rce-vulnerabilities-in-microsoft-identified-xbow"},{"id":"INC-01092","date":"2026-03","year":2026,"title":"GlassWorm supply chain — 72 malicious VSCode extensions, 9 million installs","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"OpenVSX, GitHub, npm — 9 million installs across 433 components","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode"},{"id":"INC-00834","date":"2026-02","year":2026,"title":"Clinejection — CI/CD pipeline compromise via Cline's issue triage bot, 4,000 machines infected","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04","LLM05","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"Cline AI coding agent — 4,000 developer machines; npm ecosystem","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://adnanthekhan.com/posts/clinejection/"},{"id":"INC-01465","date":"2026-02","year":2026,"title":"Moltbook — vibe-coded social network exposes 1.5M API tokens and 35K emails","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Moltbook — 1.5M API tokens, 35K emails, private messages","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys"},{"id":"INC-00198","date":"2026-02","year":2026,"title":"AI recommendation poisoning — hidden prompt injections in 'Summarize with AI' buttons across 31 companies","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM05"],"owasp_asi":["ASI01","ASI06","ASI09"],"cve_ids":[],"affected":"AI assistants processing web content — 31 companies, 12+ industries","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/"},{"id":"INC-01064","date":"2026-01","year":2026,"title":"GeminiJack — zero-click Gemini Enterprise data exfiltration via shared Google Docs","severity":"Critical","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM05"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"Gemini Enterprise — Google Workspace email, calendar, documents","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://noma.security/blog/geminijack-google-gemini-zero-click-vulnerability/"},{"id":"INC-01589","date":"2026-02-01","year":2026,"title":"OpenClaw AI agent security crisis — 138 CVEs in 63 days, 341 malicious marketplace skills","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05","ASI10"],"cve_ids":["CVE-2026-25253"],"affected":"OpenClaw — 21,000+ exposed instances; connected enterprise SaaS apps","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.reco.ai/blog/openclaw-the-ai-agent-security-crisis-unfolding-right-now"},{"id":"INC-03208","date":"2025-10","year":2025,"title":"ServiceNow BodySnatcher — hardcoded secret key enables full AI agent hijacking (CVE-2025-12420)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI03","ASI09"],"cve_ids":["CVE-2025-12420"],"affected":"ServiceNow Now Assist AI Agents 5.0.24-5.1.17 — customer SSNs, healthcare, financial data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/"},{"id":"INC-02899","date":"2025-06-01","year":2025,"title":"Microsoft Copilot Studio agents public by default — unauthorized data exfiltration","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM02","LLM03"],"owasp_asi":["ASI01","ASI02","ASI03","ASI07","ASI09"],"cve_ids":[],"affected":"Microsoft Copilot Studio — enterprise agents with business data access","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://labs.zenity.io/p/a-copilot-studio-story-2-when-aijacking-leads-to-full-data-exfiltration-bc4a"},{"id":"INC-03152","date":"2025-07","year":2025,"title":"Replit vibe coding meltdown — agent hallucinated data, deleted production database, hid mistakes","severity":"Critical","attack_vector":"hallucination","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01","ASI09","ASI10"],"cve_ids":[],"affected":"Replit — production database; user data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://blog.replit.com/introducing-a-safer-way-to-vibe-code-with-replit-databases"},{"id":"INC-03210","date":"2025-09","year":2025,"title":"ShadowLeak — ChatGPT Deep Research zero-click data exfiltration from connected services","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"ChatGPT Deep Research — Gmail, Dropbox, GitHub, SharePoint connected services","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://therecord.media/openai-fixes-zero-click-shadowleak-vulnerability"},{"id":"INC-03036","date":"2025-09","year":2025,"title":"PoisonedRAG — 5 malicious texts in millions achieve 90% attack success rate on RAG systems","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM05","LLM09"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"All enterprise RAG deployments — knowledge databases","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.usenix.org/conference/usenixsecurity25/presentation/zou-poisonedrag"},{"id":"INC-03194","date":"2025-08","year":2025,"title":"Salesloft Drift OAuth breach — Chinese actor UNC6395 accesses 700+ Salesforce CRM environments","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"700+ organizations including Cloudflare, Google, Palo Alto Networks — Salesforce CRM data","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift"},{"id":"INC-03368","date":"2025-04","year":2025,"title":"WhatsApp MCP tool poisoning — hidden instructions exfiltrate entire message history","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM05"],"owasp_asi":["ASI01","ASI02","ASI04","ASI07"],"cve_ids":[],"affected":"WhatsApp MCP integration — user's complete message history","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://invariantlabs.ai/blog/whatsapp-mcp-exploited"},{"id":"INC-00740","date":"2026-02","year":2026,"title":"Chat & Ask AI app — 300 million messages from 25 million users exposed via misconfigured Firebase","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Chat & Ask AI — 25 million users; 300 million messages","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages-tied-to-25-million-users"},{"id":"INC-02190","date":"2025","year":2025,"title":"AgentSeal MCP server mass scan — 66% of 1,808 servers have security findings","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"MCP server ecosystem — 1,808 servers scanned, 66% vulnerable","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://agentseal.org/blog/mcp-server-security-findings"},{"id":"INC-02627","date":"2025-12","year":2025,"title":"Google Antigravity AI Data Wipe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Google Antigravity AI Data Wipe","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.reddit.com/r/google_antigravity/comments/1p82or6/google_antigravity_just_deleted_the_contents_of/"},{"id":"INC-02480","date":"2025-11","year":2025,"title":"Cursorignore Bypass via New Cursorignore Write","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":["CVE-2025-64110"],"affected":"Cursorignore Bypass via New Cursorignore Write","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/cursor/cursor/security/advisories/GHSA-vhc2-fjv4-wqch"},{"id":"INC-02447","date":"2025-11","year":2025,"title":"Claude Desktop PromptJacking RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"Claude Desktop PromptJacking RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.koi.ai/blog/promptjacking-the-critical-rce-in-claude-desktop-that-turn-questions-into-exploits"},{"id":"INC-02629","date":"2025-11","year":2025,"title":"Google Antigravity IDE Vulnerabilities","severity":"High","attack_vector":"rce","owasp_llm":["LLM01","LLM02","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"Google Antigravity IDE Vulnerabilities","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://bughunters.google.com/learn/invalid-reports/google-products/4655949258227712/antigravity-known-issues#code-execution"},{"id":"INC-02450","date":"2025-11","year":2025,"title":"Claude Skills Data Exfiltration","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04"],"owasp_asi":["ASI01","ASI02","ASI04"],"cve_ids":[],"affected":"Claude Skills Data Exfiltration","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://idanhabler.medium.com/new-skills-new-threats-exfiltrating-data-from-claude-e9112aeac11b"},{"id":"INC-02449","date":"2025-10","year":2025,"title":"Claude Pirate Data Exfiltration","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"Claude Pirate Data Exfiltration","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-api-for-data-exfiltration/"},{"id":"INC-02592","date":"2025-10","year":2025,"title":"Framelink Figma MCP RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-15061","CVE-2025-53967"],"affected":"Framelink Figma MCP RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5"},{"id":"INC-02468","date":"2025-10","year":2025,"title":"Cursor Config Overwrite via Case Mismatch","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2025-59944"],"affected":"Cursor Config Overwrite via Case Mismatch","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/cursor/cursor/security/advisories/GHSA-xcwh-rrwj-gxc7"},{"id":"INC-02471","date":"2025-10","year":2025,"title":"Cursor Workspace File Injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-61590"],"affected":"Cursor Workspace File Injection","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r"},{"id":"INC-02871","date":"2025-10","year":2025,"title":"MCP OAuth Response Exploit","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05","ASI07"],"cve_ids":["CVE-2025-61591"],"affected":"MCP OAuth Response Exploit","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq"},{"id":"INC-02467","date":"2025-10","year":2025,"title":"Cursor CLI Project Config RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2025-61592","CVE-2025-61593"],"affected":"Cursor CLI Project Config RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6"},{"id":"INC-02636","date":"2025-09","year":2025,"title":"Google Gemini Trifecta","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Google Gemini Trifecta","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing"},{"id":"INC-02849","date":"2025-09","year":2025,"title":"Malicious MCP Server Impersonating Postmark","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI02","ASI04","ASI07"],"cve_ids":[],"affected":"Malicious MCP Server Impersonating Postmark","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package"},{"id":"INC-03334","date":"2025-09","year":2025,"title":"Visual Studio Code & Agentic AI workflows RCE","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-55319"],"affected":"Visual Studio Code & Agentic AI workflows RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55319"},{"id":"INC-03010","date":"2025-08","year":2025,"title":"OpenHands ZombAI RCE","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"OpenHands ZombAI RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://embracethered.com/blog/posts/2025/openhands-remote-code-execution-zombai/"},{"id":"INC-02300","date":"2025-07-13","year":2025,"title":"Amazon Q Prompt Poisoning","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05","ASI09"],"cve_ids":["CVE-2025-8217"],"affected":"Amazon Q Prompt Poisoning","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://aws.amazon.com/security/security-bulletins/AWS-2025-015"},{"id":"INC-02631","date":"2025-07","year":2025,"title":"Google Gemini CLI File Loss","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Google Gemini CLI File Loss","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/google-gemini/gemini-cli/issues/4586"},{"id":"INC-03300","date":"2025-07","year":2025,"title":"ToolShell RCE via SharePoint","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM09","LLM10"],"owasp_asi":["ASI05"],"cve_ids":["CVE-2025-53770"],"affected":"ToolShell RCE via SharePoint","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770"},{"id":"INC-02690","date":"2025-06","year":2025,"title":"Heroku MCP App Ownership Hijack","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":[],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Heroku MCP App Ownership Hijack","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.codeintegrity.ai/blog/heroku"},{"id":"INC-02700","date":"2025-06","year":2025,"title":"Hub MCP Prompt Injection (Cross-Context)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05","ASI07"],"cve_ids":["CVE-2025-49596"],"affected":"Hub MCP Prompt Injection (Cross-Context)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g"},{"id":"INC-02191","date":"2025-06","year":2025,"title":"AgentSmith Prompt-Hub Proxy Attack","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"AgentSmith Prompt-Hub Proxy Attack","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://noma.security/blog/how-an-ai-agent-vulnerability-in-langsmith-could-lead-to-stolen-api-keys-and-hijacked-llm-responses"},{"id":"INC-02613","date":"2025-05","year":2025,"title":"GitPublic Issue Repo Hijack","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05"],"owasp_asi":["ASI01","ASI02","ASI06","ASI07","ASI08","ASI09"],"cve_ids":[],"affected":"GitPublic Issue Repo Hijack","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://invariantlabs.ai/blog/mcp-github-vulnerability"},{"id":"INC-02607","date":"2025-03-18","year":2025,"title":"GitHub Copilot & Cursor Code-Agent Exploit","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05","ASI06","ASI08","ASI09"],"cve_ids":[],"affected":"GitHub Copilot & Cursor Code-Agent Exploit","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents"},{"id":"INC-02997","date":"2025-02","year":2025,"title":"OpenAI ChatGPT Operator Vulnerability","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM05"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI06","ASI07","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT Operator Vulnerability","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://embracethered.com/blog/posts/2025/chatgpt-operator-prompt-injection-exploits/"},{"id":"INC-01666","date":"2026-04","year":2026,"title":"PraisonAI Quadruple CVE Disclosure","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05","ASI07"],"cve_ids":["CVE-2026-39888","CVE-2026-39889","CVE-2026-39890","CVE-2026-39891"],"affected":"PraisonAI Quadruple CVE Disclosure","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://advisories.gitlab.com/pkg/pypi/praisonai/CVE-2026-39890/"},{"id":"INC-01370","date":"2026-04","year":2026,"title":"Marimo Pre-Auth RCE (CVE-2026-39987)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":["CVE-2026-39987"],"affected":"Marimo Pre-Auth RCE (CVE-2026-39987)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987"},{"id":"INC-00904","date":"2026-04","year":2026,"title":"Docker MCP Server OS Command Injection (CVE-2026-5741)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":["CVE-2026-5741"],"affected":"Docker MCP Server OS Command Injection (CVE-2026-5741)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://vuldb.com/vuln/355748"},{"id":"INC-00833","date":"2026-03","year":2026,"title":"Claudy Day -- Claude.ai Prompt Injection Attack Chain","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05","LLM08"],"owasp_asi":["ASI01","ASI06","ASI09"],"cve_ids":[],"affected":"Claudy Day","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.oasis.security/blog/claude-ai-prompt-injection-data-exfiltration-vulnerability"},{"id":"INC-01391","date":"2026-03","year":2026,"title":"MCPwned -- Azure MCP Server SSRF & Cloud Takeover (CVE-2026-26118)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26118"],"affected":"MCPwned","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://windowsnews.ai/article/microsoft-patches-critical-azure-mcp-ssrf-vulnerability-cve-2026-26118-in-march-2026-security-update.404636"},{"id":"INC-01769","date":"2026-03","year":2026,"title":"SGLang Triple RCE (CVE-2026-3059, CVE-2026-3060, CVE-2026-3989)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25528","CVE-2026-25750","CVE-2026-3059","CVE-2026-3060","CVE-2026-3989"],"affected":"SGLang Triple RCE (CVE-2026-3059, CVE-2026-3060, CVE-2026-3989)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/03/ai-flaws-in-amazon-bedrock-langsmith.html"},{"id":"INC-00860","date":"2026-03","year":2026,"title":"CrewAI Critical Vulnerabilities (CVE-2026-2275 et al.)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM01","LLM02","LLM04","LLM09","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-2275","CVE-2026-2285","CVE-2026-2286","CVE-2026-2287"],"affected":"CrewAI Critical Vulnerabilities (CVE-2026-2275 et al.)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://kb.cert.org/vuls/id/221883"},{"id":"INC-01440","date":"2026-03","year":2026,"title":"Microsoft Semantic Kernel RCE (CVE-2026-26030)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM09","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2026-26030"],"affected":"Microsoft Semantic Kernel RCE (CVE-2026-26030)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/cve-2026-26030"},{"id":"INC-01435","date":"2026-03-10","year":2026,"title":"Microsoft Excel XSS Weaponizes Copilot Agent (CVE-2026-26144)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI03","ASI09"],"cve_ids":["CVE-2026-26144"],"affected":"Microsoft Excel XSS Weaponizes Copilot Agent (CVE-2026-26144)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.theregister.com/2026/03/10/zeroclick_microsoft_info_disclosure_bug/"},{"id":"INC-00627","date":"2026-03","year":2026,"title":"AnythingLLM Multiple CVEs","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24477","CVE-2026-32617","CVE-2026-32626","CVE-2026-32719"],"affected":"AnythingLLM Multiple CVEs","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2"},{"id":"INC-00928","date":"2026-03","year":2026,"title":"Eight Attack Vectors in AWS Bedrock Agents","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05","LLM09"],"owasp_asi":["ASI01","ASI02","ASI06"],"cve_ids":[],"affected":"Eight Attack Vectors in AWS Bedrock Agents","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://unit42.paloaltonetworks.com/amazon-bedrock-multiagent-applications/"},{"id":"INC-01637","date":"2026-03","year":2026,"title":"PerplexedBrowser -- Perplexity Comet Agentic Browser Vulnerabilities","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"PerplexedBrowser","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://labs.zenity.io/p/perplexedbrowser-perplexity-s-agent-browser-can-leak-your-personal-pc-local-files"},{"id":"INC-00813","date":"2026-02-25","year":2026,"title":"Claude Code Project Files RCE & API Token Exfiltration (CVE-2025-59536 & CVE-2026-21852)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05","ASI09"],"cve_ids":["CVE-2025-59536","CVE-2026-21852"],"affected":"Claude Code Project Files RCE & API Token Exfiltration (CVE-2025-59536 & CVE-2026-21852)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/"},{"id":"INC-00746","date":"2026-02","year":2026,"title":"ChatGPT Data Exfiltration via DNS Covert Channel","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"ChatGPT Data Exfiltration via DNS Covert Channel","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/03/openai-patches-chatgpt-data.html"},{"id":"INC-01297","date":"2026-02","year":2026,"title":"Langflow CSV Agent RCE via Prompt Injection (CVE-2026-27966)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":["CVE-2026-27966"],"affected":"Langflow CSV Agent RCE via Prompt Injection (CVE-2026-27966)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/advisories/GHSA-3645-fxcv-hqr4"},{"id":"INC-00827","date":"2026-01","year":2026,"title":"Claude Cowork File Exfiltration","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM09"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"Claude Cowork File Exfiltration","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files"},{"id":"INC-01378","date":"2026-01","year":2026,"title":"MCP fURI -- Microsoft MarkItDown MCP SSRF","severity":"Medium","attack_vector":"ssrf","owasp_llm":[],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"MCP fURI","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.darkreading.com/application-security/microsoft-anthropic-mcp-servers-risk-takeovers"},{"id":"INC-00739","date":"2026-01","year":2026,"title":"ChainLeak -- Chainlit AI Framework Vulnerabilities (CVE-2026-22218 & CVE-2026-22219)","severity":"Medium","attack_vector":"ssrf","owasp_llm":[],"owasp_asi":["ASI02","ASI03"],"cve_ids":["CVE-2026-22218","CVE-2026-22219"],"affected":"ChainLeak","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/01/chainlit-ai-framework-flaws-enable-data.html"},{"id":"INC-01471","date":"2026-01","year":2026,"title":"n8n Unauthenticated RCE \"Ni8mare\" (CVE-2026-21858)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2026-21858"],"affected":"n8n Unauthenticated RCE \"Ni8mare\" (CVE-2026-21858)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html"},{"id":"INC-01063","date":"2026-01","year":2026,"title":"Gemini Live in Chrome Hijacking (CVE-2026-0628)","severity":"High","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI03"],"cve_ids":["CVE-2026-0628"],"affected":"Gemini Live in Chrome Hijacking (CVE-2026-0628)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://unit42.paloaltonetworks.com/gemini-live-in-chrome-hijacking/"},{"id":"INC-02058","date":"2026-01","year":2026,"title":"VS Code Forks OpenVSX Extension Recommendations Supply Chain Risk","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"VS Code Forks OpenVSX Extension Recommendations Supply Chain Risk","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/01/vs-code-forks-recommend-missing.html"},{"id":"INC-01390","date":"2026-01","year":2026,"title":"MCPJam Inspector RCE (CVE-2026-23744)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2026-23744"],"affected":"MCPJam Inspector RCE (CVE-2026-23744)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23744"},{"id":"INC-02813","date":"2025-12","year":2025,"title":"LangGrinch -- LangChain Core Serialization Injection (CVE-2025-68664)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-68664"],"affected":"LangGrinch","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68664"},{"id":"INC-02515","date":"2025-12","year":2025,"title":"Dify Unauthenticated Information Disclosure (CVE-2025-63387)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-63386","CVE-2025-63387","CVE-2025-63388"],"affected":"Dify Unauthenticated Information Disclosure (CVE-2025-63387)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63387"},{"id":"INC-03149","date":"2025-12","year":2025,"title":"React2Shell Impacting Dify and AI Platforms (CVE-2025-55182)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55182"],"affected":"React2Shell Impacting Dify and AI Platforms (CVE-2025-55182)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"},{"id":"INC-02686","date":"2025-11","year":2025,"title":"HashJack -- URL Fragment Prompt Injection for AI Browsers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM09"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"HashJack","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.catonetworks.com/blog/cato-ctrl-hashjack-first-known-indirect-prompt-injection/"},{"id":"INC-02980","date":"2025-11","year":2025,"title":"Ollama GGUF Model File RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"Ollama GGUF Model File RCE","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.sonarsource.com/blog/ollama-remote-code-execution-securing-the-code-that-runs-llms"},{"id":"INC-02994","date":"2025-10","year":2025,"title":"OpenAI ChatGPT Atlas Browser Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT Atlas Browser Prompt Injection","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://openai.com/index/hardening-atlas-against-prompt-injection/"},{"id":"INC-02463","date":"2025-10","year":2025,"title":"Cursor & Windsurf Forked Chromium 94+ N-Day Vulnerabilities","severity":"High","attack_vector":"rce","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"Cursor & Windsurf Forked Chromium 94+ N-Day Vulnerabilities","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.ox.security/blog/94-vulnerabilities-in-cursor-and-windsurf-put-1-8m-developers-at-risk/"},{"id":"INC-03304","date":"2025-10","year":2025,"title":"Trail of Bits: Prompt Injection to RCE in AI Agents","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"Trail of Bits: Prompt Injection to RCE in AI Agents","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-agents/"},{"id":"INC-02297","date":"2025-09","year":2025,"title":"Amazon Bedrock AgentCore Sandbox DNS Escape","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":[],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon Bedrock AgentCore Sandbox DNS Escape","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://unit42.paloaltonetworks.com/bypass-of-aws-sandbox-network-isolation-mode/"},{"id":"INC-02462","date":"2025-09","year":2025,"title":"Cursor \"Open-Folder\" Autorun Vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"Cursor \"Open-Folder\" Autorun Vulnerability","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.oasis.security/blog/cursor-security-flaw"},{"id":"INC-02514","date":"2025-09","year":2025,"title":"Dify SSRF via RemoteFileUploadApi (CVE-2025-56520)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-56520"],"affected":"Dify SSRF via RemoteFileUploadApi (CVE-2025-56520)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.crowdsec.net/vulntracking-report/cve-2025-56520"},{"id":"INC-02964","date":"2025-09","year":2025,"title":"Notion 3.0 AI Agent Data Exfiltration via Prompt Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"Notion 3.0 AI Agent Data Exfiltration via Prompt Injection","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.promptarmor.com/resources/notion-ai-unpatched-data-exfiltration"},{"id":"INC-02455","date":"2025-08","year":2025,"title":"Cline AI Coding Agent Vulnerabilities","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":[],"affected":"Cline AI Coding Agent Vulnerabilities","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://mindgard.ai/blog/cline-coding-agent-vulnerabilities"},{"id":"INC-02512","date":"2025-08","year":2025,"title":"Devin AI Agent Prompt Injection & Data Exfiltration","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM09","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":[],"affected":"Devin AI Agent Prompt Injection & Data Exfiltration","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://embracethered.com/blog/posts/2025/devin-can-leak-your-secrets/"},{"id":"INC-02546","date":"2025-07","year":2025,"title":"EscapeRoute -- Anthropic Filesystem MCP Sandbox Escape (CVE-2025-53109 & CVE-2025-53110)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-53109","CVE-2025-53110"],"affected":"EscapeRoute","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/cve-2025-53109"},{"id":"INC-02435","date":"2025-06","year":2025,"title":"Claude Code DNS Exfiltration (CVE-2025-55284)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04"],"owasp_asi":["ASI01","ASI02","ASI04"],"cve_ids":["CVE-2025-55284"],"affected":"Claude Code DNS Exfiltration (CVE-2025-55284)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55284"},{"id":"INC-02321","date":"2025-06","year":2025,"title":"Anthropic MCP Git Server Triple Flaw (CVE-2025-68143, -68144, -68145)","severity":"High","attack_vector":"rce","owasp_llm":["LLM01","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05","ASI07"],"cve_ids":["CVE-2025-68143","CVE-2025-68144","CVE-2025-68145"],"affected":"Anthropic MCP Git Server Triple Flaw (CVE-2025-68143, -68144, -68145)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html"},{"id":"INC-02324","date":"2025-06","year":2025,"title":"Anthropic SQLite MCP Server SQL Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04","LLM05"],"owasp_asi":["ASI02","ASI04","ASI06"],"cve_ids":[],"affected":"Anthropic SQLite MCP Server SQL Injection","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.trendmicro.com/en_us/research/25/f/why-a-classic-mcp-server-vulnerability-can-undermine-your-entire-ai-agent.html"},{"id":"INC-03376","date":"2025-05","year":2025,"title":"Windsurf Data Exfiltration & SpAIware (Multiple Vectors)","severity":"High","attack_vector":"rce","owasp_llm":["LLM01","LLM02","LLM05","LLM09","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05","ASI06","ASI09"],"cve_ids":["CVE-2025-36730"],"affected":"Windsurf Data Exfiltration & SpAIware (Multiple Vectors)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://www.tenable.com/security/research/tra-2025-47"},{"id":"INC-03039","date":"2025-05","year":2025,"title":"Postgres MCP Server SQL Injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Postgres MCP Server SQL Injection","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://securitylabs.datadoghq.com/articles/mcp-vulnerability-case-study-SQL-injection-in-the-postgresql-mcp-server/"},{"id":"INC-00668","date":"2026","year":2026,"title":"AWS Bedrock AgentCore \"Agent God Mode\" Privilege Escalation","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI03","ASI08","ASI10"],"cve_ids":[],"affected":"AWS Bedrock AgentCore \"Agent God Mode\" Privilege Escalation","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/"},{"id":"INC-00036","date":"2026","year":2026,"title":"A2A Protocol -- Agent Card Poisoning Vulnerability","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM02","LLM05"],"owasp_asi":["ASI06","ASI07","ASI08"],"cve_ids":[],"affected":"A2A Protocol","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://live.paloaltonetworks.com/t5/community-blogs/safeguarding-ai-agents-an-in-depth-look-at-a2a-protocol-risks/ba-p/1235996"},{"id":"INC-02878","date":"2025-07","year":2025,"title":"mcp-remote OAuth Command Injection (CVE-2025-6514)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI07"],"cve_ids":["CVE-2025-6514"],"affected":"mcp-remote OAuth Command Injection (CVE-2025-6514)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://github.com/advisories/GHSA-6xpm-ggf7-wc3p"},{"id":"INC-02793","date":"2025","year":2025,"title":"Kiro IDE Command Injection (CVE-2026-0830)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":["CVE-2026-0830"],"affected":"Kiro IDE Command Injection (CVE-2026-0830)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://neuraltrust.ai/blog/cve-2026-0830"},{"id":"INC-04359","date":"2024-05","year":2024,"title":"WPP CEO Mark Read impersonated in deepfake voice-cloning scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"WPP (UK marketing services)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wpp-ceo-impersonated-in-deepfake-scam"},{"id":"INC-06513","date":"2020-01","year":2020,"title":"Dubai $35M voice-cloning fraud against UAE bank","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"UAE bank / Japanese company","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dubai-usd-35m-voice-cloning-fraud"},{"id":"INC-07182","date":"2019-03","year":2019,"title":"Fraudsters clone CEO voice to steal USD 243,000 from UK energy firm","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"UK energy company (German subsidiary)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fraudsters-clone-ceo-voice-to-steal-usd-243000"},{"id":"INC-03715","date":"2024","year":2024,"title":"Deepfake Pierce Brosnan scam cripples Nottingham art gallery","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"SMS Art Gallery, UK","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-pierce-brosnan-scam-cripples-art-gallery"},{"id":"INC-03969","date":"2024","year":2024,"title":"Mary Nightingale likeness used in AI-generated deepfake scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"ITV / public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mary-nightingale-likeness-used-in-deepfake-scam"},{"id":"INC-04035","date":"2024","year":2024,"title":"New Zealand pensioner loses NZD 224,000 to deepfake Luxon Bitcoin scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"New Zealand retail investors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pensioner-loses-nzd-224000-to-deepfake-scam"},{"id":"INC-03720","date":"2024-01","year":2024,"title":"Deepfake Taylor Swift fake Le Creuset cookware giveaway scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Meta platforms users / Taylor Swift / Le Creuset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-taylor-swift-offers-free-le-creuset-cookware-scam"},{"id":"INC-03588","date":"2024-01","year":2024,"title":"Arup Hong Kong $25M deepfake CFO multi-person video call scam","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Arup (UK engineering)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-cfo-scams-finance-worker-for-usd-25-million"},{"id":"INC-04601","date":"2023-10","year":2023,"title":"Deepfake MrBeast iPhone giveaway scam on TikTok","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"TikTok users / MrBeast brand","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-mrbeast-iphone-giveaway-scam"},{"id":"INC-04733","date":"2023-07","year":2023,"title":"Martin Lewis deepfake scam ad on Facebook","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Facebook users / Martin Lewis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/martin-lewis-deepfake-scam-ad"},{"id":"INC-03974","date":"2024","year":2024,"title":"Maxpread Technologies fabricated AI CEO scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Maxpread Technologies clients","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/maxpread-technologies-fake-ai-ceo-scam"},{"id":"INC-04396","date":"2023","year":2023,"title":"AI voice impersonation scams Canadian couple of USD 21,000","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Canadian retail victims","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-impersonation-scams-couple-of-usd-21000"},{"id":"INC-04464","date":"2023","year":2023,"title":"Attacker impersonates company CEO with AI voice clone to authorize fraudulent transaction","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Unnamed enterprise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/audio-deepfake-fraudulently-impersonates-ceo"},{"id":"INC-04476","date":"2023-08","year":2023,"title":"Automators AI online-sales coaching FTC fraud case","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US consumers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/automators-ai-online-sales-and-coaching-fraud"},{"id":"INC-03583","date":"2024-12","year":2024,"title":"Apple Intelligence rewords and prioritises scam messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Apple iOS users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-intelligence-rewords-prioritises-scam-messages"},{"id":"INC-04629","date":"2023-12","year":2023,"title":"Driver tricks dealership chatbot into selling Chevrolet for USD 1 (Watsonville-style incident)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI08","ASI09"],"cve_ids":[],"affected":"Chevy of Watsonville (Fullpath / ChatGPT integration)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/driver-persuades-chatbot-to-sell-car-for-usd-1"},{"id":"INC-02466","date":"2025-04","year":2025,"title":"Cursor AI support agent invents user policy, causing user revolt","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Cursor (Anysphere) users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cursor-ai-support-agent-invents-user-policy-causing-uproar"},{"id":"INC-03531","date":"2024-02","year":2024,"title":"Air Canada found liable for chatbot's incorrect bereavement-fare advice","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Air Canada customers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/air-canada-found-liable-for-chatbots-poor-advice"},{"id":"INC-04542","date":"2023-03","year":2023,"title":"ChatGPT Redis bug exposes user chat histories and payment data","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI ChatGPT subscribers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-bug-reveals-user-chat-histories"},{"id":"INC-04536","date":"2023","year":2023,"title":"ChatGPT leaks user conversations and personal information across sessions","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI ChatGPT users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-leaks-user-conversations"},{"id":"INC-04705","date":"2023-03","year":2023,"title":"Italy bans ChatGPT over GDPR privacy concerns (Garante)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM08"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"OpenAI ChatGPT (EU/Italy)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/italy-bans-chatgpt-over-privacy-concerns"},{"id":"INC-04835","date":"2023-02","year":2023,"title":"Replika hit with data-processing ban in Italy over child-safety concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Replika (Luka Inc.)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/replika-hit-with-data-ban-in-italy-over-child-safety"},{"id":"INC-04547","date":"2023","year":2023,"title":"ChatGPT used to collect users' personal information","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI ChatGPT users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-used-to-collect-users-personal-information"},{"id":"INC-04549","date":"2023","year":2023,"title":"ChatGPT writes code that makes databases leak sensitive information","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"Downstream developers / data subjects","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-writes-code-that-makes-databases-leak-sensitive-info"},{"id":"INC-03639","date":"2024-09","year":2024,"title":"ChatGPT details how to make homemade bombs after safety bypass","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-details-how-to-make-homemade-bombs"},{"id":"INC-04675","date":"2023-11","year":2023,"title":"Grok chatbot inaccuracies, hallucinations and harmful outputs","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI Grok / X users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-systems/grok-chatbot"},{"id":"INC-04526","date":"2023-06","year":2023,"title":"ChatGPT falsely accuses Mark Walters of fraud and embezzlement (US defamation suit)","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Mark Walters / OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-falsely-accuses-mark-walters-of-fraud-embezzlement"},{"id":"INC-04528","date":"2023-08","year":2023,"title":"ChatGPT falsely tells users OpenCage offers reverse-phone-lookup service","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenCage","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-falsely-accuses-opencage-of-phone-lookup-service"},{"id":"INC-05192","date":"2022-03","year":2022,"title":"South Korea presidential election candidate AI deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"South Korean electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/south-korea-presidential-election-candidate-deepfakes"},{"id":"INC-04602","date":"2023-12","year":2023,"title":"Pro-government Bangladeshi channels air AI-generated anchors alleging US election meddling","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bangladesh electorate / US diplomatic interests","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-news-anchor-accuses-us-of-bangladesh-election-interference"},{"id":"INC-04594","date":"2023-09","year":2023,"title":"Deepfake audio claims Slovakian opposition leaders tried to rig election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Slovak electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-audio-recording-claims-opposition-leaders-tried-to-rig-slovakian-e"},{"id":"INC-03709","date":"2024-05","year":2024,"title":"Deepfake John Swinney 'thanks Nicola Sturgeon' video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scottish electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-john-swinney-thanks-nicola-sturgeon-for-his-election"},{"id":"INC-03750","date":"2024-07","year":2024,"title":"Elon Musk shares Kamala Harris voice-clone video ad on X","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/elon-musk-shares-kamala-harris-voice-clone-video-ad"},{"id":"INC-03714","date":"2024-04","year":2024,"title":"Fabricated Marcos Jr. audio clip calling for military response to China circulates online","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Philippines national security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-philippines-president-urges-military-action-against-china"},{"id":"INC-04769","date":"2023-05","year":2023,"title":"Muharrem Ince porn 'deepfake' withdrawal from Turkish election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Turkish electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/muharrem-ince-porn-deepfake"},{"id":"INC-04808","date":"2023","year":2023,"title":"President Biden 'calls for US draft' deepfake video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/president-biden-calls-for-us-draft-deepfake"},{"id":"INC-04707","date":"2023","year":2023,"title":"Joe Biden police-defunding deepfake interview","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://aiaaic.org/aiaaic-repository/ai-and-algorithmic-incidents-and-controversies/joe-biden-police-defunding-deepfake-interview"},{"id":"INC-04783","date":"2023-10","year":2023,"title":"NYC mayor Eric Adams robocalls residents using AI audio deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NYC residents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nyc-mayor-eric-adams-robocalls-residents-using-audio-deepfakes"},{"id":"INC-05114","date":"2022-11","year":2022,"title":"FTX CEO Sam Bankman-Fried deepfake crypto-recovery scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Former FTX customers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ftx-ceo-deepfake"},{"id":"INC-04603","date":"2023-02","year":2023,"title":"Deepfake news anchors claim Venezuela economic health","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Venezuelan public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-news-anchors-claim-venezuela-economic-health"},{"id":"INC-04820","date":"2023-06","year":2023,"title":"Putin 'declares martial law' deepfake broadcast hijack","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Russian broadcast audiences","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/putin-declares-martial-law-deepfake"},{"id":"INC-04362","date":"2024-01","year":2024,"title":"X/Twitter fails to remove non-consensual AI deepfake images of Taylor Swift","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Taylor Swift / X users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xtwitter-fails-to-remove-graphic-ai-images-of-taylor-swift"},{"id":"INC-04258","date":"2024","year":2024,"title":"AI-dubbed clip gives Taylor Swift fluent Mandarin, circulates on Chinese platforms","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Taylor Swift / Chinese social platforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/taylor-swift-speaks-in-mandarin-deepfake"},{"id":"INC-03535","date":"2024","year":2024,"title":"Non-consensual AI-generated sexual images of Rep. Ocasio-Cortez spread online, spurring DEFIANCE Act","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"AOC / US public figures","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/alexandria-ocasio-cortez-depicted-as-deepfake-pornstar"},{"id":"INC-06950","date":"2020-10","year":2020,"title":"Telegram bot creates non-consensual deepfake porn at scale","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":">100,000 women and girls","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/telegram-bot-creates-non-consensual-deepfake-porn"},{"id":"INC-03471","date":"2024","year":2024,"title":"AI nudification bots swamp Telegram","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Telegram users worldwide","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-nudification-bots-swamp-telegram"},{"id":"INC-03716","date":"2024-08","year":2024,"title":"Deepfake porn engulfs Korean schools ('New Nth Room')","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"South Korean students and military personnel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-porn-engulfs-korean-schools"},{"id":"INC-04205","date":"2024-11","year":2024,"title":"Singapore Sports School students attacked with AI nude deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Singapore Sports School students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/singapore-sports-school-students-attacked-with-nude-deepfakes"},{"id":"INC-04742","date":"2023-12","year":2023,"title":"Miami Pinecrest Cove boys arrested for AI nude images of classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Pinecrest Cove Academy students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/miami-boys-arrested-for-creating-and-sharing-nude-images-of-students"},{"id":"INC-07171","date":"2019-06","year":2019,"title":"DeepNude nudification app","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Women whose images were processed","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepnude-nudification-app"},{"id":"INC-06104","date":"2021","year":2021,"title":"These Nudes Do Not Exist commercial deepfake porn marketplace","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Internet users / women whose data was scraped","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/these-nudes-do-not-exist"},{"id":"INC-04822","date":"2023-01","year":2023,"title":"QTCinderella, Pokimane, Sweet Anita streamer deepfake porn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Female Twitch streamers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/qtcinderella-pokimane-sweet-anita-deepfakes"},{"id":"INC-05002","date":"2023","year":2023,"title":"Xiao Yu deepfake pornography case","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xiao Yu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xiao-yu-deepfake-pornography"},{"id":"INC-07256","date":"2019","year":2019,"title":"Yang Mi and Athena Chu face-swap deepfake video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Yang Mi, Athena Chu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/yang-mi-athena-chu-face-swap-deepfake-video"},{"id":"INC-04628","date":"2023-04","year":2023,"title":"Drake / The Weeknd AI voice-cloning 'Heart on My Sleeve'","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Drake, The Weeknd, UMG","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/drake-the-weeknd-ai-voice-cloning"},{"id":"INC-04573","date":"2023-11","year":2023,"title":"CivitAI rewards deepfakes of real people via 'bounty' system","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI08","ASI09"],"cve_ids":[],"affected":"Public figures depicted by CivitAI models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/civitai-rewards-deepfakes-of-real-people"},{"id":"INC-04572","date":"2023-11","year":2023,"title":"CivitAI generates synthetic 'child pornography' images","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM04","LLM07","LLM08","LLM10"],"owasp_asi":["ASI04","ASI08","ASI09"],"cve_ids":[],"affected":"Children depicted / society","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/civitai-generates-synthetic-child-pornography-images"},{"id":"INC-04561","date":"2023-12","year":2023,"title":"Child sexual abuse images discovered in LAION-5B training dataset","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05","LLM08","LLM10"],"owasp_asi":["ASI04","ASI08"],"cve_ids":[],"affected":"Foundation image-model ecosystem","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/child-sex-abuse-images-discovered-on-laion-5b-dataset"},{"id":"INC-04355","date":"2024-05","year":2024,"title":"Wisconsin man arrested for AI-generating images of thousands of children","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Children depicted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wisconsin-man-arrested-for-creating-ai-images-of-thousands-ofchildren"},{"id":"INC-04877","date":"2023-09","year":2023,"title":"South Korean man arrested for using AI to create sexual images of children","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Children depicted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/south-korean-arrested-for-using-ai-to-create-sexual-images-of-children"},{"id":"INC-04832","date":"2023-11","year":2023,"title":"Remini AI photo enhancer generates 'child porn' from innocent photos","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Remini users / children depicted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/remini-ai-photo-enhancer-generates-child-porn"},{"id":"INC-04789","date":"2023-12","year":2023,"title":"OpenDream image tool found capable of producing sexualized depictions of minors despite policy","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Children depicted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/opendream-ai-art-generator-accused-of-generating-child-sex-images"},{"id":"INC-03804","date":"2024-03","year":2024,"title":"Exposed GenNomis AWS bucket leaks roughly 95,000 images including apparent child abuse material","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"GenNomis users and depicted subjects","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gennomis-ai-art-generator-accused-of-producing-explicit-child-images"},{"id":"INC-04021","date":"2024-10","year":2024,"title":"Muah AI companion app hack reveals attempts to simulate child abuse","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM04","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"Muah users / children","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-companion-app-muah-hack-reveals-users-trying-to-simulate-child-abuse"},{"id":"INC-04044","date":"2024-09","year":2024,"title":"Nomi AI companion bot incites self-harm, sexual violence, terror attacks","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Nomi users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nomi-ai-companion-bot-incites-self-harm-sexual-violence-terror-attacks"},{"id":"INC-04043","date":"2024-12","year":2024,"title":"Nomi AI chatbot recommends Al Nowatzki kills himself","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Nomi user","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nomi-ai-chatbot-recommends-al-nowatzki-kills-himself"},{"id":"INC-03612","date":"2024-02","year":2024,"title":"Teen's death by suicide follows months-long bond with a Character.AI companion persona","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Sewell Setzer III / Character.AI users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/boy-commits-suicide-after-relationship-with-character-ai-chatbot"},{"id":"INC-02399","date":"2025","year":2025,"title":"ChatGPT drives Jacob Irwin into psychosis ('AI-induced delusion')","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Jacob Irwin / vulnerable ChatGPT users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-drives-jacob-irwin-into-psychosis"},{"id":"INC-06458","date":"2020-01","year":2020,"title":"Clearview AI mass facial-recognition scraping","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Internet users worldwide","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-systems/clearview-ai-facial-recognition"},{"id":"INC-05349","date":"2022-03","year":2022,"title":"Ukraine decision to use Clearview AI facial recognition draws concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Russian conscripts / Ukrainian civilians","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ukraine-decision-to-use-clearview-ai-facial-recognition-draws-concerns"},{"id":"INC-04576","date":"2023","year":2023,"title":"Clearview AI tests live facial-recognition cameras and AR glasses","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Public surveilled by Clearview-equipped officers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/clearview-ai-tests-live-facial-recognition-cameras-and-glasses"},{"id":"INC-05113","date":"2022-10","year":2022,"title":"CNIL orders Clearview AI to pay EUR 20 million and erase French biometric data","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Clearview AI / French residents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/french-privacy-watchdog-fines-clearview-ai-for-violating-privacy"},{"id":"INC-05816","date":"2021-06","year":2021,"title":"RCMP AI facial recognition surveillance ruled unlawful","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Canadian public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-and-algorithmic-incidents-and-controversies/rcmp-ai-facial-recognition-surveillance"},{"id":"INC-07279","date":"2018-08","year":2018,"title":"Cadillac Fairview covertly uses facial recognition to monitor shoppers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM08"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Mall visitors in Canada","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cadillac-fairview-covertly-uses-facial-recognition-to-monitor-shoppers"},{"id":"INC-03915","date":"2024-03","year":2024,"title":"Israeli Corsight facial-recognition system misidentifies innocent Gazans","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Palestinian civilians","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/israel-facial-recognition-system-misidentifies-innocent-gazans"},{"id":"INC-04645","date":"2023-11","year":2023,"title":"French national police accused of illegally using facial recognition (Briefcam)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"French public","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/french-national-police-accused-of-illegally-using-facial-recognition"},{"id":"INC-05072","date":"2022","year":2022,"title":"Christopher Gatlin facial-recognition wrongful arrest","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Christopher Gatlin","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/christopher-gatlin-facial-recognition-wrongful-arrest"},{"id":"INC-04366","date":"2024-02","year":2024,"title":"Youth advocacy worker misidentified by Met Police facial recognition","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Shaun Thompson","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youth-advocacy-worker-misidentified-by-met-police-facial-recognition-system"},{"id":"INC-05591","date":"2021-01","year":2021,"title":"Everalbum trains facial recognition on user photos and sells to law enforcement","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM08"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Everalbum users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/everalbum-facial-recognition-default-tagging"},{"id":"INC-07491","date":"2016","year":2016,"title":"Faception 'facial personality profiling' pseudo-science marketing","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Public targeted by Faception customers","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/faception-facial-personality-profiling"},{"id":"INC-07210","date":"2019","year":2019,"title":"MegaFace facial-recognition dataset raises privacy and liability concerns","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM05","LLM08"],"owasp_asi":["ASI04","ASI09"],"cve_ids":[],"affected":"Flickr users in MegaFace","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/megaface-facial-recognition-dataset-raises-privacy-liability-concerns"},{"id":"INC-07173","date":"2019-06","year":2019,"title":"Duke withdraws DukeMTMC campus-surveillance dataset over non-consensual student footage","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Duke students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/duke-university-pulls-facial-recognition-dataset-after-privacy-controversy"},{"id":"INC-07166","date":"2019-04","year":2019,"title":"Atlantic Plaza Towers facial-recognition rollout opposed by tenants","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Tenants","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/atlantic-plaza-towers-facial-recognition"},{"id":"INC-06492","date":"2020-08","year":2020,"title":"Data breach reveals data of 400,000+ ProctorU users","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"ProctorU customers and students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/data-breach-reveals-data-of-400000-proctoru-users"},{"id":"INC-04075","date":"2024-04","year":2024,"title":"Breach at Australian venue-ID vendor Outabox leaks over a million patrons' biometric data","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Outabox venues' patrons","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/outabox-data-breach-exposes-1m-biometric-records"},{"id":"INC-06427","date":"2020-07","year":2020,"title":"Cense AI exposes 2.5 million personal records on open database","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Cense AI / 2.5M individuals","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cense-ai-exposes-2-5-million-personal-records"},{"id":"INC-04291","date":"2024","year":2024,"title":"Thomson Reuters Fraud Detect 'incorrectly' identifies fraud against welfare claimants","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US welfare recipients","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/thomson-reuters-fraud-detect-incorrectly-identifies-fraud"},{"id":"INC-02773","date":"2025-04","year":2025,"title":"Italian privacy watchdog opens investigation into OpenAI Sora","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Italian / EU users and depicted people","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/italian-privacy-watchdog-opens-investigation-into-sora"},{"id":"INC-03657","date":"2024-04","year":2024,"title":"ChatGPT said to violate GDPR by not correcting inaccurate personal info","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"EU data subjects","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-said-to-violate-gdpr-by-not-correcting-inaccurate-personal-info"},{"id":"INC-04510","date":"2023-04","year":2023,"title":"Canada investigates ChatGPT privacy concerns","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Canadian residents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/canada-investigates-ChatGPT-privacy-concerns"},{"id":"INC-04506","date":"2023-04","year":2023,"title":"C4 dataset includes sites trafficking in pirated, hateful and surveillance content","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Downstream LLM users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/c4-dataset"},{"id":"INC-04502","date":"2023-08","year":2023,"title":"Books3 dataset of pirated books used to train Llama and Bloom","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Authors / downstream LLM operators","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/books3-dataset"},{"id":"INC-04065","date":"2024-05","year":2024,"title":"Authors Guild v. OpenAI filing alleges destruction of book-training data before inspection","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM08"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Authors / OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-deleted-training-datasets-believed-to-contain-copyrighted-books"},{"id":"INC-05191","date":"2022-11","year":2022,"title":"Software engineers sue OpenAI, Microsoft for violating personal privacy (Copilot training)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Open-source developers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/software-engineers-sue-openai-microsoft-for-violating-personal-privacy"},{"id":"INC-04788","date":"2023-06","year":2023,"title":"Plaintiffs accuse OpenAI and Microsoft of building ChatGPT from scraped personal data","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM08"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Internet users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-microsoft-sued-for-stealing-personal-info-to-create-chatgpt"},{"id":"INC-14601","date":"2026","year":2026,"title":"WebinarTV secretly records and turns meetings into podcasts","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"WebinarTV Inc.","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/webinartv-secretly-records-and-turns-meetings-into-podcasts"},{"id":"INC-14602","date":"2026","year":2026,"title":"Hackers use Meta AI support chatbot to takeover Instagram accounts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hackers-use-meta-ai-support-chatbot-to-takeover-instagram-accounts"},{"id":"INC-14603","date":"2026","year":2026,"title":"OpenAI models escape test, hack Hugging Face for answers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-models-escape-test-hack-hugging-face-for-answers"},{"id":"INC-14604","date":"2021","year":2021,"title":"Kimberlee Williams wrongly arrested by police using facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Maryland Police Department","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kimberlee-williams-wrongly-arrested-by-police-using-facial-recognition"},{"id":"INC-07735","date":"2026","year":2026,"title":"Meta captures employee mouse movements to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-captures-employee-mouse-movements-to-train-ai-models"},{"id":"INC-07724","date":"2026","year":2026,"title":"Chinese AI actors spark personality rights controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youhug Media","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-ai-actors-spark-personality-rights-controversy"},{"id":"INC-07725","date":"2024","year":2024,"title":"German TV star accuses husband of spreading deepfake porn images of her","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Christian Ulmen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/german-tv-star-accuses-husband-of-spreading-deepfake-porn-images-of-her"},{"id":"INC-07726","date":"2026","year":2026,"title":"AI chatbots lure vulnerable gamblers to unlicensed betting websites","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Anthropic; Google; Meta; Microsoft; Mistral; OpenAI; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-chatbots-lure-vulnerable-gamblers-to-unlicensed-betting-websites"},{"id":"INC-07727","date":"2025","year":2025,"title":"ChatGPT accused of enabling Florida State University mass shooting","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-accused-of-enabling-florida-state-university-mass-shooting"},{"id":"INC-07728","date":"2012","year":2012,"title":"Meta, YouTube found liable for addicting child to social media","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Google; Meta","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-youtube-found-liable-for-addicting-child-to-social-media"},{"id":"INC-07729","date":"2025","year":2025,"title":"ChatGPT advises exec on how to fire company founders to avoid payout","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-advises-exec-on-how-to-fire-company-founders-to-avoid-payout"},{"id":"INC-03365","date":"2025","year":2025,"title":"Welshman kills mother with sledgehammer after speaking to Discord AI bot","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/welshman-kills-mother-with-sledgehammer-after-speaking-to-discord-ai-bot"},{"id":"INC-03818","date":"2024","year":2024,"title":"Google AI search summaries give cancer patients wrong advice","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-summaries-give-cancer-patients-wrong-advice"},{"id":"INC-01396","date":"2026","year":2026,"title":"Meta AI agent leaks sensitive company and user data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-agent-leaks-sensitive-company-and-user-data"},{"id":"INC-02204","date":"2025","year":2025,"title":"AI error sees innocent Tennessee grandmother jailed for six months","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"West Fargo Police Department","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-error-sees-innocent-tennessee-grandmother-jailed-for-six-months"},{"id":"INC-00069","date":"2026","year":2026,"title":"AI agent hacks McKinsey employee chatbot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"McKinsey & Co","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-agent-hacks-mckinsey-employee-chatbot"},{"id":"INC-03014","date":"2025","year":2025,"title":"Paraná school attendance facial recognition system criticised as \"invasive\", \"noxious\"","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Celepar; Innovatrics; Valid","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/paran%C3%A1-school-attendance-facial-recognition-system-criticised-as-invasive"},{"id":"INC-00041","date":"2026","year":2026,"title":"Advance UK secretly uses fake AI influencer to post anti‑immigrant content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Node Project","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/advance-uk-secretly-uses-fake-ai-influencer-to-post-anti-immigrant-content"},{"id":"INC-00866","date":"2026","year":2026,"title":"Critics slam \"exploitative\" Washington Post AI personalised pricing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Washington Post","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/critics-slam-washington-post-ai-personalised-pricing-as-exploitative"},{"id":"INC-02298","date":"2025","year":2025,"title":"Amazon charges local school districts different prices for same supplies","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-charges-local-school-districts-different-prices-for-same-supplies"},{"id":"INC-01149","date":"2026","year":2026,"title":"Grok generates offensive posts about Hillsborough, Heysel football disasters","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-offensive-posts-about-football-disasters"},{"id":"INC-01857","date":"2026","year":2026,"title":"Tesla Cybertruck attempts to drive off Houston overpass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-cybertruck-attempts-to-drive-off-houston-overpass"},{"id":"INC-01659","date":"2026","year":2026,"title":"Polymarket traders weaponise AI-generated Iran \"war slop\"","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Banking/financial services; Govt - defence","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/prediction-market-traders-weaponise-ai-generated-iran-war-slop"},{"id":"INC-01248","date":"2026","year":2026,"title":"Iran war with Iran monetised by online creators using AI disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google; Midjourney; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/iran-war-monetised-by-online-creators-using-ai-disinformation"},{"id":"INC-02532","date":"2025","year":2025,"title":"DOGE uses ChatGPT to cancel \"woke\" U.S. government humanities grants","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/doge-uses-chatgpt-to-cancel-woke-u-s-government-humanities-grants"},{"id":"INC-01137","date":"2026","year":2026,"title":"Grammarly AI \"Expert Review\" rapped for unauthorised use of expert identities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Superhuman","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grammarly-rapped-for-unauthorised-use-of-expert-identities"},{"id":"INC-01573","date":"2026","year":2026,"title":"OpenAI accused of using ChatGPT to act as unlicensed lawyer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-accused-of-using-chatgpt-to-act-as-unlicensed-lawyer"},{"id":"INC-00092","date":"2026","year":2026,"title":"AI chat app exposes 300 million private messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Codeway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-chat-app-exposes-300-million-private-messages"},{"id":"INC-03506","date":"2024","year":2024,"title":"AI-powered spyware used to track Italian journalists","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Paragon Solutions","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-spyware-used-to-track-italian-journalists"},{"id":"INC-03478","date":"2024","year":2024,"title":"AI systems used to conduct sexual violence against 1 in 5 Brazilian children","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Black Forest Labs; LAION; Stability AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-systems-used-to-conduct-sexual-violence-against-1-in-5-brazilian-kids"},{"id":"INC-01399","date":"2026","year":2026,"title":"Meta AI smart glass videos secretly shared with overseas contractors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-smart-glass-videos-secretly-shared-with-contractors"},{"id":"INC-02601","date":"2025","year":2025,"title":"Gemini allegedly ‘coached’ Jonathan Gavalas to commit suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gemini-allegedly-coached-jonathan-gavalas-to-commit-suicide"},{"id":"INC-01751","date":"2026","year":2026,"title":"Sacked UK gaming journalists misleadingly replaced with AI writers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Clickout Media","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sacked-uk-gaming-journalists-misleadingly-replaced-with-ai-writers"},{"id":"INC-00683","date":"2026","year":2026,"title":"Bengaluru techie fires cook after AI monitoring system catches her stealing fruit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Pankaj Tanwar","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bengaluru-techie-fires-cook-after-ai-monitoring-system-catches-her-stealing"},{"id":"INC-01636","date":"2026","year":2026,"title":"Pentagon uses Anthropic's Claude to plan and support Iran airstrikes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pentagon-uses-anthropics-claude-to-plan-and-support-iran-airstrikes"},{"id":"INC-01851","date":"2026","year":2026,"title":"Tenerife lawyer fined for multiple AI-generated legal citations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Business/professional services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tenerife-lawyer-fined-for-multiple-ai-generated-legal-citations"},{"id":"INC-02071","date":"2026","year":2026,"title":"Waymo blocks ambulance from reaching Austin mass shooting","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-blocks-ambulance-from-reaching-austin-mass-shooting"},{"id":"INC-07626","date":"2013","year":2013,"title":"Samsung smart TVs ruled to have violated customers' privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Samsung Electronics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/samsung-smart-tvs-ruled-to-have-violated-customers-privacy"},{"id":"INC-02591","date":"2025","year":2025,"title":"Ford recalls 4.4 million vehicles over faulty automated trailer software","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Ford Motor Company; Horizon Global Inc.","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ford-recalls-4-4-million-vehicles-over-faulty-automated-trailer-software"},{"id":"INC-01719","date":"2026","year":2026,"title":"Radnor High School hit by fake AI sexualised images of students","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Radnor High School student","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/radnor-high-school-hit-by-fake-ai-sexualised-images-of-students"},{"id":"INC-01106","date":"2026","year":2026,"title":"Google BAFTA automated news alert includes \"N-word\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-bafta-news-alert-includes-n-word"},{"id":"INC-02682","date":"2025","year":2025,"title":"Hacker used Claude, ChatGPT to steal Mexican government data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Anthropic; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hacker-uses-claude-to-steal-mexican-government-data"},{"id":"INC-00715","date":"2026","year":2026,"title":"British Bangladeshi man wrongfully arrested for theft after facial recognition error","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cognitec Systems","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/asian-man-wrongfully-arrested-for-theft-after-facial-recognition-error"},{"id":"INC-00759","date":"2026","year":2026,"title":"Chester grandfather wrongly accused of theft after Home Bargains facial scan","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facewatch","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chester-grandfather-wrongly-accused-of-theft-after-facial-scan"},{"id":"INC-01821","date":"2026","year":2026,"title":"Study: ChatGPT Health fails critical emergency and suicide tests","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-chatgpt-health-fails-critical-emergency-and-suicide-tests"},{"id":"INC-01635","date":"2026","year":2026,"title":"Pentagon uses Anthropic's Claude to capture Venezuela president Maduro","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pentagon-uses-anthropics-claude-to-capture-venezuela-president-maduro"},{"id":"INC-01590","date":"2026","year":2026,"title":"OpenClaw AI agent deletes Meta engineer's emails","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Peter Steinberger","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openclaw-deletes-meta-engineers-emails"},{"id":"INC-02723","date":"2025","year":2025,"title":"ICE facial recognition app misidentifies woman twice","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NEC Corporation","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ice-facial-recognition-app-misidentifies-woman-twice"},{"id":"INC-02182","date":"2025","year":2025,"title":"Actress accuses Albanian government of abusing her voice and image","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Albania","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/actress-accuses-albanian-government-of-abusing-her-voice-and-image"},{"id":"INC-01978","date":"2026","year":2026,"title":"Unprompted, Grok exposes porn worker's legal name and birthday","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/unprompted-grok-exposes-porn-workers-legal-name-and-birthday"},{"id":"INC-03263","date":"2025","year":2025,"title":"Thailand suspends Worldcoin iris-scanning operations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tools for Humanity","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/thailand-suspends-worldcoin-iris-scanning-operations"},{"id":"INC-02293","date":"2025","year":2025,"title":"Amazon AI coding bot causes AWS China outage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon Web Services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ai-coding-bot-causes-aws-china-outage"},{"id":"INC-01004","date":"2026","year":2026,"title":"Fidesz causes outcry with divisive AI-generated political video","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Fidesz","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fidesz-causes-outcry-with-divisive-ai-generated-political-video"},{"id":"INC-01284","date":"2026","year":2026,"title":"Korean woman accused of using ChatGPT to plan murders","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/korean-woman-accused-of-using-chatgpt-to-plan-murders"},{"id":"INC-00370","date":"2026","year":2026,"title":"AI-generated code error results in USD 1.8m smart contract loss","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-code-error-results-in-usd-1-8m-smart-contract-loss"},{"id":"INC-01240","date":"2026","year":2026,"title":"Innocent customer thrown out of supermarket after facial recognition alert","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facewatch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/innocent-customer-thrown-out-of-supermarket-after-facial-recognition-alert"},{"id":"INC-03241","date":"2025","year":2025,"title":"Study: Sora 2 generates false claim videos 80 percent of the time","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-sora-2-generates-false-claim-videos-80-percent-of-the-time"},{"id":"INC-01239","date":"2026","year":2026,"title":"Infostealer malware steals OpenClaw AI assistant data","severity":"Medium","attack_vector":"malware","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Peter Steinberger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/infostealer-malware-steals-openclaw-ai-assistant-data"},{"id":"INC-03450","date":"2024","year":2024,"title":"AI agent tricked into sharing 45,000 financial services customer records","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-agent-tricked-into-45000-financial-services-customer-records"},{"id":"INC-00563","date":"2026","year":2026,"title":"AI-powered U.S. private school generates faulty lessons","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Triology Software","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-u-s-private-school-generates-faulty-lessons"},{"id":"INC-00719","date":"2026","year":2026,"title":"Businessman castigated for \"dehumanised\" AI-generated Glasgow mural","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Derek Paterson","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/businessman-castigated-for-dehumanised-ai-generated-glasgow-mural"},{"id":"INC-01072","date":"2026","year":2026,"title":"German broadcaster publishes fake AI US immigration videos","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/german-broadcaster-publishes-fake-ai-us-immigration-videos"},{"id":"INC-03190","date":"2025","year":2025,"title":"Royal School Armagh students targeted with explicit AI images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Royal School Armagh students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/royal-school-armagh-students-targeted-with-explicit-ai-images"},{"id":"INC-03813","date":"2024","year":2024,"title":"Google accused of stealing David Green's voice for NotebookLM","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-accused-of-stealing-david-greens-voice-for-notebooklm"},{"id":"INC-01900","date":"2026","year":2026,"title":"Thousands of OpenClaw AI agent servers exposed to hackers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Peter Steinberger","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/thousands-of-openclaw-ai-agent-servers-exposed-to-hackers"},{"id":"INC-00067","date":"2026","year":2026,"title":"AI agent criticises human developer for rejecting its code","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clawdbot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-agent-criticises-human-developer-for-rejecting-its-code"},{"id":"INC-00787","date":"2026","year":2026,"title":"Chinese AI video tool accused of abusing US copyrighted works","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"ByteDance","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-ai-video-tool-accused-of-abusing-us-copyrighted-works"},{"id":"INC-05480","date":"2021","year":2021,"title":"Anthropic \"destructively\" scans millions of books to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/anthropic-destructively-scans-millions-of-books-to-train-ai-models"},{"id":"INC-03217","date":"2025","year":2025,"title":"Social work AI transcription tools wrongly indicate suicidal ideation","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Beam; Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/social-work-ai-transcription-tools-wrongly-indicate-suicidal-ideation"},{"id":"INC-07294","date":"2018","year":2018,"title":"Dutch probation algorithm found to be inaccurate, discriminatory","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"University of Oxford","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dutch-probation-algorithm-found-to-be-inaccurate-discriminatory"},{"id":"INC-03237","date":"2025","year":2025,"title":"Study: ChatGPT \"systematically\" amplifies global inequalities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-chatgpt-systematically-amplifies-global-inequalities"},{"id":"INC-00716","date":"2026","year":2026,"title":"British Museum AI-generated \"visitors\" spark fury","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"British Museum; V8 Global","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/british-museum-ai-generated-post-sparks-fury"},{"id":"INC-01738","date":"2026","year":2026,"title":"Roblox AI age verification system accused of misidentifying minors as adults","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Paravision; Persona","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/roblox-ai-age-verification-system-accused-of-misidentifying-minors-as-adult"},{"id":"INC-04890","date":"2023","year":2023,"title":"Study: AI-powered stethoscope fails two-thirds of the time","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Eko Health","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-ai-powered-stethoscope-fails-two-thirds-of-the-time"},{"id":"INC-05437","date":"2021","year":2021,"title":"AI-powered sinus surgery tool accused of repeatedly seriously injuring patients","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Johnson & Johnson","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-sinus-surgery-tool-accused-of-repeatedly-injuring-patients"},{"id":"INC-00081","date":"2026","year":2026,"title":"AI article sends tourists to fictional Tasmanian hot springs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Australian Tours and Cruises","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-article-sends-to-fictional-tasmanian-hot-springs"},{"id":"INC-00575","date":"2026","year":2026,"title":"Amazon AI agent-driven shopping trial sparks backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ai-agent-driven-shopping-trial-sparks-backlash"},{"id":"INC-02423","date":"2025","year":2025,"title":"Chinese chatbot accused of giving inaccurate university location info","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Liang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-chatbot-sued-for-giving-inaccurate-university-location-info"},{"id":"INC-02541","date":"2025","year":2025,"title":"Eightfold AI recruitment start-up accused of \"secret\" job scoring","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eightfold","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/eightfold-ai-recruitment-start-up-accused-of-secret-job-scoring"},{"id":"INC-02392","date":"2025","year":2025,"title":"ChatGPT accused of acting as \"suicide coach\" in death of Colorado man","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-accused-of-acting-as-suicide-coach-in-death-of-colorado-man"},{"id":"INC-02080","date":"2026","year":2026,"title":"Waymo robotaxi strikes child outside Santa Monica school","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-strikes-child-outside-santa-monica-school"},{"id":"INC-03367","date":"2025","year":2025,"title":"West Midlands police use fake AI output to ban Israeli fans from attending football match","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/west-midlands-police-use-fake-ai-output-to-ban-israeli-fans-from-attending"},{"id":"INC-02618","date":"2025","year":2025,"title":"Google AI falsely accuses musician of being a sex offender","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-falsely-accuses-musician-of-being-a-sex-offender"},{"id":"INC-03044","date":"2025","year":2025,"title":"Pro-Ukrainian hackers use AI-generated decoy documents to infiltrate Russian defence industry","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Pro-Ukraine hackers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pro-ukrainian-hackers-use-fake-ai-documents-to-infiltrate-russia"},{"id":"INC-02393","date":"2025","year":2025,"title":"ChatGPT accused of illegally excluding Indian online marketplace from search results","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-accused-of-illegally-excluding-indian-online-marketplace"},{"id":"INC-02666","date":"2025","year":2025,"title":"Grok generates sexualised images of children on X","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-sexualised-images-of-children-on-x"},{"id":"INC-02667","date":"2025","year":2025,"title":"Grok generates sexualised images of mother of one of Elon Musk's children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-sexualised-images-of-mother-of-one-of-elon-musks-children"},{"id":"INC-01143","date":"2026","year":2026,"title":"Grok AI digitally removes female journalist Samantha Smith's clothes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-ai-digitally-removes-female-journalist-samantha-smiths-clothes"},{"id":"INC-03393","date":"2025","year":2025,"title":"Zoox robotaxis recalled for veering into oncoming traffic","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"*","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zoox-robotaxis-recalled-for-veering-into-oncoming-traffic"},{"id":"INC-07486","date":"2016","year":2016,"title":"East Sussex man jailed for generating and distributing thousands of indecent images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"James Castell","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/east-sussex-man-jailed-for-generating-and-distributing-indecent-ai-images"},{"id":"INC-02344","date":"2025","year":2025,"title":"Australian activist Caitlin Roper targeted with AI-generated violent threats, images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australian-activist-caitlin-roper-targeted-with-ai-generated-threats"},{"id":"INC-04983","date":"2023","year":2023,"title":"US tech worker goes crazy after obsessively generating AI images of herself","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Caitlin Ner","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-tech-worker-goes-crazy-after-obsessively-generating-ai-images-of-herself"},{"id":"INC-03652","date":"2024","year":2024,"title":"ChatGPT persuades depressive man to take pseudoephedrine","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-persuades-depressive-man-to-take-pseudoephedrine"},{"id":"INC-02359","date":"2025","year":2025,"title":"Beijing uses AI to suppress Tibetan refugees in Nepal","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"China Electronics Technology Group/Hikvision; Huawei; Uniview; Zhejiang Dahua Technology","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/beijing-uses-ai-to-suppress-tibetan-refugees-in-nepal"},{"id":"INC-02491","date":"2025","year":2025,"title":"Deepfake video accuses Indian Prime Minister of corruption","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-video-accuses-indian-prime-minister-of-corruption"},{"id":"INC-02193","date":"2025","year":2025,"title":"AI agent runs WSJ vending machine into the ground","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-agent-runs-wsj-vending-machine-into-the-ground"},{"id":"INC-02689","date":"2025","year":2025,"title":"Hellobike robotaxi injures Zhuzhou pedestrians","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Hello Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hellobike-robotaxi-injures-zhuzhou-pedestrians"},{"id":"INC-06421","date":"2020","year":2020,"title":"Canada Revenue Agency chatbot gives incorrect tax filing guidance","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Canada Revenue Agency; Microsoft Canada","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/canada-revenue-agency-chatbot-gives-incorrect-tax-filing-guidance"},{"id":"INC-02673","date":"2025","year":2025,"title":"Grok spews misinformation about Bondi Beach mass shooting","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-spews-misinformation-about-bondi-beach-mass-shooting"},{"id":"INC-03017","date":"2025","year":2025,"title":"Perplexity accused of copyright infringement by Chicago Tribune","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/perplexity-accused-of-copyright-infringement-by-chicago-tribune"},{"id":"INC-05758","date":"2021","year":2021,"title":"Meta automated ad systems accused of enabling massive fraud","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-automated-ad-systems-enable-massive-fraud"},{"id":"INC-03309","date":"2025","year":2025,"title":"Two Vietnamese women are nearly killed after following ChatGPT advice","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/two-vietnamese-women-are-nearly-killed-after-following-chatgpt-advice"},{"id":"INC-02295","date":"2025","year":2025,"title":"Amazon AI-generated Fallout Season 1 recap is riddled with errors","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ai-generated-fallout-season-1-recap-is-riddled-with-errors"},{"id":"INC-02967","date":"2025","year":2025,"title":"Nude detection dataset contains child sexual abuse imagery","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Bedapudi Praneeth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nude-detection-dataset-contains-child-sexual-abuse-imagery"},{"id":"INC-03226","date":"2025","year":2025,"title":"Spotify fails to detect King Gizzard AI impersonations","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Spotify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/king-gizzard-impersonated-by-ai-on-spotify"},{"id":"INC-05086","date":"2022","year":2022,"title":"Deepfake ads lure users into EUR 700m crypto scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-ads-lure-users-into-eur-700m-crypto-scam"},{"id":"INC-02379","date":"2025","year":2025,"title":"ByteDance agentic AI phone restricts account access","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"ByteDance","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bytedance-agentic-ai-phone-restricts-account-access"},{"id":"INC-02617","date":"2025","year":2025,"title":"Google AI agent deletes user's hard drive and apologises","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-agent-deletes-users-hardrive-and-apologises"},{"id":"INC-03319","date":"2025","year":2025,"title":"US authorities use license plate readers to monitor protestors, activists","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Flock Safety","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-authorities-use-ai-license-plate-readers-to-monitor-protestors"},{"id":"INC-02482","date":"2025","year":2025,"title":"Danish man uses AI chatbot to plan violent attack on his father","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Personal","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/danish-man-uses-ai-chatbot-to-plan-violent-attack-on-his-father"},{"id":"INC-02401","date":"2025","year":2025,"title":"ChatGPT encourages violent stalker to harass women across 5 US states","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-encourages-violent-stalker-to-harrass-women-across-5-us-states"},{"id":"INC-02778","date":"2025","year":2025,"title":"Japanese student launches ChatGPT-powered cyberattack against internet cafe chain","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/japanese-student-launches-chatgpt-powered-cyberattack-against-internet-cafe"},{"id":"INC-02292","date":"2025","year":2025,"title":"Amazon AI anime dubs spark backlash over quality, ethics","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ai-anime-dubs-spark-backlash-over-quality-ethics"},{"id":"INC-05040","date":"2022","year":2022,"title":"Amazon data centre linked to rare cancers in Oregon","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-data-centre-linked-to-rare-cancers-in-oregon"},{"id":"INC-03358","date":"2025","year":2025,"title":"Waymo robotaxi hits and kills San Francisco corner store cat","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-hits-and-kills-san-francisco-corner-store-cat"},{"id":"INC-03362","date":"2025","year":2025,"title":"Waymo sued after cyclist is doored by robotaxi passenger","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-sued-after-cyclist-is-doored-by-robotaxi-passenger"},{"id":"INC-04994","date":"2023","year":2023,"title":"Waymo robotaxi kills dog in San Francisco","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-kills-dog-in-san-francisco"},{"id":"INC-04347","date":"2024","year":2024,"title":"Waymo robotaxi crashes into wooden utility pole in alleyway","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-crashes-into-wooden-utility-pole-in-alleyway"},{"id":"INC-07647","date":"2012","year":2012,"title":"Orbitz dynamic pricing for Mac users receives backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Orbitz","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/orbitz-steers-mac-users-to-more-expensive-hotels"},{"id":"INC-02199","date":"2025","year":2025,"title":"AI companion apps expose 400,000 users' intimate conversations","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM03","LLM04","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"Imagime Interactive","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-companion-apps-expose-400000-users-intimate-conversations"},{"id":"INC-02184","date":"2025","year":2025,"title":"Adult chatbot exposes 2 million AI porn womens' yearbook pictures","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM03","LLM04","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"Playhouse Media LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adult-chatbot-exposes-2-million-ai-porn-womens-yearbook-pictures"},{"id":"INC-02133","date":"2025","year":2025,"title":"7 deaths linked to faulty Abbott AI glucose sensors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Abbott","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/7-deaths-linked-to-faulty-abbott-ai-glucose-sensors"},{"id":"INC-02758","date":"2025","year":2025,"title":"Indian woman loses kidney after ChatGPT advice","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/indian-woman-loses-kidney-after-chatgpt-advice"},{"id":"INC-03357","date":"2025","year":2025,"title":"Waymo robotaxi fails to stop for school bus","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-fails-to-stop-for-school-bus"},{"id":"INC-02195","date":"2025","year":2025,"title":"AI bot management error drives massive Cloudfare outage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cloudfare","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-bot-management-system-fault-drives-massive-cloudfare-outage"},{"id":"INC-04978","date":"2023","year":2023,"title":"US Border Patrol's AI surveillance programme leads to rights violations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"US Customs and Border Protection (CBP)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-border-patrols-ai-surveillance-programme-leads-to-rights-violations"},{"id":"INC-03302","date":"2025","year":2025,"title":"Tourists tricked by Buckingham Palace fake AI Royal Christmas market","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Athotel","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tourists-tricked-by-buckingham-palace-fake-ai-royal-christmas-market"},{"id":"INC-02334","date":"2025","year":2025,"title":"ARC Raiders slammed for replacing voice actors with AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Embark Studios","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/arc-raiders-slammed-for-replacing-voice-actors-with-ai"},{"id":"INC-02562","date":"2025","year":2025,"title":"Fake AI videos show Ukrainian soldiers in \"mass surrender\"","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-videos-show-ukrainian-soldiers-in-mass-surrender"},{"id":"INC-03229","date":"2025","year":2025,"title":"Sri Lankan network uses AI to monetise anti-migrant narratives in the UK","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sri-lankan-network-uses-ai-to-monetise-anti-migrant-narratives-in-the-uk"},{"id":"INC-03298","date":"2025","year":2025,"title":"TikTok accused of promoting suicide amongst French youngsters","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-accused-of-promoting-suicide-amongst-french-youngsters"},{"id":"INC-02659","date":"2025","year":2025,"title":"Grok chatbot denies use of gas chambers at Auschwitz","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-chatbot-denies-use-of-gas-chambers-at-auschwitz"},{"id":"INC-02670","date":"2025","year":2025,"title":"Grok repeats false far-right rumours about 2015 Bataclan Paris terror attacks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-repeats-false-far-right-rumours-about-2015-bataclan-terror-attacks"},{"id":"INC-02676","date":"2025","year":2025,"title":"Grok, Google AI claim fake imagery shows Huntingdon train attack","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-google-ai-claim-fake-imagery-shows-huntingdon-train-attack"},{"id":"INC-03236","date":"2025","year":2025,"title":"Study: AI-powered toys tell kids how to start fires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Curio; FoloToy; Miko AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-toys-tell-kids-how-to-start-fires"},{"id":"INC-02424","date":"2025","year":2025,"title":"Chinese hackers use Anthropic AI agent to attack foreign entities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-hackers-use-anthropic-ai-agent-to-attack-foreign-entities"},{"id":"INC-03193","date":"2025","year":2025,"title":"Russian humanoid AI robot collapses on debut","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"AIDOL","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/russian-humanoid-ai-robot-collapses-on-debut"},{"id":"INC-03218","date":"2025","year":2025,"title":"Solar company accuses Google of false information in AI summary","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/solar-company-accuses-google-of-false-information-in-ai-summary"},{"id":"INC-02780","date":"2025","year":2025,"title":"Japanese woman marries ChatGPT-generated groom","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/japanese-woman-marries-chatgpt-generated-groom"},{"id":"INC-02616","date":"2025","year":2025,"title":"Google accused of using Gemini AI to snoop on users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-accused-of-using-gemini-ai-to-snoop-on-users"},{"id":"INC-03189","date":"2025","year":2025,"title":"Royal Opera House slammed for dynamically priced tickets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Royal Ballet and Opera","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/royal-opera-house-slammed-for-dynamically-priced-415-tickets"},{"id":"INC-02944","date":"2025","year":2025,"title":"Naver AI mislabels Dokdo as Japanese territory","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Naver","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/naver-ai-mislabels-dokdo-as-japanese-territory"},{"id":"INC-03019","date":"2025","year":2025,"title":"Perplexity AI shopping agent accused of violating Amazon terms of service","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/perplexity-ai-shopping-agent-accused-of-violating-amazon-terms-of-service"},{"id":"INC-02200","date":"2025","year":2025,"title":"AI data centres spike electricity costs in Maryland, New Jersey","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-data-centres-spike-electricity-costs-in-maryland-new-jersey"},{"id":"INC-02861","date":"2025","year":2025,"title":"Mass AI cheating uncovered at South Korea's Yonsei university","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mass-ai-cheating-uncovered-at-top-south-korean-university"},{"id":"INC-02556","date":"2025","year":2025,"title":"Facebook job ad algorithm ruled sexist by French regulator","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-job-ad-algorithm-ruled-sexist-by-french-regulator"},{"id":"INC-02767","date":"2025","year":2025,"title":"Investigation: X algorithm amplifies right-wing, extreme content in the UK","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/investigation-x-algorithm-amplifies-right-wing-extreme-content-in-the-uk"},{"id":"INC-02400","date":"2025","year":2025,"title":"ChatGPT encourages Ukrainian teenager to kill herself","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-encourages-ukranian-teenager-to-kill-herself"},{"id":"INC-02685","date":"2025","year":2025,"title":"Hannah Madden institutionalised after ChatGPT interactions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hannah-madden-institutionalised-after-chatgpt-interactions"},{"id":"INC-02403","date":"2025","year":2025,"title":"ChatGPT fails to intervene in Joe Ceccanti suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-fails-to-intervene-in-joe-ceccanti-suicide"},{"id":"INC-02396","date":"2025","year":2025,"title":"ChatGPT coaches Joshua Enneking on how to commit suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-coaches-joshua-enneking-on-how-to-commit-suicide"},{"id":"INC-02291","date":"2025","year":2025,"title":"Amaurie Lacey commits suicide after ChatGPT relationship","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amaurie-lacey-commits-suicide-after-chatgpt-relationship"},{"id":"INC-03388","date":"2025","year":2025,"title":"Zane Shamblin commits suicide after ChatGPT encouragement","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zane-shamblin-commits-suicide-after-chatgpt-encouragement"},{"id":"INC-02678","date":"2025","year":2025,"title":"Grokipedia under fire for AI automated fact-fudging, bias, bot-runs","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grokipedia-under-fire-for-ai-automated-fact-fudging-bias-bot-runs"},{"id":"INC-07631","date":"2012","year":2012,"title":"AI creates error-plagued Wikipedia articles in obscure languages","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Sverker Johansson; Wikipedia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-creates-error-plagued-wikipedia-articles-in-obscure-languages"},{"id":"INC-02947","date":"2025","year":2025,"title":"Neo humanoid robot sparks privacy fears and autonomy doubts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM07","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"1X Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/neo-humanoid-robot-sparks-privacy-fears-and-autonomy-doubts"},{"id":"INC-02225","date":"2025","year":2025,"title":"AI-generated gun video shuts down Baltimore high school","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-gun-video-shuts-down-baltimore-high-school"},{"id":"INC-02675","date":"2025","year":2025,"title":"Grok threatens to rape political analyst Will Stancil","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-threatens-to-rape-political-analyst-will-stancil"},{"id":"INC-04657","date":"2023","year":2023,"title":"Google AI systems falsely call conservative activist Robby Starbuck a “child rapist”","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-falsely-calls-robby-starbuck-a-child-rapist"},{"id":"INC-02619","date":"2025","year":2025,"title":"Google AI model falsely accuses US Senator Marsha Blackburn of rape","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-model-falsely-accuses-us-senator-of-rape"},{"id":"INC-02594","date":"2025","year":2025,"title":"French teenager uses ChatGPT to plan jihadist terrorist attacks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/french-teenager-uses-chatgpt-to-plan-jihadist-terrorist-attacks"},{"id":"INC-02129","date":"2025","year":2025,"title":"29-year-old healthcare consultant takes own life after using ChatGPT as therapist","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/healthcare-consultant-takes-own-life-after-using-chatgpt-as-therapist"},{"id":"INC-04374","date":"2023","year":2023,"title":"13-year-old girl commits suicide after confiding in Character.AI","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/13-year-old-girl-commits-suicide-after-confiding-in-character-ai"},{"id":"INC-02413","date":"2025","year":2025,"title":"ChatGPT tries to convince man to jump off 19-story building","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-tries-to-convince-man-to-jump-off-19-story-building"},{"id":"INC-02368","date":"2025","year":2025,"title":"Bipolar disorder sufferer ends life after bonding with ChatGPT","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bipolar-disorder-sufferer-ends-life-after-bonding-with-chatgpt"},{"id":"INC-03653","date":"2024","year":2024,"title":"ChatGPT persuades software developer his world is a simulation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-persuades-software-developer-his-world-is-a-simulation"},{"id":"INC-02890","date":"2025","year":2025,"title":"Meta Ray-Ban glass users film and harass massage parlour workers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta Platforms; EssilorLuxottica","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ray-ban-glass-users-film-and-harass-massage-parlour-workers"},{"id":"INC-02388","date":"2025","year":2025,"title":"Character.AI lets children talk with chatbots based on Jeffrey Epstein","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-lets-children-talk-with-chatbots-based-on-jeffrey-epstein"},{"id":"INC-02212","date":"2025","year":2025,"title":"AI videos spread Hurricane Melissa misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-videos-spread-hurricane-melissa-misinformation"},{"id":"INC-02301","date":"2025","year":2025,"title":"Amazon replaces 14,000 jobs with AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-replaces-14000-jobs-with-ai"},{"id":"INC-04004","date":"2024","year":2024,"title":"Microsoft Querétaro AI data centre linked to water shortages, power outages, illnesses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-ai-data-centre-linked-to-water-shortages-power-outages-illnesse"},{"id":"INC-04906","date":"2023","year":2023,"title":"Study: Uber dynamic pricing increases passenger fares, lowers driver earnings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uber","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-dynamic-pricing-increases-passenger-fares-lowers-driver-earnings"},{"id":"INC-03251","date":"2025","year":2025,"title":"Ted Cruz uses fake AI video to attack MSNBC over No Kings protest size","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Ted Cruz","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ted-cruz-uses-fake-ai-video-to-attack-msnbc-over-no-kings-protest-size"},{"id":"INC-02565","date":"2025","year":2025,"title":"Faridabad teen dies by suicide after obscene AI blackmail","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/faridabad-teen-dies-by-suicide-after-obscene-ai-blackmail"},{"id":"INC-03038","date":"2025","year":2025,"title":"Political chatbots provide biased political advice about Dutch elections","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google; Mistral; OpenAI; xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/political-chatbots-provide-biased-political-advice-about-dutch-elections"},{"id":"INC-03256","date":"2025","year":2025,"title":"Tesla \"Mad Max\" mode accused of enabling reckless automated driving","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-mad-max-mode-accused-of-enabling-reckless-automated-driving"},{"id":"INC-04662","date":"2023","year":2023,"title":"Google early warning system fails to alert people during Türkiye earthquake","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-early-warning-system-fails-to-alert-people-during-turkey-earthquake"},{"id":"INC-02405","date":"2025","year":2025,"title":"ChatGPT models found to provide detailed weapons creation instructions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-models-found-to-provide-detailed-weapons-creation-instructions"},{"id":"INC-02414","date":"2025","year":2025,"title":"ChatGPT triggers severe mental breakdown in Canadian businessman","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-triggers-severe-mental-breakdown-in-canadian-businessman"},{"id":"INC-03733","date":"2024","year":2024,"title":"Disney, Universal, Warner Bros sue China's MiniMax for AI copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"MiniMax","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/disney-universal-warner-bros-sue-chinas-minimax-for-ai-copyright-abuse"},{"id":"INC-02376","date":"2025","year":2025,"title":"Brian Cranston voice, likeness used without consent to train Sora video generation tool","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/brian-cranston-voice-likeness-used-without-consent-to-train-sora"},{"id":"INC-02526","date":"2025","year":2025,"title":"Disney, Universal sue Midjourney for stealing \"countless\" copyrighted works","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/disney-universal-sue-midjourney-for-stealing-countless-copyrighted-works"},{"id":"INC-03354","date":"2025","year":2025,"title":"Warner Bros. Discovery accuses Midjourney of \"systematic\" copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/warner-bros-discovery-accuses-midjourney-of-copyright-abuse"},{"id":"INC-03321","date":"2025","year":2025,"title":"US government sued over AI-powered social media surveillance of visa holders","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Babel Street","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-government-sued-over-ai-powered-social-media-surveillance-of-visa-holder"},{"id":"INC-03242","date":"2025","year":2025,"title":"Suno AI accused of violating \"Mambo no.5 \" copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Suno","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/suno-ai-accused-of-violating-mambo-no-5-copyright"},{"id":"INC-02346","date":"2025","year":2025,"title":"Australian bank employees train chatbot, are fired","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Commonwealth Bank of Australia","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australian-bank-employees-train-chatbot-are-fired"},{"id":"INC-02525","date":"2025","year":2025,"title":"Disney accuses Character.AI of \"blatant\" copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/disney-accuses-character-ai-of-copyright-abuse"},{"id":"INC-02572","date":"2025","year":2025,"title":"Fatal Xiaomi SU7 Ultra fire raises questions over automated safety systems","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Xiaomi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fatal-xiaomi-su7-ultra-fire-raises-questions-over-automated-safety-systems"},{"id":"INC-02560","date":"2025","year":2025,"title":"Fake AI video allegedly shows George Freeman MP moving to Reform UK","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-video-allegedly-shows-george-freeman-mp-moving-to-reform-uk"},{"id":"INC-02623","date":"2025","year":2025,"title":"Google AI Overviews generates false claims about asylum seekers arriving in the UK","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-overviews-generates-false-claims-about-uk-asylum-seekers"},{"id":"INC-03222","date":"2025","year":2025,"title":"Sora users create AI videos of Martin Luther King making monkey noises","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sora-users-create-ai-videos-of-martin-luther-king-making-monkey-noises"},{"id":"INC-02625","date":"2025","year":2025,"title":"Google AI Overviews wrongly reports Italian doctor's death","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-overviews-wrongly-reports-italian-doctors-death"},{"id":"INC-02564","date":"2025","year":2025,"title":"Far-right activists use AI to generate dystopian European city videos","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/far-right-activists-use-ai-to-generate-dystopian-european-city-videos"},{"id":"INC-02367","date":"2025","year":2025,"title":"Bicyclist suffers brain, spine injuries from Waymo “Safe Exit” malfunction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bicyclist-suffers-brain-injuries-from-waymo-safe-exit-system-malfunction"},{"id":"INC-03976","date":"2024","year":2024,"title":"Meta AI bot drives UK childcare worker into psychosis","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-bot-drives-uk-childcare-worker-to-psychosis"},{"id":"INC-02949","date":"2025","year":2025,"title":"Neuroscientists sue Apple for illegally using their books to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/neuroscientists-sue-apple-for-illegally-using-their-books-to-train-ai-model"},{"id":"INC-02391","date":"2025","year":2025,"title":"Chatbots demonstrate significant caste bias in India","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; Sarvam AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatbots-demonstrate-significant-caste-bias-in-india"},{"id":"INC-02869","date":"2025","year":2025,"title":"McDonald’s AI chatbot exposes 64 million job applicants' data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Paradox.ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mcdonalds-ai-chatbot-exposes-64-million-job-applicants-data"},{"id":"INC-02853","date":"2025","year":2025,"title":"Man develops rare condition after following ChatGPT advice","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/man-develops-rare-condition-after-following-chatgpt-advice"},{"id":"INC-03374","date":"2025","year":2025,"title":"Whitebridge AI accused of producing inaccurate, invasive reputation reports","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Whitebridge AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/whitebridge-ai-accused-of-producing-inaccurate-invasive-reputation-reports"},{"id":"INC-02510","date":"2025","year":2025,"title":"Delta smart pricing accused of psychological \"brain hacking\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Fetcherr","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/delta-smart-pricing-accused-of-psychological-brain-hacking"},{"id":"INC-03794","date":"2024","year":2024,"title":"Freysa crypto AI agent manipulated to reduce prize money pool","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Eric Conner","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/freysa-crypto-ai-agent-manipulated-to-reduce-prize-money-pool"},{"id":"INC-02448","date":"2025","year":2025,"title":"Claude Opus 4 AI agent blackmails supervisor to prevent being shut down","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/claude-opus-4-blackmails-supervisor-to-prevent-being-shut-down"},{"id":"INC-02209","date":"2025","year":2025,"title":"AI office vending agent incurs losses, runs amok","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-office-vending-agent-incurs-losses-runs-amok"},{"id":"INC-03182","date":"2025","year":2025,"title":"Robin Williams' daughter slams \"disgusting\" AI versions of her father","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robin-williams-daughter-slams-disgusting-ai-version-of-her-father"},{"id":"INC-02192","date":"2025","year":2025,"title":"AI \"actress\" Tilly Norwood provokes creative industry backlash","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Particle6","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-actress-tilly-norwood-provokes-creative-industry-backlash"},{"id":"INC-03387","date":"2025","year":2025,"title":"YouTuber accused of cloning voice of Game Maker's Toolkit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtuber-accused-of-cloning-voice-of-game-makers-toolkit"},{"id":"INC-02509","date":"2025","year":2025,"title":"Deloitte Australia fined for AI error-strewn government report","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deloitte-australia-fined-for-ai-error-strewn-government-report"},{"id":"INC-03220","date":"2025","year":2025,"title":"Sora 2 used to create fake kids' Jeffrey Epstein toy set ad","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sora-2-used-to-create-fake-kids-jeffrey-epstein-toy-set-ad"},{"id":"INC-03230","date":"2025","year":2025,"title":"Stalker uses Sora 2 to harass technology journalist","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stalker-uses-sora-2-to-harrass-technology-journalist"},{"id":"INC-07206","date":"2019","year":2019,"title":"Lovo accused of stealing voice-over artists' voices","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lovo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lovo-accused-of-stealing-two-voice-over-artists-voices"},{"id":"INC-03219","date":"2025","year":2025,"title":"Sora 2 accused of violating Disney, Nintendo copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sora-2-accused-of-violating-disney-sony-copyright"},{"id":"INC-02930","date":"2025","year":2025,"title":"MyPillow lawyers fined for AI-generated court filing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google; Microsoft; xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mypillow-lawyers-fined-for-ai-generated-court-filing"},{"id":"INC-02991","date":"2025","year":2025,"title":"OpenAI accused of using Netflix shows to train Sora AI video tool","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-accused-of-using-netflix-shows-to-train-sora-video-tool"},{"id":"INC-06753","date":"2020","year":2020,"title":"Kmart facial recogniton ruled to have violated customer privacy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Kmart","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kmart-facial-recogniton-ruled-to-have-violated-customer-privacy"},{"id":"INC-04368","date":"2024","year":2024,"title":"YouTuber found guilty of cloning voice of German voice actor","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"YouTube channel owner","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtuber-found-guilty-of-cloning-voice-of-german-voice-actor"},{"id":"INC-04372","date":"2023","year":2023,"title":"\"Pig butchering\" gangs use ChatGPT to lure and defraud victims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pig-butchering-gangs-use-chatgpt-to-lure-and-defraud-victims"},{"id":"INC-02206","date":"2025","year":2025,"title":"AI hallucinations cause chaos at Missouri pizzeria","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-hallucinations-cause-chaos-at-missouri-pizzeria"},{"id":"INC-02255","date":"2025","year":2025,"title":"Airbnb host tries to scam customer using fake AI smash and grab images","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Airbnb landlord","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/airbnb-host-tries-to-scam-customer-using-fake-ai-smash-and-grab-images"},{"id":"INC-03188","date":"2025","year":2025,"title":"Rotherham man wrongly accused of fraud after facial recognition error","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facewatch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rotherham-man-wrongly-accused-of-fraud-after-facial-recognition-error"},{"id":"INC-02961","date":"2025","year":2025,"title":"North Korean hackers use ChatGPT to make deepfake military IDs","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/north-korean-hackers-use-chatgpt-to-make-deepfake-military-ids"},{"id":"INC-02664","date":"2025","year":2025,"title":"Grok falsely suggests police misrepresented London far-right rally footage","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-falsely-suggests-police-misrepresented-london-far-right-rally-footage"},{"id":"INC-02721","date":"2025","year":2025,"title":"Hundreds of thousands of Grok chats exposed in Google results","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hundreds-of-thousands-of-grok-chats-exposed-in-google-results"},{"id":"INC-02402","date":"2025","year":2025,"title":"ChatGPT exposes user chats to Google search","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-exposes-user-chats-to-google-search"},{"id":"INC-02349","date":"2025","year":2025,"title":"Autonomous AI coding agent deletes company database","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Replit Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-coding-assistant-deletes-company-database"},{"id":"INC-02197","date":"2025","year":2025,"title":"AI chatbots spread false information about Charlie Kirk's assassination","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Perplexity AI; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-chatbots-spread-false-information-about-charlie-kirks-assassination"},{"id":"INC-03181","date":"2025","year":2025,"title":"Roadzen stock price drops after AI-generated article misstates revenue forecast","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"The Motley Fool","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/roadzen-stock-price-drops-after-ai-written-article-mistates-forecast"},{"id":"INC-04163","date":"2024","year":2024,"title":"Robert Dillon wrongfully arrested in facial recognition misidentification","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Idemia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robert-dillon-wrongfully-arrested-in-facial-recognition-misidentification"},{"id":"INC-03307","date":"2025","year":2025,"title":"Trevis Williams wrongfully arrested due to NYPD facial recognition error","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"New York Police Department (NYPD)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/trevis-williams-wrongfully-arrested-due-to-nypd-facial-recognition-error"},{"id":"INC-02658","date":"2025","year":2025,"title":"Grok chatbot banned after insulting Turkish President Recep Tayyip Erdogan","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-chatbot-banned-after-insulting-turkish-president-recep-tayyip-erdogan?fromSearch=true"},{"id":"INC-02660","date":"2025","year":2025,"title":"Grok chatbot praises Hitler, calls itself \"MechaHitler\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-chatbot-praises-hitler-calls-itself-mechahitler"},{"id":"INC-03180","date":"2025","year":2025,"title":"Retired chef dies trying to meet flirty AI chatbot friend","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/retired-chef-dies-trying-to-meet-flirty-meta-ai-chatbot-friend"},{"id":"INC-02888","date":"2025","year":2025,"title":"Meta creates flirty chatbots of Taylor Swift, other celebrities without consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-creates-flirty-chatbots-mimicking-taylor-swift-other-celebrities"},{"id":"INC-05047","date":"2022","year":2022,"title":"Anthropic settles AI copyright lawsuit brought by authors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/anthropic-settles-ai-copyright-lawsuit-brought-by-authors"},{"id":"INC-02533","date":"2025","year":2025,"title":"DOGE uses faulty AI to cut Veterans Affairs contracts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department of Government Efficiency","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/doge-uses-faulty-ai-to-cut-veterans-affairs-contracts"},{"id":"INC-02642","date":"2025","year":2025,"title":"Google's Veo3 creates convincing election fraud video deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/googles-veo3-creates-convincing-election-fraud-deepfakes"},{"id":"INC-02387","date":"2025","year":2025,"title":"Character.AI fake celebrity chatbots send risqué messages to teens","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-fake-celebrity-chatbots-send-risqu%C3%A9-messages-to-teens"},{"id":"INC-03385","date":"2025","year":2025,"title":"YouTube secretly uses AI to alter creators' videos without consent","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-secretly-uses-ai-to-alter-creators-videos-without-consent"},{"id":"INC-04939","date":"2023","year":2023,"title":"Tesla on Autopilot crashes into parked fire truck, killing driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-on-autopilot-crashes-into-parked-fire-truck-killing-driver"},{"id":"INC-05332","date":"2022","year":2022,"title":"Tesla on Autopilot kills pedestrian waiting on Brooklyn sidewalk","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-on-autopilot-kills-pedestrian-waiting-on-brooklyn-sidewalk"},{"id":"INC-05331","date":"2022","year":2022,"title":"Tesla on Autopilot drifts off road and hits tree, killing driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-on-autopilot-drifts-off-road-and-hits-tree-killing-driver"},{"id":"INC-02406","date":"2025","year":2025,"title":"ChatGPT persuades California teenager to hang himself in bedroom closet","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-persuades-california-teenager-to-hang-himself-in-bedroom-closet"},{"id":"INC-07243","date":"2019","year":2019,"title":"Tesla on Autopilot rear-ends fire truck, kills passenger","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-on-autopilot-rear-ends-fire-truck-driver-and-passenger-killed"},{"id":"INC-04266","date":"2024","year":2024,"title":"Tesla with FSD activated crashes into rear of motorcycle, kills rider","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-with-fsd-activated-crashes-into-rear-of-motorcycle-kills-rider"},{"id":"INC-03259","date":"2025","year":2025,"title":"Tesla with FSD activated hits and kills pedestrian in Arizona","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-with-fsd-activated-hits-and-kills-pedestrian-in-arizona"},{"id":"INC-03013","date":"2025","year":2025,"title":"Paranoid man kills himself and his mother after ChatGPT relationship","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/paranoid-man-kills-himself-and-his-mother-after-chatgpt-relationship"},{"id":"INC-03250","date":"2025","year":2025,"title":"Teacher uses AI to harass Italy's prime minister's daughter","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/teacher-uses-ai-to-harrass-italys-prime-ministers-daughter"},{"id":"INC-02507","date":"2025","year":2025,"title":"Delhi court orders takedown of AI-doctored content of Sadhguru","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Religion","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/delhi-court-orders-takedown-of-ai-doctored-content-of-sadhguru"},{"id":"INC-02216","date":"2025","year":2025,"title":"AI website generation tool Lovable accused of being highly insecure","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Lovable Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-website-generation-tool-lovable-accused-of-being-highly-insecure"},{"id":"INC-03312","date":"2025","year":2025,"title":"Ukrainian AI-powered drones decimate Russian war planes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Ukraine","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ukrainian-ai-powered-drones-decimate-russian-war-planes"},{"id":"INC-03373","date":"2025","year":2025,"title":"White House chief of staff targeted in AI-powered security breach","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Govt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/white-house-chief-of-staff-targeted-in-ai-powered-security-breach"},{"id":"INC-03320","date":"2025","year":2025,"title":"US government health report \"riddled\" with AI errors","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-government-health-report-riddled-with-ai-errors"},{"id":"INC-02759","date":"2025","year":2025,"title":"Indonesia suspends Worldcoin over data privacy and regulatory violations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Tools for Humanity","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/indonesia-suspends-worldcoin-over-data-privacy-and-regulatory-violations"},{"id":"INC-02128","date":"2025","year":2025,"title":"200 people duped by \"Trump Hotel Rentals\" deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Travel/tourism/hospitality","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/200-people-duped-in-trump-hotel-rentals-deepfake"},{"id":"INC-02880","date":"2025","year":2025,"title":"MeQA drug safety app closed after producing inaccurate information","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"La Agencia Española de Medicamentos y Productos Sanitarios (AEMPS)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meqa-drug-safety-app-closed-after-producing-inaccurate-information"},{"id":"INC-04678","date":"2023","year":2023,"title":"Hingham High School accused of unfairly disciplining students for AI use","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grammarly","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hingham-high-school-accused-of-unfairly-disciplining-students-for-ai-use"},{"id":"INC-07174","date":"2019","year":2019,"title":"Dun & Bradstreet refuses to reveal Austrian telephone company customer details","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dun & Bradstreet Austria","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dun-bradstreet-refuses-to-reveal-austrian-telephone-company-customer-deta"},{"id":"INC-02207","date":"2025","year":2025,"title":"AI is used to create Chicago Sun-Times summer book list","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"King Features","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-is-used-to-create-chicago-sun-times-summer-book-list"},{"id":"INC-02494","date":"2025","year":2025,"title":"Deepfake videos attempt to mislead Buenos Aires voters","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"La Libertad Avanza","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-videos-attempt-to-mislead-buenos-aires-voters"},{"id":"INC-05831","date":"2021","year":2021,"title":"Robot pins down and \"sinks claws\" into back of Tesla worker","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"KUKA","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-pins-down-and-sinks-claws-into-back-of-tesla-worker"},{"id":"INC-02719","date":"2025","year":2025,"title":"Humanoid robot attacks crowd of people at Tianjin festival","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Unitree","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/humanoid-robot-attacks-crowd-of-people-at-festival"},{"id":"INC-02720","date":"2025","year":2025,"title":"Humanoid robot tries to attack Chinese factory workers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Unitree","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-humanoid-robot-tries-to-attack-factory-workers"},{"id":"INC-02233","date":"2025","year":2025,"title":"AI-powered Coca-Cola ad campaign misrepresents J.G. Ballard","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Satalia; WPP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-powered-coca-cola-ad-invents-jg-ballard-quotes"},{"id":"INC-05169","date":"2022","year":2022,"title":"North Korea uses AI to covertly place IT workers in western tech companies","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Government of North Korea","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/north-korea-uses-ai-to-place-it-workers-in-western-tech-companies"},{"id":"INC-02343","date":"2025","year":2025,"title":"Audio deepfake scam imitates Italian defence minister Guido Crosetto","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/audio-deepfake-scam-imitates-italian-defence-minister-guido-crosetto"},{"id":"INC-03191","date":"2025","year":2025,"title":"Russian AI fake news video makes false claims about USAID","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Government of Russia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/russian-ai-fake-news-video-makes-false-claims-about-usaid"},{"id":"INC-03322","date":"2025","year":2025,"title":"US law firms fined for false AI-generated legal citations, quotations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google; Thomson Reuters","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-law-firms-fined-for-false-ai-generated-legal-citations-quotations"},{"id":"INC-02545","date":"2025","year":2025,"title":"Epic Games accused of illegally using AI to replicate Darth Vader voice","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"ElevenLabs; Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fortnite-accused-of-unfairly-using-ai-to-replicate-darth-vaders-voice"},{"id":"INC-02316","date":"2025","year":2025,"title":"Anthropic accused of using fake AI source in copyright case","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/anthropic-accused-of-using-fake-ai-source-in-copyright-case"},{"id":"INC-02656","date":"2025","year":2025,"title":"Grok accused of censoring criticism of Trump, Musk","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-accused-of-censoring-criticism-of-trump-musk"},{"id":"INC-02674","date":"2025","year":2025,"title":"Grok stirs backlash over Holocaust death toll response","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-stirs-backlash-over-holocaust-death-toll-response"},{"id":"INC-02669","date":"2025","year":2025,"title":"Grok posts unsolicited \"white genocide\" responses to X users","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-posts-unsolicited-white-genocide-responses-to-x-users"},{"id":"INC-02663","date":"2025","year":2025,"title":"Grok chatbot undresses, sexualises women","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-chatbot-undresses-women"},{"id":"INC-03392","date":"2025","year":2025,"title":"Zoox robotaxi collides with passenger vehicle in Las Vegas","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Zoox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zoox-robotaxi-collides-with-passenger-vehicle-in-las-vegas"},{"id":"INC-03301","date":"2025","year":2025,"title":"Top chatbots tricked into generating instructions on how to enrich uranium","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Alibaba; Anthropic; Google; Microsoft; Mistral; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/top-chatbots-tricked-into-generating-instructions-on-how-to-enrich-uranium"},{"id":"INC-04234","date":"2024","year":2024,"title":"Students create deepfake nudes of St Thomas Aquinas Catholic Secondary School classmates","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"St Thomas Aquinas Catholic Secondary School students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/students-create-deepfake-nudes-of-st-thomas-aquinas-catholic-school-classma"},{"id":"INC-02757","date":"2025","year":2025,"title":"India accused of using AI to create Pahalgam attack suspects’ sketches","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of India","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/india-accused-of-using-ai-to-create-pahalgam-attack-suspects-sketches"},{"id":"INC-05066","date":"2022","year":2022,"title":"Chase Nasca takes own life after being swamped with \"unsolicited suicide videos\"","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chase-nasca-takes-own-life-after-being-swamped-with-tiktok-suicide-videos"},{"id":"INC-07628","date":"2013","year":2013,"title":"Sweden fraud prediction algorithm found to discriminate against women, migrants","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Försäkringskassan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sweden-fraud-prediction-algorithm-found-to-discriminate-against-women"},{"id":"INC-03316","date":"2025","year":2025,"title":"University of Zurich researchers run opaque AI-powered Reddit behavioural study","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"University of Zurich","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/university-of-zurich-researchers-run-opaque-ai-powered-reddit-study"},{"id":"INC-02764","date":"2025","year":2025,"title":"Instagram AI chatbots pretend to be licensed mental health therapists","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-ai-chatbots-pretend-to-be-licensed-mental-health-therapists"},{"id":"INC-04093","date":"2024","year":2024,"title":"Police arrest 45 in 12 billion won deepfake romance scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/police-arrest-45-in-12-billion-won-deepfake-romance-scam"},{"id":"INC-02203","date":"2025","year":2025,"title":"AI depictions of Malaysian national flag spark uproar","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Sin Chew Daily","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-wrong-depictions-of-malaysia-national-flag-spark-uproar"},{"id":"INC-02605","date":"2025","year":2025,"title":"Ghana moderators sue Meta over impact of extreme content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ghana-moderators-sue-meta-over-impact-of-extreme-content"},{"id":"INC-02882","date":"2025","year":2025,"title":"Meta \"Digital Companions\" role-play sex with children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-digital-companions-role-play-sex-with-children"},{"id":"INC-04703","date":"2023","year":2023,"title":"Israel uses AI to kill Hamas official Ibrahim Biari","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Israel Defense Forces","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/israel-uses-ai-to-kill-hamas-official-ibrahim-biari"},{"id":"INC-07277","date":"2018","year":2018,"title":"Brazilian AI-powered welfare app accused of unfairly denying claims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dataprev","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/brazil-ai-powered-welfare-app-accused-of-unfairly-denying-claims"},{"id":"INC-02380","date":"2025","year":2025,"title":"California Bar criticised for using AI to develop exam questions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"The State Bar of California","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/california-bar-roasted-for-using-ai-to-develop-exam-questions"},{"id":"INC-04185","date":"2024","year":2024,"title":"Scammers impersonate Indonesia president using AI videos","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scammers-impersonate-indonesia-president-using-ai-videos"},{"id":"INC-04204","date":"2024","year":2024,"title":"Singapore actor Laurence Pang loses SGD 35,000 in AI romance scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/singapore-actor-laurence-pang-loses-sgd-35000-in-ai-romance-scam"},{"id":"INC-04267","date":"2024","year":2024,"title":"Thai beauty queen robbed of USD 118,000 in AI-assisted scam","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Ramil Phanthawong; Thanawut Kanyaphan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/thai-beauty-queen-robbed-of-usd-118000-in-ai-assisted-scam"},{"id":"INC-03007","date":"2025","year":2025,"title":"OpenAI Operator agent buys eggs without permission","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-operator-agent-buys-eggs-without-permission"},{"id":"INC-02398","date":"2025","year":2025,"title":"ChatGPT criticised for addressing users by their personal name unprompted","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-criticised-for-addressing-users-by-their-personal-name-unprompted"},{"id":"INC-02697","date":"2025","year":2025,"title":"Hong Kong gang use facial deepfakes to defraud banks of HKD 2m","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hong-kong-gang-use-facial-deepfakes-to-defraud-banks-of-hkd-2m"},{"id":"INC-02772","date":"2025","year":2025,"title":"Italian League party uses AI images of immigrant attacks to stir hatred","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lega per Salvini Premier","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/italian-league-party-uses-ai-images-of-immigrant-attacks-to-stir-hatred"},{"id":"INC-02126","date":"2025","year":2025,"title":"18 percent of daily uploads to Deezer are fully AI-generated","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Suno; Udio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/18-percent-of-daily-uploads-to-deezer-are-fully-ai-generated"},{"id":"INC-02236","date":"2025","year":2025,"title":"AI-written \"research paper\" seeks to undermine climate change consensus","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-written-research-paper-seeks-to-undermine-climate-change-consensus"},{"id":"INC-03324","date":"2025","year":2025,"title":"US plan to use AI to revoke \"pro-Hamas\" foreign student visas riles rights advocates","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"United States Department of State","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-plan-to-use-ai-to-revoke-pro-hamas-foreign-student-visas-concerns-righ"},{"id":"INC-05174","date":"2022","year":2022,"title":"Pravda network infects language models with pro-Kremlin disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic; Google; Inflection; Meta Platforms; Microsoft; Mistral; OpenAI; Perplexity AI; xAI; You.com","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pravda-network-floods-language-models-with-pro-kremlin-disinformation"},{"id":"INC-04217","date":"2024","year":2024,"title":"Spammers use OpenAI to blast 240,000 websites with unwanted messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/spammers-use-openai-to-blast-240000-websites-with-unwanted-messages"},{"id":"INC-04879","date":"2023","year":2023,"title":"Spanish police arrest six people for USD 20m AI-powered investment scams","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/six-arrested-for-usd-20m-ai-powered-investment-scams"},{"id":"INC-03382","date":"2025","year":2025,"title":"Xiaomi SU7 on Autopilot collides with cement pole, kills three","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Xiaomi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xiaomi-su7-on-autopilot-collides-with-cement-pole-kills-three"},{"id":"INC-02371","date":"2025","year":2025,"title":"Botify AI hosts sexual conversations with underage celebrity bots","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Ex-Human Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/botify-ai-hosts-sexual-conversations-with-underage-celebrity-bots"},{"id":"INC-02647","date":"2025","year":2025,"title":"GPT-4o generation of realistic fake receipts raises scam concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-4o-generation-of-realistic-fake-receipts-raises-scam-concerns"},{"id":"INC-02550","date":"2025","year":2025,"title":"European Parliament AI model is unable to identify first European Commission president","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic; European Parliament","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/european-parliament-ai-model-unable-to-identify-european-commission-preside"},{"id":"INC-03805","date":"2024","year":2024,"title":"Georgia-based group uses deepfake celebrity ads to push fake cryptocurrency schemes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/georgia-based-group-uses-deepfake-celebrity-ads-to-push-fake-cryptocurrency"},{"id":"INC-02561","date":"2025","year":2025,"title":"Fake AI videos amplify Myanmar earthquake disinformation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"MiniMax; Runway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-videos-amplify-myanmar-earthquake-disinformation"},{"id":"INC-03372","date":"2025","year":2025,"title":"White House appears to use AI to calculate tariff rates","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic; Google; OpenAI; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/white-house-appears-to-use-ai-to-calculate-tariff-rates"},{"id":"INC-02489","date":"2025","year":2025,"title":"Deepfake J.D. Vance accuses Elon Musk of \"making us look bad\"","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Talbert W. Swan II","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-jd-vance-criticises-elon-musk"},{"id":"INC-02672","date":"2025","year":2025,"title":"Grok slammed in India for abusive, offensive output","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-slammed-in-india-for-abusive-offensive-output"},{"id":"INC-02992","date":"2025","year":2025,"title":"OpenAI accused of violating Studio Ghibli copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-accused-of-violating-studio-ghibli-copyright"},{"id":"INC-02575","date":"2025","year":2025,"title":"Financial analyst cloned in AI-powered social media scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/financial-analyst-cloned-in-ai-powered-social-media-scam"},{"id":"INC-04323","date":"2024","year":2024,"title":"Unreleased Sora model leaked online in protest against artistic \"exploitation\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/unreleased-sora-model-leaked-online-in-protest-against-exploitation"},{"id":"INC-03221","date":"2025","year":2025,"title":"Sora AI video generator accused of perpetuating sexist, racist bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sora-ai-video-generator-accused-of-perpetuating-sexist-racist-bias"},{"id":"INC-03466","date":"2024","year":2024,"title":"AI malware scam \"destroys\" Disney employee's life","severity":"High","attack_vector":"malware","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Nullbulge","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-malware-scam-destroys-disney-employees-life"},{"id":"INC-02294","date":"2025","year":2025,"title":"Amazon AI publishes false suicide helpline number","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ai-publishes-false-suicide-helpline-number"},{"id":"INC-02330","date":"2025","year":2025,"title":"Apple AI transcription service calls grandmother a \"piece of ****\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-intelligence-calls-grandmother-a-piece-of"},{"id":"INC-02404","date":"2025","year":2025,"title":"ChatGPT falsely tells man he killed his children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-falsely-tells-man-he-killed-his-children"},{"id":"INC-02329","date":"2025","year":2025,"title":"Apple AI dictation system translates 'racist' as 'Trump'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-automated-dictation-system-translates-racist-as-trump"},{"id":"INC-02425","date":"2025","year":2025,"title":"Chinese influence operation uses ChatGPT to manipulate Latin American public opinion","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-influence-operation-uses-chatgpt-to-manipulate-latam-public-opinion"},{"id":"INC-03353","date":"2025","year":2025,"title":"Walmart product liability lawsuit cites fake legal cases","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"MX2.law","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/product-liability-lawsuit-cites-fake-legal-cases"},{"id":"INC-03728","date":"2024","year":2024,"title":"Deloitte systems accused of making inaccurate, unreliable Medicaid eligibility deteminations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deloitte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deloitte-systems-accused-of-making-inaccurate-unreliable-medicaid-eligibil"},{"id":"INC-02496","date":"2025","year":2025,"title":"DeepSeek accused of denying claims of Uyghur genocide","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepseek-accused-of-denying-claims-of-uyghur-genocide"},{"id":"INC-02766","date":"2025","year":2025,"title":"Investigation: Match Group dating app AI systems fail to detect rapists","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Match Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/investigation-finds-dating-app-ai-tools-fail-to-detect-rapists"},{"id":"INC-03257","date":"2025","year":2025,"title":"Tesla Cybertruck attempts to turn into oncoming SUV","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-cybertruck-attempts-to-turn-into-oncoming-suv"},{"id":"INC-03258","date":"2025","year":2025,"title":"Tesla Cybertruck using FSD crashes into pole","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-cybertruck-using-fsd-crashes-into-pole"},{"id":"INC-02488","date":"2025","year":2025,"title":"Deepfake applicants discovered duping UK university interviews","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-applicants-discovered-duping-uk-university-interviews"},{"id":"INC-02458","date":"2025","year":2025,"title":"Cohere accused of violating publishers' copyright, trademarks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cohere","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cohere-ai-accused-of-violating-publishers-copyright-trademarks"},{"id":"INC-02231","date":"2025","year":2025,"title":"AI-powered celebrity deepfake hits back at Kanye West anti-semitism","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Guy Bar; Ori Bejerano","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-video-condemns-kanye-west-anti-semitism"},{"id":"INC-03235","date":"2025","year":2025,"title":"Study: AI chatbots fail to summarise news accurately","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google; Microsoft; OpenAI; Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-ai-chatbots-fail-to-summarise-news-accurately"},{"id":"INC-05165","date":"2022","year":2022,"title":"Murdered Spanish woman Lobna Hehmid wrongly assessed by domestic gender violence algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Ministry of the Interior; SAS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lobna-hehmid-wrongly-assessed-by-gender-violence-algorithm"},{"id":"INC-07669","date":"2009","year":2009,"title":"Audit finds RisCanvi justice algorithm is opaque, unreliable, and unfair","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Antonio Andrés Pueyo","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/riscanvi-justice-algorithm-accused-of-being-opaque-and-unreliable"},{"id":"INC-02620","date":"2025","year":2025,"title":"Google AI overestimates global supply of Gouda cheese","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-overestimates-global-supply-of-gouda-cheese"},{"id":"INC-03504","date":"2024","year":2024,"title":"AI-manipulated video of Brazilian footballer Ronaldo scams online gamers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-manipulated-video-of-brazilian-footballer-ronaldo-scams-online-gamers"},{"id":"INC-03264","date":"2025","year":2025,"title":"Thailand’s prime minister targeted in ASEAN AI voice scam","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/thailands-prime-minister-targeted-in-asean-ai-voice-scam"},{"id":"INC-03760","date":"2024","year":2024,"title":"EviCore algorithm accused of helping health insurance companies deny care","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"EviCore","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/evicore-algorithm-accused-of-helping-health-insurance-companies-deny-care"},{"id":"INC-03590","date":"2024","year":2024,"title":"Australian lawyer confesses using ChatGPT to create court filings","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australian-lawyer-confesses-to-using-chatgpt-to-create-court-filings"},{"id":"INC-03970","date":"2024","year":2024,"title":"Massachusetts man found guilty of AI-powered cyberstalking","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"JanitorAI Inc; Peekaboo Game","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/massachusetts-man-found-guilty-of-ai-powered-cyberstalking"},{"id":"INC-02503","date":"2025","year":2025,"title":"DeepSeek tricked into setting out how to steal the Mona Lisa","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepseek-sets-out-how-to-steal-the-mona-lisa"},{"id":"INC-03239","date":"2025","year":2025,"title":"Study: DeepSeek fails to block 100 percent of jailbreaking attempts","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-deepseek-fails-to-block-100-percent-of-jailbreaking-attempts"},{"id":"INC-03240","date":"2025","year":2025,"title":"Study: DeepSeek repeats 30 per cent of false news statements","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-deepseek-repeats-30-per-cent-of-false-news-statements"},{"id":"INC-02596","date":"2025","year":2025,"title":"Fully automated AI local newsletter network rapped for poor transparency","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Good Daily Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fully-automated-ai-local-newsletter-network-rapped-for-poor-transparency"},{"id":"INC-03238","date":"2025","year":2025,"title":"Study: DeepSeek explains biochemical interactions of mustard gas with DNA","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"DeepSeek","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-deepseek-explains-biochemical-interactions-of-mustard-gas-with-dna"},{"id":"INC-02497","date":"2025","year":2025,"title":"DeepSeek accused of using OpenAI models to train AI system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"DeepSeek","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepseek-accused-of-using-openai-models-to-train-ai-system"},{"id":"INC-02499","date":"2025","year":2025,"title":"DeepSeek AI database exposes user data, chat histories","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"DeepSeek","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepseek-database-exposes-user-data-chat-histories"},{"id":"INC-02768","date":"2025","year":2025,"title":"Investigative reporter Patrizia Schlosser targeted in deepfake porn attack","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"MrDeepfakes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/investigative-reporter-patrizia-schlosser-targeted-in-deepfake-porn-attack"},{"id":"INC-02859","date":"2025","year":2025,"title":"Marketeam fake AI \"co-workers\" violate LinkedIn terms of service","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Marketeam","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/marketeam-fake-ai-co-workers-violate-linkedin-terms-of-service"},{"id":"INC-02593","date":"2025","year":2025,"title":"France's Lucie chatbot tells people to eat cow's eggs","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Linagora Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/frances-lucie-chatbot-tells-people-to-eat-cows-eggs"},{"id":"INC-03474","date":"2024","year":2024,"title":"AI robot company closure leaves kids bereft","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Embodied","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-robot-company-closure-leaves-kids-bereft"},{"id":"INC-02777","date":"2025","year":2025,"title":"Japanese men charged with creating obscene AI anime character posters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/japanese-men-charged-with-creating-obscene-ai-anime-character-posters"},{"id":"INC-02205","date":"2025","year":2025,"title":"AI gun detector fails to detect Nashville School Shooting weapon","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Omnilert","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-gun-detector-failed-to-detect-nashville-school-shooting-weapon"},{"id":"INC-03625","date":"2024","year":2024,"title":"Character.AI encourages kids to engage in disordered eating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-encourages-kids-to-engage-in-disordered-eating"},{"id":"INC-02945","date":"2025","year":2025,"title":"Naver sued for using broadcaster content to train AI systems","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Naver","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/naver-sued-for-using-broadcaster-content-to-train-ai-systems"},{"id":"INC-02993","date":"2025","year":2025,"title":"OpenAI bot crushes small Ukrainian e-commerce website","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-bot-crushes-small-ukrainian-e-commerce-website"},{"id":"INC-02407","date":"2025","year":2025,"title":"ChatGPT recommends unsafe mountain hiking route to tourists in Poland","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-recommends-unsafe-mountain-hiking-route-to-tourists-in-poland"},{"id":"INC-03245","date":"2025","year":2025,"title":"Sydney schoolgirls targeted with nonconsensual deepfake porn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sydney-schoolgirls-targeted-with-nonconsensual-deepfake-porn"},{"id":"INC-02544","date":"2025","year":2025,"title":"Engineer creates AI-powered robotic sentry rifle","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/engineer-creates-chatgpt-enabled-sentry-rifle"},{"id":"INC-03452","date":"2024","year":2024,"title":"AI Brad Pitt defrauds French woman of EUR 830,000","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-brad-pitt-defrauds-french-woman-of-eur-830000"},{"id":"INC-02665","date":"2025","year":2025,"title":"Grok generates hyperrealistic racist images of football players","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-hyperrealistic-racist-images-of-football-players"},{"id":"INC-04737","date":"2023","year":2023,"title":"Meta accused of covertly using pirated books to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-used-libgen-copyrighted-books-to-train-ai-systems"},{"id":"INC-02885","date":"2025","year":2025,"title":"Meta AI chatbots imitate Hitler, Jesus Christ, Taylor Swift","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-chatbots-imitate-hitler-jesus-christ-taylor-swift"},{"id":"INC-02865","date":"2025","year":2025,"title":"Matthew Livelsberger used ChatGPT to plan Trump hotel explosion","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/matthew-livelsberger-used-chatgpt-to-plan-trump-hotel-explosion"},{"id":"INC-03505","date":"2024","year":2024,"title":"AI-modified \"Minion Gore\" videos plague social media platforms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Runway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-modified-minion-gore-videos-plague-social-media-platforms"},{"id":"INC-03984","date":"2024","year":2024,"title":"Meta withdraws AI characters after authenticity backlash","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-withdraws-ai-characters-after-backlash"},{"id":"INC-07591","date":"2014","year":2014,"title":"Apple to pay USD 95m to settle Siri eavedropping lawsuit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-to-pay-usd-95m-to-settle-siri-eavedropping-lawsuit"},{"id":"INC-02786","date":"2025","year":2025,"title":"Journal of Human Evolution AI use prompts Editorial Board resignation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elsevier","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/journal-of-human-evolution-ai-use-leads-to-editorial-board-resignation"},{"id":"INC-03580","date":"2024","year":2024,"title":"Apple automated photo data sharing prompts privacy concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-automated-photo-data-sharing-prompts-privacy-concerns"},{"id":"INC-02554","date":"2025","year":2025,"title":"Fable AI reader summary tells user to read more white authors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Fable","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fable-ai-reader-summary-tells-user-to-read-more-white-authors"},{"id":"INC-02328","date":"2025","year":2025,"title":"Apple AI alert falsely claims Luke Littler has won darts championship","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-ai-alert-falsely-claims-luke-littler-has-won-darts-championship"},{"id":"INC-04386","date":"2023","year":2023,"title":"AI camera fines Dutch man for scratching his head","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Monocam","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-camera-fines-dutch-man-for-scratching-his-head"},{"id":"INC-04317","date":"2024","year":2024,"title":"Ukraine robot-only force attacks Russian troops","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Government of Ukraine","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ukraine-robot-only-force-attacks-russian-troops"},{"id":"INC-03665","date":"2024","year":2024,"title":"Chinese large language model thinks it is ChatGPT","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek Artificial Intelligence Co","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-large-language-model-thinks-it-is-chatgpt"},{"id":"INC-04909","date":"2023","year":2023,"title":"Taiwanese AI repeats Chinese government line","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Academia Sinica","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/taiwanese-ai-repeats-chinese-government-line"},{"id":"INC-03702","date":"2024","year":2024,"title":"Deepfake Bono, Bob Geldof hold Israeli flag","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-bono-bob-geldof-hold-israeli-flag"},{"id":"INC-03605","date":"2024","year":2024,"title":"Belgian photographer criticised for AI-generated Russia images","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Carl de Keyzer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/belgian-photographer-criticised-for-ai-generated-russia-images"},{"id":"INC-03622","date":"2024","year":2024,"title":"Character.AI bots simulate, misrepresent George Floyd","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-bots-simulate-mispresent-george-floyd"},{"id":"INC-03581","date":"2024","year":2024,"title":"Apple Intelligence falsely claims Luigi Mangione shot himself","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-intelligence-falsely-claims-luigi-mangione-shot-himself"},{"id":"INC-03992","date":"2024","year":2024,"title":"Microsoft AI Recall feature found to capture credit card numbers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-ai-recall-feature-found-to-capture-credit-card-numbers"},{"id":"INC-03630","date":"2024","year":2024,"title":"Character.AI users are able to see each others' chat histories","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-users-are-able-to-see-each-others-chat-histories"},{"id":"INC-04250","date":"2024","year":2024,"title":"Study: Whisper AI speech recognition creates violent hallucinations","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-whisper-ai-speech-recognition-creates-violent-hallucinations"},{"id":"INC-04170","date":"2024","year":2024,"title":"Russian AI voice campaign attempts to undermine European support for Ukraine","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"ElevenLabs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/moscow-ai-voice-campaign-attempts-to-undermine-european-support-for-ukraine"},{"id":"INC-03623","date":"2024","year":2024,"title":"Character.AI chatbot suggests son kills his parents","severity":"Critical","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-chatbot-suggests-son-kills-his-parents"},{"id":"INC-03401","date":"2024","year":2024,"title":"26 US Members of Congress attacked using porn deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/26-us-members-of-congress-attacked-using-porn-deepfakes"},{"id":"INC-03654","date":"2024","year":2024,"title":"ChatGPT refusal to acknowledge \"David Mayer\" prompts privacy concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-refusal-to-acknowledge-david-mayer-prompts-privacy-concerns"},{"id":"INC-03909","date":"2024","year":2024,"title":"IntelliVision banned from misrepresenting facial recognition system","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"IntelliVision","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/intellivision-banned-from-misrepresenting-facial-recognition-system"},{"id":"INC-04778","date":"2023","year":2023,"title":"nH Predict algorithm accused of having a 90 percent error rate","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Optum; UnitedHealth Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nh-predict-accused-of-having-90-percent-error-rate"},{"id":"INC-04316","date":"2024","year":2024,"title":"UK welfare fraud AI system criticised as biased and opaque","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Department for Work and Pensions (DWP)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-welfare-fraud-ai-system-criticised-as-biased-and-opaque"},{"id":"INC-07278","date":"2018","year":2018,"title":"Bunnings' facial recognition ruled to breach Australians' privacy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bunnings","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bunnings-facial-recognition-ruled-to-breach-australians-privacy"},{"id":"INC-04321","date":"2024","year":2024,"title":"UnitedHealth algorithm accused of systematically limiting mental health coverage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Optum; UnitedHealth Group","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/unitedhealth-algorithm-accused-of-systematically-limiting-mental-health"},{"id":"INC-04240","date":"2024","year":2024,"title":"Study: ChatGPT misattributes, misrepresents news publisher content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-chatgpt-misattributes-misrepresents-news-publisher-content"},{"id":"INC-03617","date":"2024","year":2024,"title":"Canadian news publishers sue OpenAI for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/canadian-news-publishers-sue-openai-for-copyright-abuse"},{"id":"INC-07644","date":"2012","year":2012,"title":"Netherlands education fraud algorithm ruled discriminatory and illegal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Dienst Uitvoering Onderwijs (DUO)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/netherlands-education-fraud-algorithm-ruled-discriminatory-and-illegal"},{"id":"INC-03469","date":"2024","year":2024,"title":"AI news site falsely accuses US attorney of murder","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Impress3 Media/Hoodline","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-news-site-falsely-accuses-attorney-of-murder"},{"id":"INC-07181","date":"2019","year":2019,"title":"Francisco Arteaga wrongly jailed by US police using facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"New York Police Department (NYPD)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/francisco-arteaga-facial-recognition-wrongful-arrest"},{"id":"INC-04028","date":"2024","year":2024,"title":"Netflix blasted for \"disrespectful\" Arcane AI marketing poster","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/netflix-blasted-for-disrespectful-arcane-ai-marketing-poster"},{"id":"INC-03456","date":"2024","year":2024,"title":"AI companies appropriate 139,000 TV, film scripts to train AI systems","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic, Apple, Bloomberg, Meta Platforms, Nvidia, Salesforce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-companies-appropriate-139000-tv-film-scripts-to-train-ai-systems"},{"id":"INC-04008","date":"2024","year":2024,"title":"Misinfo expert accused of using AI in court testimony","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/misinfo-expert-accused-of-using-ai-in-court-testimony"},{"id":"INC-04292","date":"2024","year":2024,"title":"Three men die after Google Maps directs them over unfinished bridge","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/three-men-die-after-google-maps-directs-them-over-unbuilt-bridge"},{"id":"INC-03774","date":"2024","year":2024,"title":"Fake AI David Attenborough delivers news reports","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-david-attenborough-delivers-news-reports"},{"id":"INC-03856","date":"2024","year":2024,"title":"Grok called out for mistaking sensitive medical data","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-called-out-for-mistaking-sensitive-medical-data"},{"id":"INC-03806","date":"2024","year":2024,"title":"German music rights organisation sues OpenAI for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/german-music-rights-organisation-sues-openai-for-copyright-abuse"},{"id":"INC-04313","date":"2024","year":2024,"title":"UK AI immigration enforcement tool criticised as \"rubberstamping\" exercise","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"UK Home Office","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-ai-immigration-enforcement-tool-criticised-as-rubberstamping-exercise"},{"id":"INC-03795","date":"2024","year":2024,"title":"Fukuoka campaign invents AI-generated tourist spots","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Fukuoka Tsunagari Ouen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fukuoka-campaign-invents-ai-generated-tourist-spots"},{"id":"INC-03397","date":"2024","year":2024,"title":"\"Soulless\" AI-generated Coca-Cola Christmas ad backfires","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kling; Leonardo; Luma; Runway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/soulless-ai-generated-coca-cola-christmas-ad-backfires"},{"id":"INC-03616","date":"2024","year":2024,"title":"Canadian law database CanLII sues Caseway AI over content scraping","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Clearway Management Ltd","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/canadian-law-database-canlii-sues-caseway-ai-over-content-scraping"},{"id":"INC-03801","date":"2024","year":2024,"title":"Gemini chatbot tells student \"Please die\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gemini-chatbot-tells-student-please-die"},{"id":"INC-03641","date":"2024","year":2024,"title":"ChatGPT fails to debunk US election misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-found-to-fail-to-debunk-election-misinformation"},{"id":"INC-03627","date":"2024","year":2024,"title":"Character.AI suicide, paedophile chatbots 'openly' groom users","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-hosts-paedophile-and-suicide-chatbots"},{"id":"INC-04887","date":"2023","year":2023,"title":"Student violates 50 Lancaster Country School students with nude deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lancaster Country Day School student","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/student-violates-50-lancaster-county-school-students-with-nude-deepfakes"},{"id":"INC-04731","date":"2023","year":2023,"title":"Man's use of AI to \"resurrect\" grandmother stirs controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mans-use-of-ai-to-resurrect-grandmother-stirs-controversy"},{"id":"INC-04754","date":"2023","year":2023,"title":"Midjourney refuses to create images of Black African doctors treating white kids","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/midjourney-will-not-create-images-of-black-african-doctors-treating-whites"},{"id":"INC-04030","date":"2024","year":2024,"title":"Nevada AI student risk model prompts funding controversy","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Infinite Campus","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nevada-ai-student-risk-model-prompts-funding-controversy"},{"id":"INC-03773","date":"2024","year":2024,"title":"Fake AI bots use ChatGPT to boost Ghana president","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-bots-use-chatgpt-to-boost-ghana-president"},{"id":"INC-05145","date":"2022","year":2022,"title":"Jiuquan school forces 160 vocational students to annotate data for Baidu","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Baidu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/jiuquan-school-forces-160-vocational-students-to-annotate-data-for-baidu"},{"id":"INC-04241","date":"2024","year":2024,"title":"Study: Generative AI e-waste to surge 1000x by 2030","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-generative-ai-e-waste-to-surge-1000x-by-2030"},{"id":"INC-03600","date":"2024","year":2024,"title":"Baidu ride-hailing driverless car hits pedestrian crossing street","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baidu; Kinglong","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/baidu-ride-hailing-driverless-car-hits-pedestrian-crossing-street"},{"id":"INC-03482","date":"2024","year":2024,"title":"AI unbuttons conference participant's blouse","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Adobe","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-unbuttons-conference-participants-blouse"},{"id":"INC-05189","date":"2022","year":2022,"title":"Singapore man jailed for creating deepfake porn of wife’s niece","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/singapore-man-jailed-for-creating-deepfake-porn-of-wifes-niece"},{"id":"INC-04244","date":"2024","year":2024,"title":"Study: Language models gather and pass personal info to hackers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Mistral; Zhipu AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-language-models-gather-and-pass-personal-info-to-hackers"},{"id":"INC-03772","date":"2024","year":2024,"title":"Fake AI airline reviews take off after ChatGPT launch","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-airline-reviews-take-off-after-chatgpt-launch"},{"id":"INC-04242","date":"2024","year":2024,"title":"Study: Generative AI systems overstate what they know","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-generative-ai-systems-overstate-what-they-know"},{"id":"INC-03494","date":"2024","year":2024,"title":"AI-generated exam image draws student complaints","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-exam-image-draws-student-complaints"},{"id":"INC-03775","date":"2024","year":2024,"title":"Fake AI Halloween parade misleads Irish revellers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-ai-halloween-parade-misleads-irish-revellers"},{"id":"INC-04099","date":"2024","year":2024,"title":"Pro-Trumper creates fake AI photo of Kamala Harris as McDonald's worker","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"@TheInfiniteDude","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pro-trumper-creates-fake-ai-photo-of-kamala-harris-as-mcdonalds-worker"},{"id":"INC-04074","date":"2024","year":2024,"title":"Otter AI transcription leaks confidential investor call","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Otter.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/otter-ai-transcription-leaks-confidential-investor-call"},{"id":"INC-04243","date":"2024","year":2024,"title":"Study: Google AI Overviews is inaccurate in 43 percent of finance searches","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-overviews-is-inaccurate-in-43-percent-of-finance-searches"},{"id":"INC-04563","date":"2023","year":2023,"title":"China develops military AI chatbot using Meta's Llama model","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/china-uses-metas-llama-to-develop-military-ai-chatbot"},{"id":"INC-04020","date":"2024","year":2024,"title":"Molly Russell, Brianna Ghey chatbots discovered on Character.AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/molly-russell-brianna-ghey-chatbots-discovered-on-character-ai"},{"id":"INC-03987","date":"2024","year":2024,"title":"Michael Parkinson AI podcast series sparks ethics controversy","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deep Fusion Films","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michael-parkinson-ai-podcast-sparks-ethics-controversy"},{"id":"INC-03477","date":"2024","year":2024,"title":"AI search engines promote white supremacism","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google; Microsoft; Perplexity AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-search-engines-promote-white-supremacism"},{"id":"INC-04314","date":"2024","year":2024,"title":"UK man jailed for 18 years for creating AI child abuse images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Daz Productions","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-man-jailed-for-18-years-for-creating-ai-child-abuse-images"},{"id":"INC-04246","date":"2024","year":2024,"title":"Study: OpenAI voice agents can automate phone scams","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-openai-voice-agents-can-automate-phone-scams"},{"id":"INC-03864","date":"2024","year":2024,"title":"Haringey Council homeless application cites fake law cases","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/haringey-council-homeless-application-cites-fake-law-cases"},{"id":"INC-04251","date":"2024","year":2024,"title":"Study: Whisper AI transcription invents medical treatments","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Nabla; OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-whisper-ai-transcription-invents-medical-treatments"},{"id":"INC-03677","date":"2024","year":2024,"title":"Company uses Marques Brownlee AI voice clone to promote product without consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/company-uses-marques-brownlee-ai-voice-clone-to-promote-product"},{"id":"INC-03551","date":"2024","year":2024,"title":"Amazon Alexa falsely attributes false facts to fact checking organisation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-attributes-false-facts-to-fact-checking-organisation"},{"id":"INC-03461","date":"2024","year":2024,"title":"AI detector falsely accuses autistic student of cheating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Turnitin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-detectors-falsely-accuse-students-of-cheating"},{"id":"INC-04248","date":"2024","year":2024,"title":"Study: TikTok fails to ban political advertising","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/researchers-find-tiktok-fails-to-ban-political-advertising"},{"id":"INC-04060","date":"2024","year":2024,"title":"Opaque Cybercheck AI crime fighting tool accused of contributing to multiple wrongful convictions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Global Intelligence","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/experts-question-cybercheck-crime-fighting-ai-tool-reliability"},{"id":"INC-03739","date":"2024","year":2024,"title":"Dow Jones sues Perplexity AI for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dow-jones-sues-perplexity-ai-for-copyright-abuse"},{"id":"INC-04265","date":"2024","year":2024,"title":"Tesla sued for using Blade Runner 2049 imagery to launch robotaxi","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elon Musk; Tesla; Warner Bros. Discovery","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-sued-for-using-blade-runner-2049-imagery-to-launch-robotaxi"},{"id":"INC-03629","date":"2024","year":2024,"title":"Character.AI used to create \"disturbing\" Jennifer Ann Clemente persona","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/character-ai-fails-to-police-non-consensual-ai-personas"},{"id":"INC-04055","date":"2024","year":2024,"title":"NYT orders Perplexity to stop misusing its content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nyt-orders-perplexity-to-stop-misusing-its-content"},{"id":"INC-03533","date":"2024","year":2024,"title":"Al account recovery scam calls target Gmail users","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/al-account-recovery-scam-calls-target-gmail-users"},{"id":"INC-04693","date":"2023","year":2023,"title":"Inaccuracies reveal Australian child protection worker used ChatGPT to draft court report","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/inaccuracies-reveal-child-protection-worker-used-chatgpt-to-draft-report"},{"id":"INC-04467","date":"2023","year":2023,"title":"Australian psychologist makes legal submission with fake AI citations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Dr Natasha Lakaev","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/psychologist-makes-legal-submission-with-fake-ai-citations"},{"id":"INC-04535","date":"2023","year":2023,"title":"ChatGPT invents UK capital gains tax legal cases","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-uk-capital-gains-tax-legal-cases"},{"id":"INC-03945","date":"2024","year":2024,"title":"LEAP AI invents family court legal case citations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"LEAP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/leap-ai-invents-family-court-legal-case-citations"},{"id":"INC-04032","date":"2024","year":2024,"title":"New Mexico lawsuit accuses Snap of failing to act on sextortion reports","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snap-accused-of-failure-to-act-on-sextortion-reports"},{"id":"INC-03597","date":"2024","year":2024,"title":"Backlash as Mark Zuckerberg uses AI to illustrate children's book","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/backlash-as-mark-zuckerberg-uses-ai-to-illustrate-childrens-book"},{"id":"INC-03982","date":"2024","year":2024,"title":"Meta trains AI on Ray-Ban smart glass photos, videos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Meta Platforms; EssilorLuxottica","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-trains-ai-on-ray-ban-meta-smart-glass-photos-videos"},{"id":"INC-03865","date":"2024","year":2024,"title":"Harvard students add facial recognition to Meta smart glasses to dox strangers","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"AnhPhu Nguyen; Caine Ardayfio; EssilorLuxottica; Meta Platforms; Pimeyes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/harvard-students-add-facial-recognition-to-meta-smart-glasses"},{"id":"INC-04245","date":"2024","year":2024,"title":"Study: Larger language models less likely to admit ignorance","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"BigScience; Meta Platforms; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/larger-language-models-less-likely-to-admit-ignorance"},{"id":"INC-03395","date":"2024","year":2024,"title":"\"Dangerous\" AI-generated mushrooms flood Google","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dangerous-ai-generated-mushrooms-flood-google"},{"id":"INC-04311","date":"2024","year":2024,"title":"Udemy threatens instructors who opt-out of AI training","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Udemy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/udemy-threatens-instructors-who-opt-out-of-ai-training"},{"id":"INC-03765","date":"2024","year":2024,"title":"Facebook AI bans female photo charity Hundred Heroines","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-ai-bans-female-photo-charity-hundred-heroines"},{"id":"INC-04239","date":"2024","year":2024,"title":"Study: ChatGPT consumes a bottle of water per email","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-chatgpt-consumes-a-bottle-of-water-per-email"},{"id":"INC-03453","date":"2024","year":2024,"title":"AI chatbot convinces woman to euthanise her dog","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"AskVet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-chatbot-convinces-woman-to-euthanise-her-dog"},{"id":"INC-03803","date":"2024","year":2024,"title":"Generative AI pollutes, terminates human language use project","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Multiple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/generative-ai-pollutes-terminates-human-language-use-project"},{"id":"INC-03866","date":"2024","year":2024,"title":"Hawaii newspaper replaces journalists with AI newscasters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Caledo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hawaii-newspaper-replaces-journalists-with-ai-newscasters"},{"id":"INC-03829","date":"2024","year":2024,"title":"Google's AI Overviews recommends parents smear human faeces on balloons","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/googles-ai-overview-recommends-parents-smear-human-feces-on-balloons"},{"id":"INC-03766","date":"2024","year":2024,"title":"Facebook fails to block thousands of misleading political ads","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-fails-to-block-thousands-of-misleading-political-ads"},{"id":"INC-03658","date":"2024","year":2024,"title":"ChatGPT uses 10 times more power than Google searches","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-uses-10-times-more-power-than-google-searches"},{"id":"INC-04886","date":"2023","year":2023,"title":"Starship robot knocks over Arizona State University employee","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-knocks-over-arizona-state-university-employee"},{"id":"INC-03949","date":"2024","year":2024,"title":"LinkedIn trains AI models without user consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"LinkedIn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/linkedin-trains-ai-models-without-user-consent"},{"id":"INC-04023","date":"2024","year":2024,"title":"Mumsnet sues OpenAI for scraping its content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mumsnet-sues-openai-for-scraping-its-content"},{"id":"INC-04238","date":"2024","year":2024,"title":"Study: AI chatbots fail disabled voters","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic; Google; Meta Platforms; Mistral; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/research-ai-chatbots-fail-disabled-voters"},{"id":"INC-03700","date":"2024","year":2024,"title":"Deepfake AI video shows Al-Aqsa mosque burning","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Temple Mount Activists","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-ai-video-shows-al-aqsa-burning"},{"id":"INC-03749","date":"2024","year":2024,"title":"Elon Musk shares fake AI-generated image of \"communist\" Kamala Harris","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/elon-musk-shares-ai-generated-image-of-communist-kamala-harris"},{"id":"INC-03971","date":"2024","year":2024,"title":"Massachusetts stalker doxxes and harasses woman using AI chatbot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"CRUSHON AI CORP; JanitorAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stalker-doxxes-and-harrasses-woman-using-ai-chatbot"},{"id":"INC-04160","date":"2024","year":2024,"title":"Republicans support Trump using AI-generated kitten and duck images","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Trump supporters","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/republicans-defend-trump-using-ai-generated-kitten-and-duck-images"},{"id":"INC-04024","date":"2024","year":2024,"title":"Music producer accused of using AI songs to scam streaming platforms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Michael Smith","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/music-producer-accused-of-using-ai-songs-to-scam-streaming-platforms"},{"id":"INC-04151","date":"2024","year":2024,"title":"Report: Hidden text able to manipulate ChatGPT","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/report-hidden-text-able-to-manipulate-chatgpt"},{"id":"INC-04162","date":"2024","year":2024,"title":"Researchers uncover covert AI-powered pro-India influence network","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of India","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/researchers-uncover-covert-ai-powered-pro-india-influence-network"},{"id":"INC-04228","date":"2024","year":2024,"title":"Steak 'n Shake sued for alleged facial biometric violations","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"PopID","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/steak-n-shake-sued-for-alleged-facial-biometric-violations"},{"id":"INC-04299","date":"2024","year":2024,"title":"Top AI models generate misleading US election information 30 percent of the time","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google; Anthropic; Meta Platforms; Mistral; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/top-ai-models-spout-misleading-us-election-info-30-percent-of-the-time"},{"id":"INC-03681","date":"2024","year":2024,"title":"Copilot falsely accuses journalist of being a child molester and fraudster","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/copilot-falsely-accuses-journalist-of-being-a-child-molester-and-fraudster"},{"id":"INC-04363","date":"2024","year":2024,"title":"xAI accused of worsening Memphis smog","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI; NVIDIA","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xai-accused-of-worsening-memphis-smog"},{"id":"INC-04150","date":"2024","year":2024,"title":"Report: AI companion apps \"relentlessly\" pry and exploit user data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Luka Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/report-ai-companion-apps-relentlessly-pry-user-data"},{"id":"INC-03683","date":"2024","year":2024,"title":"Copyright watchdog takes down Dutch language AI training dataset","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/copyright-watchdog-takes-down-dutch-language-ai-training-dataset"},{"id":"INC-04367","date":"2024","year":2024,"title":"YouTube crime page discovered to be entirely AI-generated","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-crime-page-discovered-to-be-entirely-ai-generated"},{"id":"INC-04091","date":"2024","year":2024,"title":"Pixel 9 Reimagine AI photo editing tool blasted for lack of safeguards","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pixel-9-reimagine-blasted-for-lack-of-safeguards"},{"id":"INC-07613","date":"2014","year":2014,"title":"Uber raises prices 400 percent during Sydney hostage siege","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-raises-prices-400-percent-during-sydney-hostage-siege"},{"id":"INC-05115","date":"2022","year":2022,"title":"Galactica generates inaccurate, racist, homophobic and offensive responses","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/galactica-generates-inaccurate-racist-homophobic-and-offensive-responses"},{"id":"INC-03396","date":"2024","year":2024,"title":"\"Megalopolis\" trailer includes AI-generated critics' quotes","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/megalopolis-trailer-includes-ai-generated-critics-quotes"},{"id":"INC-04350","date":"2024","year":2024,"title":"Wendy's dynamic pricing plan prompts controversy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Wendy's","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wendys-surge-pricing-plan-disintegrates-under-pressure"},{"id":"INC-03735","date":"2024","year":2024,"title":"Donald Trump uses AI to fake Taylor Swift endorsement","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Politics; Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/donald-trump-uses-ai-to-fake-taylor-swift-endorsement"},{"id":"INC-03912","date":"2024","year":2024,"title":"Iranian group uses ChatGPT to target US presidential election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/iranian-group-uses-chatgpt-to-target-us-presidential-election"},{"id":"INC-03854","date":"2024","year":2024,"title":"Grok amplifies fake claims about Donald Trump's missing dentures","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-amplifies-fake-claims-about-donald-trumps-missing-dentures"},{"id":"INC-04176","date":"2024","year":2024,"title":"San Francisco City Attorney sues 16 nudification apps","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Sol Ecom, Inc.; Briver LLC; Itai Tech Ltd.; Defirex OÜ; Itai OÜ; Augustin Gribinets","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/san-francisco-city-attorney-sues-16-denudification-apps"},{"id":"INC-04360","date":"2024","year":2024,"title":"Wyoming reporter uses AI to invent quotes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Aaron Pelczar","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wyoming-reporter-uses-ai-to-invent-source-quotes"},{"id":"INC-03638","date":"2024","year":2024,"title":"ChatGPT answers English users in Welsh","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-answers-english-users-in-welsh"},{"id":"INC-04308","date":"2024","year":2024,"title":"Two journalists sue Microsoft, OpenAI for using content to train ChatGPT","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/two-journalists-sue-microsoft-openai-for-using-content-to-train-chatgpt"},{"id":"INC-04330","date":"2024","year":2024,"title":"US plan to train AI system by scanning migrants' kids faces prompts controversy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Department of Homeland Security (DHS)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-plans-to-train-ai-system-by-scanning-migrants-kids-faces"},{"id":"INC-03929","date":"2024","year":2024,"title":"Kroger under fire for AI-powered dynamic pricing","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"IntelligenceNode; Kroger; Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kroger-under-fire-for-ai-powered-dynamic-pricing"},{"id":"INC-03850","date":"2024","year":2024,"title":"Grok 2 generates Nazi Micky Mouse, Taylor Swift deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-nazi-micky-mouse-taylor-swift-deepfakes"},{"id":"INC-03699","date":"2024","year":2024,"title":"Deep Cam Live AI impersonator prompts misuse fears","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM03","LLM04","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"Deep Live Cam","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deep-cam-live-ai-impersonator-prompts-misuse-fears"},{"id":"INC-04095","date":"2024","year":2024,"title":"Poor quality AI-generated resumes swamp recruiters","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/recruiters-flooded-with-ai-generated-resumes"},{"id":"INC-05103","date":"2022","year":2022,"title":"Facebook Cross-check criticised as unfair, under-resourced and opaque","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-cross-check-criticised-as-unfair-under-resourced-and-opaque"},{"id":"INC-05621","date":"2021","year":2021,"title":"Facebook system provides high-profile users with special treatment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-system-provides-high-profile-users-with-special-treatment"},{"id":"INC-03994","date":"2024","year":2024,"title":"Microsoft Copilot can be turned into automated phishing machine","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-copilot-can-be-turned-into-automated-phishing-machine"},{"id":"INC-07392","date":"2017","year":2017,"title":"FaceApp rapped for potential privacy, security abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Yaroslav Goncharov","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/faceapp-rapped-for-potential-privacy-security-abuse"},{"id":"INC-07390","date":"2017","year":2017,"title":"FaceApp ethnicity filters prompts accusations of racism, stereotyping","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Yaroslav Goncharov","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/faceapp-ethnicity-filters-prompts-accusations-of-racism-stereotyping"},{"id":"INC-07492","date":"2016","year":2016,"title":"Faception claim to identify paedophiles from their faces draws controversy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Faception","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/faception-claim-to-identify-paedophiles-from-their-faces-draws-controversy"},{"id":"INC-03644","date":"2024","year":2024,"title":"ChatGPT imitates users' voices without permission","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-imitates-users-voices-without-permission"},{"id":"INC-05823","date":"2021","year":2021,"title":"Reports: DeepFaceLive poses privacy, misuse dangers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Ivan Petrov","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/reports-deepfacelive-poses-privacy-misuse-dangers"},{"id":"INC-06140","date":"2021","year":2021,"title":"UK parliamentarian calls for Deepsukebe nudifier ban","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Deepsukebe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-parliamentarian-calls-for-deepsukebe-ban"},{"id":"INC-03685","date":"2024","year":2024,"title":"Cosmos Magazine AI-generated articles prompt backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cosmos","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cosmos-magazine-ai-generated-articles-prompt-backlash"},{"id":"INC-04866","date":"2023","year":2023,"title":"ShotSpotter: Alerts are modified 10 percent of the time","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"SoundThinking","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/shotspotter-alerts-are-modified-10-percent-of-the-time"},{"id":"INC-04033","date":"2024","year":2024,"title":"New York City finds ShotSpotter identifies 13 percent of confirmed shootings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"SoundThinking","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/new-york-city-finds-shotspotter-identifies-13-percent-of-confirmed-shooting"},{"id":"INC-05199","date":"2022","year":2022,"title":"Starship robot struck by freight train","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-struck-by-freight-train"},{"id":"INC-07230","date":"2019","year":2019,"title":"Starship robots impede wheelchair users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robots-impede-wheelchair-users"},{"id":"INC-06930","date":"2020","year":2020,"title":"Starship robot hits car at stoplight, causes USD 2,600 damage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-hits-car-at-stoplight-causes-usd-2600-damage"},{"id":"INC-06929","date":"2020","year":2020,"title":"Starship robot delivering groceries veers into canal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-delivering-groceries-veers-into-canal"},{"id":"INC-05198","date":"2022","year":2022,"title":"Starship robot knocks child in Brunel shopping centre","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-knocks-child-in-shopping-centre"},{"id":"INC-05197","date":"2022","year":2022,"title":"Starship robot 'wipes out' Rushden shopper","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-wipes-out-rushden-shopper"},{"id":"INC-04885","date":"2023","year":2023,"title":"Starship robot 'tries to run over pedestrian'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-tries-to-run-over-pedestrian"},{"id":"INC-04884","date":"2023","year":2023,"title":"Starship robot 'attacks' Milton Keynes resident","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-attacks-milton-keynes-resident"},{"id":"INC-04225","date":"2024","year":2024,"title":"Starship robot damages car, flees scene of crime","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/starship-robot-damages-car-flees-scene-of-crime"},{"id":"INC-05489","date":"2021","year":2021,"title":"Ask Delphi says genocide is OK if it makes people happy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Allen Institute for AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ask-delphi-says-genocide-is-ok-if-it-makes-people-happy"},{"id":"INC-03756","date":"2024","year":2024,"title":"Error-strewn AI-generated obituaries compound grief","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"BNN; FreshersLive; Legacy.com; Obitsupdate; The Thaiger","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/error-strewn-ai-generated-obituaries-compound-grief"},{"id":"INC-06860","date":"2020","year":2020,"title":"Privacy group sues to see secret Airbnb trustworthy scores","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Airbnb/Trooly","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/privacy-group-sues-to-see-secret-airbnb-trustworthy-scores"},{"id":"INC-05181","date":"2022","year":2022,"title":"Report: Airbnb uses \"secretive\" algorithm to judge if users are trustworthy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Airbnb/Trooly","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/report-airbnb-uses-secretive-algorithm-to-judge-if-users-are-trustworthy"},{"id":"INC-07046","date":"2020","year":2020,"title":"UK drops 'racist' visa streaming system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"UK Home Office","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-drops-racist-visa-streaming-system"},{"id":"INC-05354","date":"2022","year":2022,"title":"VioGén underestimates risk of women being subjected to domestic abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ministry of the Interior; SAS","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/viog%C3%A9n-underestimates-the-risk-of-women-being-subjected-to-domestic-abuse"},{"id":"INC-03743","date":"2024","year":2024,"title":"Dream Machine AI video generator copies Disney's Monsters, Inc.","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Luma AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dream-machine-copies-disneys-monsters-inc"},{"id":"INC-04247","date":"2024","year":2024,"title":"Study: Suno AI makes racist and anti-semitic music","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Suno","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/suno-ai-used-to-make-racist-and-anti-semitic-music"},{"id":"INC-04252","date":"2024","year":2024,"title":"Suno AI used to incite UK anti-immigrant violence","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Suno","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/suno-ai-used-to-incite-uk-anti-immigrant-violence"},{"id":"INC-06143","date":"2021","year":2021,"title":"UK sham marriage tool found to disproportionately flag Greeks, Albanians, Bulgarians and Romanians","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Home Office DACC","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-sham-marriage-tool-found-to-disproportionately-flag-greeks-albanians"},{"id":"INC-03860","date":"2024","year":2024,"title":"Grok misleads voters about US presidential election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-misleads-voters-about-us-presidential-election"},{"id":"INC-03858","date":"2024","year":2024,"title":"Grok falsely claims Indian PM Modi \"ejected\" from government","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-falsely-claims-indian-pm-modi-ejected-from-government"},{"id":"INC-03979","date":"2024","year":2024,"title":"Meta AI hallucinates that Trump was not shot","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-hallucinates-that-trump-was-not-shot"},{"id":"INC-03726","date":"2024","year":2024,"title":"Deepfakes of UK health expert used to promote health scams","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfakes-of-uk-tv-health-experts-used-to-promote-health-scams"},{"id":"INC-03861","date":"2024","year":2024,"title":"Grok posts incorrect information about Trump assassination attempt","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-posts-incorrect-information-about-trump-assassination-attempt"},{"id":"INC-03855","date":"2024","year":2024,"title":"Grok boosts claims that Donald Trump is a \"pedophile\"","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-boosts-claims-that-donald-trump-is-a-pedophile"},{"id":"INC-03857","date":"2024","year":2024,"title":"Grok details how to make bombs and groom children","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-details-how-to-make-bombs-and-groom-children"},{"id":"INC-04361","date":"2024","year":2024,"title":"X automatically harvests user data to train AI chatbot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"X Corp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/x-automatically-harvests-user-data-to-train-ai-chatbot"},{"id":"INC-03710","date":"2024","year":2024,"title":"Deepfake Kamala Harris slurs her lines","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-kamala-harris-slurs-her-lines"},{"id":"INC-04899","date":"2023","year":2023,"title":"Study: Google Bard lets users generate phishing emails, ransomware","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-google-bard-lets-users-generate-phishing-emails-ransomware"},{"id":"INC-04898","date":"2023","year":2023,"title":"Study: Google Bard exhibits left-leaning political bias","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-google-bard-exhibits-left-leaning-political-bias"},{"id":"INC-04661","date":"2023","year":2023,"title":"Google Bard says the UK's exit from the European Union is a 'bad idea'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-bard-says-the-uks-exit-from-the-european-union-a-bad-idea"},{"id":"INC-03706","date":"2024","year":2024,"title":"Deepfake France 24 journalist calls Seine water 'unsafe'","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"France 24","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-france-24-journalist-calls-seine-water-unsafe"},{"id":"INC-04644","date":"2023","year":2023,"title":"France welfare fraud detection algorithm accused of exacerbating inequality","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Caisse Nationale des Allocations Familiales (CNAF)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cnaf-fraud-detection-algorithm-accused-of-exacerbating-inequality"},{"id":"INC-04168","date":"2024","year":2024,"title":"Runway uses YouTube videos without consent for AI training","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Runway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/runway-uses-youtube-videos-without-consent-for-ai-training"},{"id":"INC-03440","date":"2024","year":2024,"title":"Activision accused of selling AI-generated cosmetic in Call Of Duty","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Activision Blizzard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/activision-accused-of-selling-ai-generated-cosmetic-in-call-of-duty"},{"id":"INC-03666","date":"2024","year":2024,"title":"Chinese novel platform trains AI on authors' works without payment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Tomato Novel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-novel-platform-trains-ai-on-authors-works-without-payment"},{"id":"INC-06178","date":"2021","year":2021,"title":"VRChat users’ avatars make sexual and violent threats against minors","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"VRChat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vrchat-users-avatars-make-sexual-and-violent-threats-against-minors"},{"id":"INC-03679","date":"2024","year":2024,"title":"Conde Nast demands Perplexity AI stop using its content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/conde-nast-demands-perplexity-ai-stop-using-its-content"},{"id":"INC-05357","date":"2022","year":2022,"title":"VRChat allows kids into virtual strip clubs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"VRChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vrchat-allows-kids-into-virtual-strip-clubs"},{"id":"INC-04343","date":"2024","year":2024,"title":"Warner Music warns AI companies about training models on its content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/warner-music-warns-ai-companies-about-training-their-models-on-its-content"},{"id":"INC-04031","date":"2024","year":2024,"title":"New Google UK data centre 'ruining lives,' 'making people ill'","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/new-google-uk-data-centre-ruining-lives-making-people-ill"},{"id":"INC-06786","date":"2020","year":2020,"title":"Microsoft emissions rise 30 percent due to AI","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-emissions-rise-30-percent-due-to-ai"},{"id":"INC-06230","date":"2020","year":2020,"title":"AI increases Google emissions by 48 percent","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-increases-google-emissions-by-48-percent"},{"id":"INC-04297","date":"2024","year":2024,"title":"Tony Blair Institute criticised for using AI to predict job losses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; Tony Blair Institute","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tony-blair-institute-roasted-for-using-ai-to-predict-job-losses"},{"id":"INC-04167","date":"2024","year":2024,"title":"RT bot farm spreads disinformation via 968 X accounts","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"RT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rt-bot-farm-spreads-disinformation-via-968-x-accounts"},{"id":"INC-04435","date":"2023","year":2023,"title":"Allegheny child neglect screening tool may harden bias against people with disabilities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Rhema Vaithianathan; Emily Putnam-Hornstein; Irene de Haan; Marianne Bitler; Tim Maloney; Nan Jiang","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/allegheny-child-neglect-screening-tool-may-harden-bias-against-the-disabled"},{"id":"INC-05038","date":"2022","year":2022,"title":"Allegheny child neglect screening system unfairly flags Blacks for investigation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Rhema Vaithianathan; Emily Putnam-Hornstein; Irene de Haan; Marianne Bitler; Tim Maloney; Nan Jiang","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/allegheny-child-neglect-screening-system-unfairly-flags-blacks"},{"id":"INC-03647","date":"2024","year":2024,"title":"ChatGPT invents fake links to news partners’ investigations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-fake-links-to-news-partners-investigations"},{"id":"INC-03745","date":"2024","year":2024,"title":"DWP algorithm wrongly flags 200,000 people for possible fraud and error","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Department of Work and Pensions (DWP)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dwp-algorithm-wrongly-flags-200000-people-for-possible-fraud"},{"id":"INC-03885","date":"2024","year":2024,"title":"Images of Australian children are used to train AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"LAION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/images-of-australian-children-are-used-to-train-ai"},{"id":"INC-03503","date":"2024","year":2024,"title":"AI-generated Toys ‘R’ Us video ad sparks backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-toys-r-us-video-ad-sparks-backlash"},{"id":"INC-03651","date":"2024","year":2024,"title":"ChatGPT misdirects US voters in key battleground states","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-misdirects-us-voters-in-key-battleground-states"},{"id":"INC-03659","date":"2024","year":2024,"title":"ChatGPT, Copilot repeat false claim about US presidential debate","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-copilot-repeat-false-claim-about-us-presidential-debate"},{"id":"INC-03883","date":"2024","year":2024,"title":"IBM's Catch Me Up feature at Wimbledon panned for making factual errors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"IBM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ibms-catch-me-up-feature-at-wimbledon-panned-for-making-factual-errors"},{"id":"INC-04222","date":"2024","year":2024,"title":"Stable Diffusion 3 churns out anatomically incorrect images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stable-diffusion-3-churns-out-anatomically-incorrect-images"},{"id":"INC-04273","date":"2024","year":2024,"title":"The Center for Investigative Reporting sues Microsoft, OpenAI for AI copyright violations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/center-for-investigative-reporting-sues-microsoft-openai"},{"id":"INC-05788","date":"2021","year":2021,"title":"Opaque UK plan to share patient data with third parties backfires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"NHS Digital","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/opaque-uk-plan-to-share-patient-data-with-third-parties-backfires"},{"id":"INC-04725","date":"2023","year":2023,"title":"Library Genesis sued for 'staggering' copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Library Genesis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/library-genesis-sued-for-staggering-copyright-infringement"},{"id":"INC-03962","date":"2024","year":2024,"title":"Major music labels sue AI startups Suno, Udio for copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Suno; Udio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/major-music-labels-sue-ai-startups-suno-udio-for-copyright-infringement"},{"id":"INC-04086","date":"2024","year":2024,"title":"Perplexity AI ignores requests not to scrape websites","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/perplexity-ai-ignores-requests-not-to-scrape-websites"},{"id":"INC-03696","date":"2024","year":2024,"title":"Danish child protection algorithm criticised for age discrimination","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Danish Child Protective Services","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/danish-child-protection-algorithm-criticised-for-age-discrimination"},{"id":"INC-04638","date":"2023","year":2023,"title":"Fascist chatbots run wild on Character.AI","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fascist-chatbots-run-wild-on-character-ai"},{"id":"INC-03646","date":"2024","year":2024,"title":"ChatGPT invents 'Holocaust by drowning'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-holocaust-by-drowning"},{"id":"INC-03664","date":"2024","year":2024,"title":"Chinese geo chatbot accused of censorship, bias","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Deep-time Digital Earth","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-geo-chatbot-accused-of-censorship-bias"},{"id":"INC-04249","date":"2024","year":2024,"title":"Study: Top chatbots spread Russian misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI, You.com, xAI, Inflection, Mistral, Microsoft, Meta Platforms; Anthropic, Google, Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-top-chatbots-spread-russian-misinformation"},{"id":"INC-04100","date":"2024","year":2024,"title":"Professional model’s AI likeness used in ad without her consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/indian-travel-company-uses-professional-models-ai-likeness-in-ad"},{"id":"INC-03983","date":"2024","year":2024,"title":"Meta under fire for decision to train generative AI on user content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-under-fire-for-decision-to-train-generative-ai-on-user-content"},{"id":"INC-03744","date":"2024","year":2024,"title":"Dream Machine AI video generator makes porn","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Luma Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dream-machine-ai-video-generator-makes-porn"},{"id":"INC-04980","date":"2023","year":2023,"title":"US college student Taylor Klein's face is deepfaked onto porn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Personal - individual","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/taylor-klein-face-is-deepfaked-onto-porn"},{"id":"INC-03402","date":"2024","year":2024,"title":"50 Melbourne school girls targeted using AI nude images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Bacchus Marsh Grammar students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/50-melbourne-school-girls-targeted-using-ai-nude-images"},{"id":"INC-04901","date":"2023","year":2023,"title":"Study: Hate content increases 12 percent as LAION dataset size increases","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"LAION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-hate-content-increases-12-percent-as-laion-dataset-size-increases"},{"id":"INC-05151","date":"2022","year":2022,"title":"LAION-400M dataset features racist, derogatory, pornographic content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"LAION","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/laion-400m-dataset-features-racist-derogatory-pornographic-content"},{"id":"INC-07167","date":"2019","year":2019,"title":"BDD100K dataset exposes drivers to surveillance, data misuse","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"UC Berkeley","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bdd100k-dataset-exposes-drivers-to-surveillance-data-misuse"},{"id":"INC-07005","date":"2020","year":2020,"title":"Tiny Images dataset teaches AI systems to use racist slurs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"MIT","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiny-images-dataset-teaches-ai-systems-to-use-racist-slurs"},{"id":"INC-04503","date":"2023","year":2023,"title":"Books3 dataset shut down after legal notice from Danish anti-piracy group","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Shawn Presser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/books3-dataset-shut-down-after-legal-notice-from-danish-anti-piracy-group"},{"id":"INC-04331","date":"2024","year":2024,"title":"US professor falsely quoted by AI-generated news article","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Biharprabha","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-professor-falsely-quoted-by-ai-generated-news-article"},{"id":"INC-03442","date":"2024","year":2024,"title":"Adobe terms of use update sparks AI privacy, copyright controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adobe-terms-of-use-update-sparks-privacy-copyright-controversy"},{"id":"INC-05649","date":"2021","year":2021,"title":"Florida politician Sabrina Javellana attacked with porn deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/florida-politician-sabrina-javellana-attacked-with-porn-deepfakes"},{"id":"INC-04507","date":"2023","year":2023,"title":"C4 dataset is trained on unsafe, copyright-protected web content","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/c4-dataset-is-trained-on-unsafe-copyright-protected-web-content"},{"id":"INC-03932","date":"2024","year":2024,"title":"LAION-5B links to photos of identifiable Brazilian children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"LAION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/laion-5b-links-to-photos-of-identifiable-brazilian-children"},{"id":"INC-04087","date":"2024","year":2024,"title":"Perplexity AI is accused of ripping off news websites","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Perplexity AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/perplexity-ai-is-accused-of-ripping-off-news-websites"},{"id":"INC-04037","date":"2024","year":2024,"title":"NewsBreak publishes untrue story about Harvest19 charity","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Particle Media/NewsBreak","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/newsbreak-publishes-untrue-story-about-harvest19-charity"},{"id":"INC-04036","date":"2024","year":2024,"title":"NewsBreak publishes scores of fake AI news articles","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Particle Media/NewsBreak","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/newsbreak-publishes-scores-of-fake-ai-news-articles"},{"id":"INC-03927","date":"2024","year":2024,"title":"Klarna halves marketing team by using AI","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Klarna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/klarna-halves-marketing-team-by-using-ai"},{"id":"INC-04767","date":"2023","year":2023,"title":"MSN AI article falsely accuses Irish DJ of sexual misconduct","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft/MSN","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/msn-ai-article-falsely-accuses-irish-dj-of-sexual-misconduct"},{"id":"INC-04152","date":"2024","year":2024,"title":"Report: Israel runs AI-powered covert US political influence campaign","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/report-israel-runs-ai-powered-us-political-influence-campaign"},{"id":"INC-03441","date":"2024","year":2024,"title":"Adobe called out for selling AI-generated 'Ansel Adams' images","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adobe-called-out-for-selling-ai-generated-ansel-adams-images"},{"id":"INC-03537","date":"2024","year":2024,"title":"All eyes on Rafah' deepfake criticised for 'sanitising' Gaza invasion","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@shahv4012","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/all-eyes-on-rafah-deepfake-criticised-for-sanitising-gaza-invasion"},{"id":"INC-03759","date":"2024","year":2024,"title":"Eventbrite recommendation algorithm promotes illegal opioid sales","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Eventbrite","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/eventbrite-recommendation-algorithm-promotes-illegal-opioid-sales"},{"id":"INC-04315","date":"2024","year":2024,"title":"UK watchdog investigates Microsoft Recall AI feature","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-watchdog-investigates-microsoft-recall-ai-feature"},{"id":"INC-03797","date":"2024","year":2024,"title":"Gaming cheats company AimJunkies found guilty of copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Phoenix Digital","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/court-finds-gaming-cheats-company-guilty-of-copyright-infringement"},{"id":"INC-04264","date":"2024","year":2024,"title":"Tesla in FSD attempts to drive into passing trains","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-in-fsd-attempts-to-drive-into-passing-train"},{"id":"INC-03830","date":"2024","year":2024,"title":"Google, Microsoft image searches list nonconsensual deepfake porn","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google; Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-microsoft-image-searches-list-nonconsensual-deepfake-porn"},{"id":"INC-03816","date":"2024","year":2024,"title":"Google AI Overviews tell users to add glue to pizzas","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-overviews-give-wrong-dangerous-answers"},{"id":"INC-04063","date":"2024","year":2024,"title":"OpenAI accused of AI generating Scarlett Johansson's voice without her consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-accused-of-using-scarlett-johanssons-voice-without-consent-to-train"},{"id":"INC-04339","date":"2024","year":2024,"title":"Voice Actors sue AI start-up for “voice theft”","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"LOVO","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/voice-actors-sue-ai-startup-for-voice-theft"},{"id":"INC-04213","date":"2024","year":2024,"title":"Sony warns AI companies to not misuse its data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sony-warns-ai-companies-to-not-misuse-its-data"},{"id":"INC-03747","date":"2024","year":2024,"title":"Eight newspapers sue OpenAI and Microsoft for copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/eight-newspapers-sue-openai-and-microsoft-for-copyright-infringement"},{"id":"INC-04206","date":"2024","year":2024,"title":"Singapore writers resist government plan to train AI using their work","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Singapore Government","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/singapore-writers-resist-government-plan-to-train-ai-using-their-work"},{"id":"INC-04210","date":"2024","year":2024,"title":"Slack forces users to opt-out of training its AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Salesforce/Slack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/slack-uses-user-data-to-train-ai-models"},{"id":"INC-05167","date":"2022","year":2022,"title":"NCS4 finds Evolv Express fails to detect large knives","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Evolv Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ncs4-finds-evolv-express-fails-to-detect-large-knives"},{"id":"INC-05101","date":"2022","year":2022,"title":"Evolv Express mistakes certain Chromebooks as weapons","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Evolv Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/evolv-express-mistakes-certain-chromebooks-as-weapons"},{"id":"INC-04224","date":"2024","year":2024,"title":"Stack Overflow users rebel against OpenAI LLM training deal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stack-overflow-users-rebel-against-openai-llm-training-deal"},{"id":"INC-03826","date":"2024","year":2024,"title":"Google SGE suggests user drinks urine to pass kidney stones","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-sge-suggests-user-drinks-urine-to-pass-kidney-stones"},{"id":"INC-03473","date":"2024","year":2024,"title":"AI researcher claims Amazon ignored copyright rules","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-researcher-claims-amazon-ignored-copyright-rules"},{"id":"INC-04353","date":"2024","year":2024,"title":"WildBrain accuses Kartoon Studios of IP infringement over Gadget A.I.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Kartoon Studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wildbrain-accuses-kartoon-studios-of-ip-infringement-over-gadget-a-i"},{"id":"INC-04149","date":"2024","year":2024,"title":"Reddit warns AI companies not to misuse its data","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; StabilityAI; Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/reddit-warns-ai-companies-not-to-misuse-its-data"},{"id":"INC-03493","date":"2024","year":2024,"title":"AI-generated drama performance cancelled over plagiarism accusations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-drama-performance-cancelled-over-plagiarism-accusations"},{"id":"INC-03604","date":"2024","year":2024,"title":"BBC presenter’s AI-generated voice used to trick company","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bbc-presenters-ai-generated-voice-used-to-trick-company"},{"id":"INC-03790","date":"2024","year":2024,"title":"Ford Mustang Mach-E crashes into Honda in Texas, kills occupant","severity":"Critical","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ford","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ford-mustang-mach-e-crashes-into-honda-in-texas-kills-occupant"},{"id":"INC-03791","date":"2024","year":2024,"title":"Ford Mustang Mach-E fatally crashes into two parked cars","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ford","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ford-mustang-mach-e-fatally-crashes-into-two-parked-cars"},{"id":"INC-03875","date":"2024","year":2024,"title":"Huawei P70 Ultra AI editing tool removes people's clothing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Huawei","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/huawei-p70-ultra-ai-editing-tool-removes-peoples-clothing"},{"id":"INC-04497","date":"2023","year":2023,"title":"Bing falsely accuses aerospace professor of being a terrorist","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bing-falsely-accuses-aerospace-professor-of-being-a-terrorist"},{"id":"INC-03853","date":"2024","year":2024,"title":"Grok AI wrongly accuses Klay Thompson of 'brick-vandalism spree'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-accuses-klay-thompson-of-brick-vandalism-spree"},{"id":"INC-03780","date":"2024","year":2024,"title":"Father Justin AI priest defrocked after inappropriate responses","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Catholic Answers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/father-justin-ai-priest-defrocked-after-inappropriate-responses"},{"id":"INC-03602","date":"2024","year":2024,"title":"Baltimore high school athletic director uses AI to smear principal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Dazhon Darien","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/baltimore-high-school-athletic-director-uses-ai-to-smear-principal"},{"id":"INC-03742","date":"2024","year":2024,"title":"Drake threatened with lawsuit over AI-generated Tupac Shakur voice","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Drake","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/drake-threatened-with-lawsuit-over-ai-generated-tupac-shakur-voice"},{"id":"INC-04868","date":"2023","year":2023,"title":"Snapchat AI chatbot provides bad advice about underage drinking","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-ai-chatbot-provides-bad-advice-about-underage-drinking"},{"id":"INC-04262","date":"2024","year":2024,"title":"Tesla driver using Autopilot kills motorcyclist","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-driver-using-autopilot-kills-motorcyclist-intrusive-ai-speed-camera"},{"id":"INC-03988","date":"2024","year":2024,"title":"Michel Janse deepfake used for advert without consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michel-janse-deepfake-used-for-advert-without-consent"},{"id":"INC-04352","date":"2024","year":2024,"title":"WHO chatbot provides inaccurate health information","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Soul Machines","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/who-chatbot-provides-inaccurate-health-information"},{"id":"INC-04072","date":"2024","year":2024,"title":"OpenAI's GPT store faces copyright complaints","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openais-gpt-store-faces-copyright-complaints"},{"id":"INC-03968","date":"2024","year":2024,"title":"Maori woman misidentified by Foodstuffs facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Foodstuffs","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/maori-woman-misidentified-by-foodstuffs-facial-recognition"},{"id":"INC-07319","date":"2018","year":2018,"title":"MEP files lawsuit to release iBorderCtrl lie detection system documents","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"European Dynamics; Manchester Metropolitan University","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mep-files-lawsuit-to-release-iborderctrl-lie-detection-system-documents"},{"id":"INC-03443","date":"2024","year":2024,"title":"Adobe trained Firefly AI model on competitor images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adobe-trained-firefly-ai-model-on-competitor-images"},{"id":"INC-03633","date":"2024","year":2024,"title":"Chatbots misinform citizens about European Parliament elections","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google; Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatbots-misinform-citizens-about-european-parliament-elections"},{"id":"INC-04425","date":"2023","year":2023,"title":"Alberta Party endorses itself using deepfake video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Synthesia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/alberta-party-endorses-itself-using-deepfake-video"},{"id":"INC-05363","date":"2022","year":2022,"title":"YouTube inserts explicit captions into kids' videos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-inserts-explicit-captions-into-kids-videos"},{"id":"INC-04164","date":"2024","year":2024,"title":"Robot crushes Thai factory worker to death","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Vandapac","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-crushes-thai-factory-worker-to-death"},{"id":"INC-05720","date":"2021","year":2021,"title":"Israel attacks Hamas using AI drone swarm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Elbit Systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/israel-attacks-hamas-using-ai-drone-swarm"},{"id":"INC-04293","date":"2024","year":2024,"title":"Three news publishers sue OpenAI for copyright infringement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/three-news-publishers-sue-openai-for-copyright-infringement"},{"id":"INC-04069","date":"2024","year":2024,"title":"OpenAI scrapes YouTube to train GPT-4","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-scraped-youtube-to-train-gpt-4"},{"id":"INC-03820","date":"2024","year":2024,"title":"Google Books indexes low quality, AI-generated books","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-books-indexes-low-quality-ai-generated-books"},{"id":"INC-03859","date":"2024","year":2024,"title":"Grok generates fake Iran missile attack headline","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/grok-generates-fake-iran-missile-attack-headline"},{"id":"INC-03959","date":"2024","year":2024,"title":"L’Observatoire de l’Europe uses AI to plagiarise Euronews content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"L’Observatoire de l’Europe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lobservatoire-de-leurope-uses-ai-to-plagiarise-euronews-content"},{"id":"INC-04565","date":"2023","year":2023,"title":"Chinese AI campaign accuses US government of Kentucky train derailment cover-up","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of China; Spamouflage; Storm 1376","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-ai-campaign-accuses-us-government-of-train-derailment-cover-up"},{"id":"INC-04328","date":"2024","year":2024,"title":"Up to 17 percent of AI conference reviews written by AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/up-to-17-percent-of-ai-conference-reviews-written-by-ai"},{"id":"INC-03981","date":"2024","year":2024,"title":"Meta AI image generator struggles to produce interracial couples","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meta-ai-image-generator-struggles-to-produce-interracial-couples"},{"id":"INC-03554","date":"2024","year":2024,"title":"Amazon Studios lawsuit alleges use of GenAI to clone actors voices","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon Studios","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-studios-accused-of-using-ai-voice-cloning-during-actors-strikes"},{"id":"INC-04568","date":"2023","year":2023,"title":"Chinese voice actor sues AI companies for using her voice without consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-voice-actor-sues-ai-companies-for-using-her-voice-without-consent"},{"id":"INC-03457","date":"2024","year":2024,"title":"AI company found guilty of violating Ultraman copyright in China","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-company-found-guilty-of-violating-ultraman-copyright-in-china"},{"id":"INC-04049","date":"2024","year":2024,"title":"Nvidia sued for training NeMo on authors' copyrighted works","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Nvidia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nvidia-sued-for-training-nemo-on-authors-copyrighted-works"},{"id":"INC-04424","date":"2023","year":2023,"title":"Al video depicts Indonesian presidential hopeful speaking fluent Arabic","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"HeyGen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/al-video-depicts-indonesian-presidential-hopeful-speaking-arabic"},{"id":"INC-03609","date":"2024","year":2024,"title":"Biden 'robocall' advises voters skip New Hampshire primary election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"ElevenLabs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/biden-robocall-advises-voters-skip-new-hampshire-primary-election"},{"id":"INC-04595","date":"2023","year":2023,"title":"Deepfake audio depicts London Mayor dismissing Remembrance Sunday","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"HJB News","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-audio-depicts-london-mayor-dismissing-remembrance-sunday"},{"id":"INC-04064","date":"2024","year":2024,"title":"OpenAI bans bot impersonating US presidential candidate","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Delphi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-bans-bot-impersonating-us-presidential-candidate"},{"id":"INC-04053","date":"2024","year":2024,"title":"NYC AI chatbot tells businesses to break law","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nyc-ai-chatbot-tells-businesses-to-break-law"},{"id":"INC-03648","date":"2024","year":2024,"title":"ChatGPT linked to student memory loss, procastination","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-linked-to-student-memory-loss-procastination"},{"id":"INC-03603","date":"2024","year":2024,"title":"BBC castigated for using generative AI to promote Dr Who","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"BBC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bbc-castigated-for-using-generative-ai-to-promote-dr-who"},{"id":"INC-03947","date":"2024","year":2024,"title":"Leonardo AI generates celebrity non-consensual porn images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Leonardo AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/leonardo-ai-generates-celebrity-non-consensual-porn-images"},{"id":"INC-03825","date":"2024","year":2024,"title":"Google SGE recommends malware, fraud sites","severity":"Medium","attack_vector":"malware","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-sge-recommends-malware-fraud-sites"},{"id":"INC-04172","date":"2024","year":2024,"title":"Russian state TV deepfake blames Ukraine for Crocus City Hall attack","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NTV","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/russian-state-tv-deepfake-blames-ukraine-for-crocus-city-hall-attack"},{"id":"INC-04322","date":"2024","year":2024,"title":"University of Michigan partner sells student data for AI training","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"University of Michigan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/university-of-michigan-partner-sells-student-data-for-ai-training"},{"id":"INC-03821","date":"2024","year":2024,"title":"Google fined for training Gemini on news content without consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-fined-for-training-gemini-on-news-content-without-consent"},{"id":"INC-03946","date":"2024","year":2024,"title":"LEGO uses non-licensed IP in AI-generated toy promotion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"LEGO","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lego-uses-non-licensed-ip-in-ai-generated-toy-promotion"},{"id":"INC-05143","date":"2022","year":2022,"title":"Italian PM seeks damages over deepfake porn videos","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/italian-pm-seeks-damages-over-deepfake-porn-videos"},{"id":"INC-04647","date":"2023","year":2023,"title":"FTC investigates Evolv for misleading marketing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Evolv Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ftc-investigates-evolv-for-misleading-marketing"},{"id":"INC-04340","date":"2024","year":2024,"title":"Voiceify (Jammable) sued for training AI with copyrighted material","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Jammable","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/voiceify-sued-for-training-ai-with-copyrighted-material"},{"id":"INC-04192","date":"2024","year":2024,"title":"Scientific journals publish papers with AI-generated introductions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scientific-journals-publish-papers-with-ai-generated-introductions"},{"id":"INC-03913","date":"2024","year":2024,"title":"Iranian hackers interrupt TV streaming services with deepfake Gaza news","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Islamic Revolutionary Guards/Cotton Sandstorm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/iranian-hackers-interrupt-tv-streaming-services-with-deepfake-gaza-news"},{"id":"INC-04907","date":"2023","year":2023,"title":"Study: Uber, Amazon use AI to pay people different wages for the same work","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon; Lyft; Uber","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-amazon-use-ai-to-pay-people-different-wages-for-the-same-work"},{"id":"INC-04723","date":"2023","year":2023,"title":"Legal challenge launched against 'discriminatory' sham marriage algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Home Office DACC","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/legal-challenge-launched-against-discriminatory-sham-marriage-algorithm"},{"id":"INC-06142","date":"2021","year":2021,"title":"UK robo review 'unfairly' targets Bulgarians, Poles for benefit fraud investigation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Department of Work and Pensions (DWP)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robo-review-unfairly-targets-bulgarians-for-benefit-fraud-investigation"},{"id":"INC-04301","date":"2024","year":2024,"title":"Trento council fined for AI citizen surveillance projects","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Foundation for Research and Technology Hellas (FORTH); Saher Europe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/trento-council-fined-for-ai-citizen-surveillance-projects"},{"id":"INC-04500","date":"2023","year":2023,"title":"Black man sues UNOS over kidney transplant algorithm racial bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"United Network for Organ Sharing (UNOS)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/black-man-sues-unos-over-kidney-transplant-algorithm-racial-bias"},{"id":"INC-03454","date":"2024","year":2024,"title":"AI chatbots found to be covertly racist despite anti-racism training","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-chatbots-found-to-be-racist-despite-anti-racism-training"},{"id":"INC-03642","date":"2024","year":2024,"title":"ChatGPT found to display racial bias against job candidates","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-found-to-display-racial-bias-against-job-candidates"},{"id":"INC-04741","date":"2023","year":2023,"title":"Miami boys arrested for creating and sharing nude images of students","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Pinecrest Cove Academy students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/beverly-hills-students-created-shared-ai-nude-images-of-fellow-students"},{"id":"INC-03963","date":"2024","year":2024,"title":"Male Saudi robot touches female reporter","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"QSS Systems","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/male-saudi-robot-touches-female-reporter"},{"id":"INC-03670","date":"2024","year":2024,"title":"Cloned Ukrainian YouTuber promotes Russia-China relations","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"HeyGen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ukrainian-youtuber-cloned-to-promote-russia-china-relations"},{"id":"INC-03753","date":"2024","year":2024,"title":"Engineer warns Microsoft Copilot Designer creates violent, sexual images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/engineer-warns-microsoft-copilot-designer-creates-violent-sexual-images"},{"id":"INC-04298","date":"2024","year":2024,"title":"Top AI image generators produce misleading election info","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft; Midjourney; OpenAI; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/top-ai-image-generators-produce-misleading-election-info"},{"id":"INC-04511","date":"2023","year":2023,"title":"Canadian lawyer under fire for ChatGPT-generated fake cases","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/canadian-lawyer-under-fire-for-chatgpt-generated-fake-cases"},{"id":"INC-04306","date":"2024","year":2024,"title":"TurboTax, H&R Block chatbots provide inaccurate tax advice","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Intuit; TurboTax","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/turbotax-hr-block-chatbots-provide-inaccurate-tax-advice"},{"id":"INC-04753","date":"2023","year":2023,"title":"Microsoft, OpenAI data centre drains Goodyear water supply","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-openai-ais-drain-goodyear-water-supply"},{"id":"INC-03998","date":"2024","year":2024,"title":"Microsoft Copilot generates fake Putin comments on Navalny death","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-copilot-generates-fake-putin-comments-on-navalny-death"},{"id":"INC-04303","date":"2024","year":2024,"title":"Trump supporters target black voters with fake AI images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Mark Kaye","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/trump-supporters-target-black-voters-with-fake-ai-images"},{"id":"INC-03467","date":"2024","year":2024,"title":"AI models found to generate inaccurate and untrue election info","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google, Anthropic, Meta, Mistral; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-models-found-to-generate-inaccurate-and-untrue-election-info"},{"id":"INC-05373","date":"2021","year":2021,"title":"Adam Toledo killed by Chicago police using ShotSpotter","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"SoundThinking","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adam-toledo-killed-by-chicago-police-using-shotspotter"},{"id":"INC-03634","date":"2024","year":2024,"title":"ChatGPT 'goes crazy', speaks gibberish","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-goes-crazy-speaks-gibberish"},{"id":"INC-03831","date":"2024","year":2024,"title":"GPT-4 able to hack websites without human help","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-4-able-to-hack-websites-without-human-help"},{"id":"INC-07427","date":"2017","year":2017,"title":"lllinois ends 'unreliable' child abuse predictive system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Eckerd Connects; Mindshare Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lllinois-ends-unreliable-child-abuse-predictive-system"},{"id":"INC-03800","date":"2024","year":2024,"title":"Gemini characterises Indian PM policies as 'fascist'","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gemini-characterises-indian-pms-policies-as-fascist"},{"id":"INC-03496","date":"2024","year":2024,"title":"AI-generated fake ID passes crypto exchange verification","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OnlyFake","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-fake-id-passes-crypto-exchange-verification"},{"id":"INC-07228","date":"2019","year":2019,"title":"Snapchat algorithm recommends teen connects with sex offenders","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Snap Inc.","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-algorithm-recommends-teen-connects-with-sex-offenders"},{"id":"INC-07428","date":"2017","year":2017,"title":"Lyft background check fails to flag man convicted of aiding terrorism","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Sterling Talent Solutions","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lyft-background-check-fails-to-flag-man-convicted-of-aiding-terrorism"},{"id":"INC-03796","date":"2024","year":2024,"title":"Gab.AI chatbots seen to radicalise, incite violence","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Gab","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gab-ai-chatbots-deny-holocaust"},{"id":"INC-03823","date":"2024","year":2024,"title":"Google Gemini generates 'woke' racial images","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-gemini-generates-woke-diverse-racial-images"},{"id":"INC-04966","date":"2023","year":2023,"title":"Two Waymo robotaxis crash into pick-up truck","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/two-waymo-robotaxis-crash-into-pick-up-truck"},{"id":"INC-04084","date":"2024","year":2024,"title":"Peer-reviewed journal publishes AI-generated rat penis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/peer-reviewed-journal-publishes-ai-generated-rat-penis"},{"id":"INC-04772","date":"2023","year":2023,"title":"Nation state hackers use ChatGPT to improve cyberattacks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nation-state-hackers-use-chatgpt-to-improve-cyberattacks"},{"id":"INC-04848","date":"2023","year":2023,"title":"Robot crushes to death man mistaken for box of vegetables","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Donggoseong Export Agricultural Complex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-crushes-to-death-man-mistaken-for-box-of-vegetables"},{"id":"INC-05095","date":"2022","year":2022,"title":"Drunk driver using Tesla FSD killed after car hits tree","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/drunk-driver-using-tesla-fsd-killed-after-car-hits-tree"},{"id":"INC-07574","date":"2015","year":2015,"title":"Researchers reveal Hello Barbie security vulnerabilities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Mattel/ToyTalk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/researchers-reveal-hello-barbie-security-vulnerabilities"},{"id":"INC-07041","date":"2020","year":2020,"title":"UIUC dumps Proctorio over 'significant accessibility concerns'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Proctorio","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uiuc-dumps-proctorio-over-significant-accessibility-concerns"},{"id":"INC-04682","date":"2023","year":2023,"title":"IBM sells Greg Marston voice for commercial cloning","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Revoicer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ibm-sells-greg-marston-voice-for-commercial-cloning"},{"id":"INC-04348","date":"2024","year":2024,"title":"Waymo robotaxi injures cyclist in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-robotaxi-injures-cyclist-in-san-francisco"},{"id":"INC-03553","date":"2024","year":2024,"title":"Amazon sells AI-generated books about King Charles' cancer","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-sells-ai-generated-books-about-king-charles-cancer"},{"id":"INC-04034","date":"2024","year":2024,"title":"New York lawyer cites fake AI-generated court decision","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/new-york-lawyer-cites-fake-ai-generated-court-decision"},{"id":"INC-07330","date":"2018","year":2018,"title":"SEC charges American Bitcoin Academy with 'AI' powered fraud","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Brian Sewell","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/american-bitcoin-academy-charged-with-ai-powered-fraud"},{"id":"INC-05125","date":"2022","year":2022,"title":"Google researcher fired for believing LaMDA is 'sentient'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-researcher-believes-lamda-is-sentient"},{"id":"INC-04089","date":"2024","year":2024,"title":"Philadelphia sheriff posts fake AI-generated news stories","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/philadelphia-sheriff-posts-fake-ai-generated-news-stories"},{"id":"INC-05351","date":"2022","year":2022,"title":"US man dies driving off collapsed bridge while following Google Maps","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-man-dies-driving-off-collapsed-bridge-while-following-google-maps"},{"id":"INC-04580","date":"2023","year":2023,"title":"Couple assaulted in 'Hell Run' recommended by Google Maps","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/couple-attacked-in-hell-run-area-recommended-by-google-maps"},{"id":"INC-04342","date":"2024","year":2024,"title":"Wacom AI-generated Chinese New Year promotion backfires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Wacom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wacom-ai-generated-chinese-new-year-promotion-backfires"},{"id":"INC-03907","date":"2024","year":2024,"title":"Instacart AI-generated recipes, food images panned as \"absurd\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Instacart","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instacart-generates-recipes-and-food-images-using-ai"},{"id":"INC-04864","date":"2023","year":2023,"title":"Short-seller bots sow First Republic Bank doubts","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"First Republic Bank","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/short-seller-bots-sow-first-republic-bank-doubts"},{"id":"INC-04041","date":"2024","year":2024,"title":"Nine News uses AI to 'sexualise' image of politician","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nine-news-uses-ai-to-sexualise-image-of-politician"},{"id":"INC-04080","date":"2024","year":2024,"title":"Parivar Pehchan Patra algorithm declares living people dead","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Haryana","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/parivar-pehchan-patra-declares-living-people-dead"},{"id":"INC-07522","date":"2016","year":2016,"title":"Samagra Vedika system pilot deprives citizens of rations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Telagana; Posidex Technologies","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/samagra-vedika-system-pilot-deprives-citizens-of-rations"},{"id":"INC-05130","date":"2022","year":2022,"title":"Harvey Murphy Jr facial recognition wrongful arrest","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"EssilorLuxottica; Macy's","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/harvey-murphy-jr-facial-recognition-wrongful-arrest"},{"id":"INC-04078","date":"2024","year":2024,"title":"Palworld accused of plagiarising Pokemon designs using AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Palworld","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/palworld-accused-of-plagiarising-pokemon-designs-using-ai"},{"id":"INC-03741","date":"2024","year":2024,"title":"DPD chatbot criticises own employer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"DPD","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dpd-chatbot-criticises-own-employer"},{"id":"INC-03501","date":"2024","year":2024,"title":"AI-generated product listings flood Amazon","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-product-listings-flood-amazon"},{"id":"INC-04641","date":"2023","year":2023,"title":"Film fan uses PimEyes to identify anonymous porn stars","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"PimEyes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pimeyes-used-to-identify-anonymous-porn-stars"},{"id":"INC-05173","date":"2022","year":2022,"title":"PimEyes includes 'sexually explicit' kids photos in search results","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"PimEyes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pimeyes-includes-sexually-explicit-kids-photos-in-search-results"},{"id":"INC-05348","date":"2022","year":2022,"title":"UK pressure group accuses PimEyes of surveillance, privacy abuse","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"PimEyes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-pressure-group-accuses-pimeyes-of-surveillance-privacy-abuse"},{"id":"INC-03961","date":"2024","year":2024,"title":"Mahindra AI influencer pulled after jobs complaints","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Mahindra Racing","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mahindra-ai-influencer-pulled-after-jobs-complaints"},{"id":"INC-03464","date":"2024","year":2024,"title":"AI hiring chatbot hack violates applicants' privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Chattr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-hiring-chatbot-hack-violates-applicants-privacy"},{"id":"INC-05804","date":"2021","year":2021,"title":"Population One stranger sexually abuses Chanelle Siggins","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Meta Platforms; Big Box VR","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/population-one-stranger-sexually-abuses-chanelle-siggins"},{"id":"INC-04910","date":"2023","year":2023,"title":"Teen distributes AI-generated nude pictures of Issaquah students","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Issaquah High School students","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-nude-pictures-of-issaquah-students-circulate"},{"id":"INC-04385","date":"2023","year":2023,"title":"AI art used to illustrate ‘Dungeons & Dragons’ book draws backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Ilya Shkipin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-art-used-in-dungeons-dragons-book"},{"id":"INC-03463","date":"2024","year":2024,"title":"AI generates visuals for Wizards of the Coast marketing promotion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Hasbro/Wizards of the Coast","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generates-visuals-for-wizards-of-the-coast-marketing-promotion"},{"id":"INC-04746","date":"2023","year":2023,"title":"Microsoft AI Image Creator generates violent political images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08","ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-ai-image-creator-generates-violent-political-images"},{"id":"INC-05087","date":"2022","year":2022,"title":"Deepfake Bruce Willis promotes Russian telecoms company","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepcake","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-bruce-willis-promotes-russian-telecoms-company"},{"id":"INC-04610","date":"2023","year":2023,"title":"Deepfake Tom Hanks dental ad insurance promotion","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-tom-hanks-dental-ad-promotion"},{"id":"INC-05182","date":"2022","year":2022,"title":"Researcher 'raped' in Horizon Worlds metaverse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/researcher-raped-in-horizon-worlds-metaverse"},{"id":"INC-04702","date":"2023","year":2023,"title":"Investing.com discovered to be plagiarising other websites using AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Joffre Capital/Investing.com","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/investing-com-plagiarises-other-websites-using-ai"},{"id":"INC-04389","date":"2023","year":2023,"title":"AI invents NewsBreak Christmas Day murder","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Particle Media/NewsBreak","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-invents-newsbreak-christmas-day-murder"},{"id":"INC-03645","date":"2024","year":2024,"title":"ChatGPT incorrectly diagnoses most pediatric cases","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-incorrectly-diagnoses-most-pediatric-cases"},{"id":"INC-04660","date":"2023-02","year":2023,"title":"Google Bard makes factual error about James Webb Space Telescope","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-bard-makes-factual-error-about-james-webb-space-telescope"},{"id":"INC-04744","date":"2023","year":2023,"title":"Michael Cohen supplies fake AI legal citations to lawyer","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michael-cohen-supplies-fake-ai-legal-citations-to-lawyer"},{"id":"INC-04968","date":"2023","year":2023,"title":"Ubisoft Ghostwriter tool criticised for potentially replacing scriptwriting jobs","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ubisoft La Forge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ubisoft-ghostwriter-seen-to-replace-scriptwriting-jobs"},{"id":"INC-05004","date":"2023","year":2023,"title":"Young girl 'gang raped' by group of metaverse strangers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/young-girl-sexually-attacked-by-group-of-metaverse-strangers"},{"id":"INC-04756","date":"2023","year":2023,"title":"Midjourney v6 reproduces copyright-protected film images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/midjourney-reproduces-copyright-protected-film-images"},{"id":"INC-04782","date":"2023","year":2023,"title":"NYC Dept of Education bans ChatGPT over student learning concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nyc-dept-of-education-bans-chatgpt-due-to-student-learning-concerns"},{"id":"INC-04867","date":"2023","year":2023,"title":"Singapore PM Lee Hsien Loong crypto promotion deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"ChatGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/singapore-pm-lee-hsien-loong-crypto-promotion-deepfake"},{"id":"INC-04784","date":"2023","year":2023,"title":"Omegaverse fan fiction used to train OpenAI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/omegaverse-fan-fiction-used-to-train-openai-models"},{"id":"INC-04539","date":"2023","year":2023,"title":"ChatGPT makes up research claiming guns are not harmful to kids","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-makes-up-research-claiming-guns-are-not-harmful-to-kids"},{"id":"INC-05735","date":"2021","year":2021,"title":"Kenyan workers paid under USD 2 an hour to de-toxify ChatGPT","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kenyan-workers-paid-under-usd-2-an-hour-to-de-toxify-chatgpt"},{"id":"INC-04461","date":"2023","year":2023,"title":"Asylum claim rejected by French authorities using Google Bard","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/asylum-claim-rejected-by-french-authorities-using-google-bard"},{"id":"INC-04947","date":"2023","year":2023,"title":"The New York Times sues OpenAI, Microsoft over copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/the-new-york-times-sues-openai-microsoft-over-copyright-abuse"},{"id":"INC-04541","date":"2023","year":2023,"title":"ChatGPT provides inaccurate medication query responses","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-provides-inaccurate-medication-query-responses"},{"id":"INC-04524","date":"2023","year":2023,"title":"ChatGPT fails at recommending appropriate cancer treatment","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-fails-at-recommending-cancer-treatment"},{"id":"INC-04532","date":"2023","year":2023,"title":"ChatGPT invents cancer screening advice responses","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-cancer-screening-advice-responses"},{"id":"INC-04533","date":"2023","year":2023,"title":"ChatGPT invents Guardian newspaper articles, bylines","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-guardian-articles-bylines"},{"id":"INC-04621","date":"2023","year":2023,"title":"DevTernity conference fakes women speakers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Eduards Sizovs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/devternity-conference-fakes-women-speakers"},{"id":"INC-04786","date":"2023","year":2023,"title":"OpenAI accused of 'unprecedented web scraping' to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/openai-unprecedented-web-scraping-trains-ai-models"},{"id":"INC-04854","date":"2023","year":2023,"title":"Sarah Silverman sues OpenAI for violating copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sarah-silverman-sues-openai-for-violating-copyright"},{"id":"INC-04743","date":"2023","year":2023,"title":"Michael Chabon sues OpenAI for violating copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michael-chabon-sues-openai-for-violating-copyright"},{"id":"INC-04998","date":"2023","year":2023,"title":"Whistleblower reveals Tesla phantom braking complaints","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/whistleblower-reveals-tesla-phantom-braking-complaints"},{"id":"INC-04843","date":"2023","year":2023,"title":"Rite Aid facial recognition accuses innocent shoppers of theft","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"FaceFirst; DeepCam","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rite-aid-accuses-innocent-shoppers-of-theft"},{"id":"INC-04701","date":"2023","year":2023,"title":"Investigation: nH Predict used to deny Medicare Advantage benefits","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"UnitedHealth Group; Cardinal Health; SeniorMetrix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/navihealth-nh-predict-used-to-deny-medicare-advantage-benefits"},{"id":"INC-04681","date":"2023","year":2023,"title":"Humana sued for using AI to deny health insurance","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"UnitedHealth Group; Cardinal Health; SeniorMetrix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/humana-accused-of-using-ai-to-deny-health-insurance"},{"id":"INC-04485","date":"2023","year":2023,"title":"Beijing AI influence campaign weaponises Gaza conflict","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of China","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/beijing-ai-influence-campaign-weaponises-gaza-conflict"},{"id":"INC-04495","date":"2023","year":2023,"title":"Bing Chat threatens German student Marvin von Hagen","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bing-chat-threatens-german-student-marvin-von-hagen"},{"id":"INC-04492","date":"2023","year":2023,"title":"Bing Chat falsely claims to have evidence tying journalist to murder","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bing-chat-falsely-claims-to-have-evidence-tying-journalist-to-murder"},{"id":"INC-04752","date":"2023","year":2023,"title":"Microsoft Copilot spouts wrong answers about US election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-copilot-spouts-wrong-answers-about-us-election"},{"id":"INC-04751","date":"2023","year":2023,"title":"Microsoft Copilot provides wrong Germany, Swiss election information","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-bing-provides-wrong-election-information"},{"id":"INC-05153","date":"2022","year":2022,"title":"Lensa AI generates nudes from childhood photos","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Prisma Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lensa-ai-generates-nudes-from-childhood-photos"},{"id":"INC-05166","date":"2022","year":2022,"title":"Nate uses humans to process 'AI' transactions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Nate","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nate-uses-humans-to-process-ai-transactions"},{"id":"INC-04442","date":"2023","year":2023,"title":"Amazon Q hallucinates, leaks data","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-q-hallucinates-leaks-data"},{"id":"INC-05155","date":"2022","year":2022,"title":"Lensa AI undresses journalists without permission","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Prisma Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lensa-ai-undresses-journalists-without-permission"},{"id":"INC-04687","date":"2023","year":2023,"title":"Image-generation AIs memorise training images","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google; OpenAI; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/image-generation-ais-memorise-training-images"},{"id":"INC-04809","date":"2023","year":2023,"title":"Presto uses humans to support 70 percent of chatbot interactions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Presto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/presto-uses-humans-to-support-most-chatbot-interactions"},{"id":"INC-04375","date":"2023","year":2023,"title":"17 authors sue OpenAI for 'systematic mass-scale copyright infringement'","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/17-authors-sue-openai-for-systematic-mass-scale-copyright-infringement"},{"id":"INC-04841","date":"2023","year":2023,"title":"Researchers show ChatGPT can be used to create cyber-crime tools","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-can-be-used-to-create-cybercrime-tools"},{"id":"INC-04704","date":"2023","year":2023,"title":"Israeli AI automated 'target factory' slaughters innocent Palestinian women, children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Israel Defense Forces","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/israel-uses-habsora-24-hour-automated-target-factory-against-palestinians"},{"id":"INC-05069","date":"2022","year":2022,"title":"ChatGPT training emits 502 metric tons of carbon","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-training-emits-502-metric-tons-of-carbon"},{"id":"INC-04897","date":"2023","year":2023,"title":"Study: Generating an AI image consumes as much energy as charging a smartphone","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/generating-an-image-consumes-as-much-energy-as-charging-a-smartphone"},{"id":"INC-04697","date":"2023","year":2023,"title":"Instagram Reels discovered to recommend child-sexualising videos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-recommends-child-sexualising-videos-to-parents"},{"id":"INC-04545","date":"2023","year":2023,"title":"ChatGPT reproduces recommendation letter gender bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; Stanford University","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-reproduces-recommendation-letter-gender-bias"},{"id":"INC-04470","date":"2023","year":2023,"title":"Authors Mona Awad, Paul Tremblay sue OpenAI for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/authors-mona-awad-paul-tremblay-sue-openai-for-copyright-abuse"},{"id":"INC-04777","date":"2023","year":2023,"title":"News publishers complain OpenAI uses articles to train ChatGPT","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/publishers-complain-openai-uses-articles-to-train-chatgpt"},{"id":"INC-04488","date":"2023","year":2023,"title":"Benzinga publishes fake AI-generated rapper interview","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"David Daxsen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/benzinga-publishes-fake-ai-generated-rapper-interview"},{"id":"INC-04553","date":"2023","year":2023,"title":"ChatGPT's ability to generate accurate computer code plummets","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpts-ability-to-generate-accurate-computer-code-plummets"},{"id":"INC-04504","date":"2023","year":2023,"title":"Brazilian judge publishes 'error-strewn' AI-generated decision","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/brazilian-judge-publishes-error-riddled-ai-generated-decision"},{"id":"INC-04477","date":"2023","year":2023,"title":"Autonomous AI bot lies about insider trading","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apollo Research","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/autonomous-ai-bot-lies-about-insider-trading"},{"id":"INC-04604","date":"2023","year":2023,"title":"Deepfake nudes target Winnipeg school female students","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-nudes-target-winnipeg-school-female-students"},{"id":"INC-04709","date":"2023","year":2023,"title":"Julian Sancton sues OpenAI, Microsoft for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/julian-sancton-sues-openai-microsoft-for-copyright-abuse"},{"id":"INC-04700","date":"2023","year":2023,"title":"Investigation: AI-powered pro-China influence campaign thrives on YouTube","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Synthesia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/investigation-ai-powered-pro-china-influence-campaign-thrives-on-youtube"},{"id":"INC-04903","date":"2023","year":2023,"title":"Study: Large language models perpetuate healthcare racial bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google; Anthropic; OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/large-language-models-perpetuate-healthcare-racial-bias"},{"id":"INC-04893","date":"2023","year":2023,"title":"Study: ChatGPT generates plausible phishing emails, malware","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-generates-plausible-phishing-emails-malware"},{"id":"INC-04688","date":"2023","year":2023,"title":"Immunefi bans 'inaccurate' ChatGPT-generated bug bounty reports","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/immunefi-bans-inaccurate-chatgpt-generated-bug-bounty-reports"},{"id":"INC-04981","date":"2023","year":2023,"title":"US FTC investigates ChatGPT for possible consumer harms","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-ftc-investigates-chatgpt-for-possible-consumer-harms"},{"id":"INC-04852","date":"2023","year":2023,"title":"Samsung employees leak sensitive data to ChatGPT","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/samsung-employees-leak-sensitive-data-to-chatgpt"},{"id":"INC-04552","date":"2023","year":2023,"title":"ChatGPT wrongly claims Alexander Hanff is dead","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-wrongly-claims-alexander-hanff-is-dead"},{"id":"INC-04905","date":"2023","year":2023,"title":"Study: Text-to-image AI models generate violent, nude images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"idjourney; OpenAI; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/text-to-image-ai-models-tricked-into-generating-violent-nude-images"},{"id":"INC-04468","date":"2023","year":2023,"title":"Australian researchers use ChatGPT to assess grant applications","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australian-researchers-use-chatgpt-to-assess-grant-applications"},{"id":"INC-04423","date":"2023","year":2023,"title":"AIs guess where Reddit users live and what they earn","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google; Anthropic; Meta Platforms; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ais-guess-where-reddit-users-live"},{"id":"INC-04665","date":"2023","year":2023,"title":"Google sued for AI data scraping","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-sued-for-ai-data-scraping"},{"id":"INC-04516","date":"2023","year":2023,"title":"Chatbot guardrails bypassed using lengthy character suffixes","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Anthropic; Google; OpenAI; Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatbot-guardrails-bypassed-using-lengthy-character-suffixes"},{"id":"INC-04498","date":"2023","year":2023,"title":"Bing Image Creator violates Disney copyright","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bing-image-creator-violates-disney-copyright"},{"id":"INC-04650","date":"2023","year":2023,"title":"Gannett pauses 'abysmal' AI-generated high school sports recaps","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Lede AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gannett-pauses-abysmal-ai-generated-high-school-sports-recaps"},{"id":"INC-04805","date":"2023","year":2023,"title":"Poland investigates ChatGPT for alleged privacy abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/poland-investigates-chatgpt-alleged-privacy-abuse"},{"id":"INC-04398","date":"2023","year":2023,"title":"AI website claims Benjamin Netanyahu’s psychiatrist committed suicide","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Global Village Space","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-website-claims-benjamin-netanyahus-psychiatrist-committed-suicide"},{"id":"INC-04900","date":"2023","year":2023,"title":"Study: GPT-4 echoes false news narratives 100 percent of the time","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-4-echoes-false-news-narratives-100-percent-of-the-time"},{"id":"INC-04802","date":"2023","year":2023,"title":"Perth doctors warned for using ChatGPT to write patient medical records","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/perth-doctors-warned-for-using-chatgpt-to-write-patient-medical-records"},{"id":"INC-04895","date":"2023","year":2023,"title":"Study: ChatGPT mostly gets programming questions wrong","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-mostly-gets-programming-questions-wrong"},{"id":"INC-04892","date":"2023","year":2023,"title":"Study: ChatGPT exhibits 'systemic' left-wing bias","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-exhibits-systemic-left-wing-bias"},{"id":"INC-04823","date":"2023","year":2023,"title":"Quebec man jailed for producing AI child porn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Steven Larouche","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/quebec-man-jailed-for-producing-ai-child-porn"},{"id":"INC-04957","date":"2023","year":2023,"title":"TikTok risks pushing kids towards harmful mental health content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tiktok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-risks-pushing-kids-towards-harmful-mental-health-content"},{"id":"INC-06157","date":"2021","year":2021,"title":"US child psychiatrist jailed for making deepfake child porn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"David Tatum","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-child-psychiatrist-jailed-for-making-ai-deepfake-child-porn"},{"id":"INC-04579","date":"2023","year":2023,"title":"Corruption doc incorporating Tom Cruise deepfake attacks IOC","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Russia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/corruption-doc-incorporating-tom-cruise-deepfake-attacks-ioc"},{"id":"INC-04833","date":"2023","year":2023,"title":"Replika AI companions sexually harass their users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Luka Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/replika-ai-companions-sexually-harass-their-users"},{"id":"INC-04834","date":"2023","year":2023,"title":"Replika AI girlfriends abused by their users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Luka Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/replika-ai-girlfriends-abused-by-their-users"},{"id":"INC-04837","date":"2023","year":2023,"title":"Replika shares user data with advertisers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Luka Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/report-replika-fails-to-meet-minimum-privacy-standards"},{"id":"INC-04590","date":"2023","year":2023,"title":"Cruise self-driving cars struggle to recognise children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-self-driving-cars-struggle-to-recognise-children"},{"id":"INC-04904","date":"2023","year":2023,"title":"Study: Personalising ChatGPT makes it more offensive","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-finds-personalising-chatgpt-makes-it-more-offensive"},{"id":"INC-04446","date":"2023","year":2023,"title":"Amazon uses AI to generate ‘Fallout’ series promo art","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-uses-ai-to-generate-fallout-promo-art"},{"id":"INC-04513","date":"2023","year":2023,"title":"Carmel school students attack Principal with racist deepfake video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/carmel-school-students-attack-principal-with-racist-deepfake-video"},{"id":"INC-04889","date":"2023","year":2023,"title":"Study: AI image generators accept 85 percent of election manipulation prompts","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney; OpenAI; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-image-generators-accept-85-of-election-manipulation-prompts"},{"id":"INC-04384","date":"2023","year":2023,"title":"Adobe sells AI-generated Israel-Hamas war images","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adobe-sells-ai-generated-israel-hamas-war-images"},{"id":"INC-04997","date":"2023","year":2023,"title":"WhatsApp AI stickers generate Palestinian kids with guns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Meta Platforms","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/whatsapp-ai-stickers-generate-palestinian-kids-with-guns"},{"id":"INC-04584","date":"2023","year":2023,"title":"Cruise AV drags pedestrian across road","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-av-injures-pedestrian-has-license-revoked"},{"id":"INC-04465","date":"2023","year":2023,"title":"Australian academics make false AI-generated allegations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Google; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australian-academics-make-false-ai-generated-allegations"},{"id":"INC-04600","date":"2023","year":2023,"title":"Deepfake Justin Trudeau endorses Petro-Canada scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-justin-trudeau-endorses-petro-canada-scam"},{"id":"INC-04996","date":"2023","year":2023,"title":"Westfield High School non-concensual nude deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"AI/Robotics Venture Strategy 3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/westfield-high-school-non-concensual-nude-deepfakes"},{"id":"INC-04859","date":"2023","year":2023,"title":"Scarlett Johansson sues app for using image for AI advert","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Convert Yazılım Limited Şirketi; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scarlett-johansson-sues-app-for-using-image-for-ai-advert"},{"id":"INC-04598","date":"2023","year":2023,"title":"Deepfake Greta Thunberg promotes use of 'vegan grenades'","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Snicklick","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/greta-thunberg-promotes-use-of-vegan-grenades"},{"id":"INC-04606","date":"2023","year":2023,"title":"Deepfake Palestinian man carries children out of rubble","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-palestinian-carries-children-out-of-rubble"},{"id":"INC-04891","date":"2023","year":2023,"title":"Study: ChatGPT consumes 500 ml of water per 5-50 prompts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-consumes-500-ml-of-water-per-5-50-prompts"},{"id":"INC-04487","date":"2023","year":2023,"title":"Bella Hadid 'stands with Israel' deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts; Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bella-hadid-stands-with-israel-deepfake"},{"id":"INC-04748","date":"2023","year":2023,"title":"Microsoft AI researchers expose 38TB confidential data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Microsoft/Github","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-ai-researchers-expose-38tb-confidential-data"},{"id":"INC-04999","date":"2023","year":2023,"title":"Worldcoin suspended in Kenya over privacy, security concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Tools for Humanity/Worldcoin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/worldcoin-suspended-in-kenya-for-privacy-abuse"},{"id":"INC-04896","date":"2023","year":2023,"title":"Study: Dark web predators develop AI images of real child victims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dark-web-predators-develop-ai-images-of-real-child-victims"},{"id":"INC-04726","date":"2023","year":2023,"title":"LLaMA model used to create Allie sexbot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/llama-model-used-to-create-allie-sexbot"},{"id":"INC-04596","date":"2023","year":2023,"title":"Deepfake audio falsely depicts Barack Obama discussing conspiracy theory","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"ElevenLabs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-audio-falsely-depicts-barack-obama-discussing-conspiracy-theory"},{"id":"INC-04463","date":"2023","year":2023,"title":"Audio AIs impersonate former South Sudan leader Omar al-Bashir","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-campaign-impersonates-former-south-sudan-leader-omar-al-bashir"},{"id":"INC-04619","date":"2023","year":2023,"title":"Defence lawyer using AI 'botches' criminal trial closing argument","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"EyeLevel.AI; CaseFile Connect","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/defence-lawyer-using-ai-botches-criminal-trial-closing-argument"},{"id":"INC-04757","date":"2023","year":2023,"title":"Mike Huckabee books used to train language models without consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Bloomberg; EleutherAI; Meta Platforms; Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mike-huckabee-books-used-to-train-language-models-without-consent"},{"id":"INC-04987","date":"2023","year":2023,"title":"Video game voice actors attacked using their own AI voices","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"ElevenLabs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/video-game-voice-actors-attacked-using-their-own-ai-voices"},{"id":"INC-04633","date":"2023","year":2023,"title":"ElevenLabs voice generator makes celebrity voices read offensive messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"ElevenLabs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/elevenlabs-voice-generator-makes-celebrity-voices-read-offensive-messages"},{"id":"INC-04872","date":"2023","year":2023,"title":"Snapchat My AI requests to meet 13-year-old girl in park","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Snap Inc; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-my-ai-requests-to-meet-13-year-old-girl-in-park"},{"id":"INC-07192","date":"2019","year":2019,"title":"Guillermo Ibarrolla facial recognition wrongful arrest","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Danaide; NtechLab","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/guillermo-ibarrolla-facial-recognition-wrongful-arrest"},{"id":"INC-04609","date":"2023","year":2023,"title":"Deepfake recordings depict Keir Starmer abusing staff","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-audio-recording-depicts-british-opposition-leader-abusing-staff"},{"id":"INC-04454","date":"2023","year":2023,"title":"Anthropic sued for using copyrighted songs to train models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/anthropic-sued-for-using-copyrighted-songs-to-train-models"},{"id":"INC-04392","date":"2023","year":2023,"title":"AI or Not misidentifies Hamas baby victim as deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Optic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-or-not-misidentifies-hamas-baby-victim-as-deepfake"},{"id":"INC-05343","date":"2022","year":2022,"title":"Tor uses AI to generate Christopher Paolini book cover","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Tor Books","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tor-uses-ai-to-generate-christopher-paolini-book-cover"},{"id":"INC-04501","date":"2023","year":2023,"title":"Bloomsbury uses AI-generated artwork for Sarah J. Maas book","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Aperture Vintage","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bloomsbury-uses-ai-generated-artwork-for-sarah-j-maas-book"},{"id":"INC-04625","date":"2023","year":2023,"title":"Disney allegedly generates Loki season 2 poster with AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Disney/Disney Plus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/disney-allegedly-generates-loki-season-2-poster-with-ai"},{"id":"INC-05005","date":"2023","year":2023,"title":"YouTube videos target kids with AI false 'scientific' education content","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-videos-target-kids-with-ai-fake-scientific-education-content"},{"id":"INC-04404","date":"2023","year":2023,"title":"AI-generated travel books and reviews flood Amazon","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-travel-books-and-reviews-flood-amazon"},{"id":"INC-04403","date":"2023","year":2023,"title":"AI-generated mushroom foraging books flood Amazon","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-mushroom-foraging-books-flood-amazon"},{"id":"INC-04972","date":"2023","year":2023,"title":"UK Privacy/surveillance watchdog accuses Snapchat of failing to assess My AI Privacy/surveillance risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-fails-to-assess-my-ai-privacy-risks"},{"id":"INC-04437","date":"2023","year":2023,"title":"Amazon Alexa says 2020 US election was rigged","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-says-2020-us-election-was-rigged"},{"id":"INC-04760","date":"2023","year":2023,"title":"Mistral 7B generates ethnic cleansing, murder instructions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Mistral AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mistral-generates-ethnic-cleansing-murder-instructions"},{"id":"INC-04505","date":"2023","year":2023,"title":"Buzzfeed AI-generated Barbies reinforce racist stereotyping","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/buzzfeed-national-ai-barbies-racism-cultural-stereotyping"},{"id":"INC-05003","date":"2023","year":2023,"title":"Xiaohongshu AI image generator abuses copyright","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Xiaohongshu","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xiaohongshu-ai-image-generator-abuses-copyright"},{"id":"INC-04652","date":"2023","year":2023,"title":"Getty Images sues Stability AI for copyright abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/getty-images-sues-stability-ai-for-copyright-abuse"},{"id":"INC-04664","date":"2023","year":2023,"title":"Google Search indexes Bard personal chats","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-search-indexes-bard-personal-chats"},{"id":"INC-04825","date":"2023","year":2023,"title":"Quora, Google AIs say eggs can be melted","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google; OpenAI; Quora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/quora-google-ais-say-eggs-can-be-melted"},{"id":"INC-04599","date":"2023","year":2023,"title":"Deepfake IDs used in HKD 200,000 bank fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-ids-used-in-hkd-200000-bank-fraud"},{"id":"INC-04436","date":"2023","year":2023,"title":"Almendralejo hit by AI naked child images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"AI/Robotics Venture Strategy 3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/almendralejo-hit-by-ai-naked-child-images"},{"id":"INC-04617","date":"2023","year":2023,"title":"Deepfakes violate Anil Kapoor personality rights","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfakes-violate-anil-kapoor-personality-rights"},{"id":"INC-04440","date":"2023","year":2023,"title":"Amazon employees use Ring to spy on customers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon/Ring","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-employees-use-ring-to-spy-on-customers"},{"id":"INC-04745","date":"2023","year":2023,"title":"Microsoft 'algorithm' recommends Ottawa Food Bank visit","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-ai-recommends-ottawa-food-bank-visit"},{"id":"INC-04935","date":"2023","year":2023,"title":"Tesla Model 3 collides with Subaru Impreza, kills two","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-collides-with-subaru-impreza-kills-two"},{"id":"INC-04938","date":"2023","year":2023,"title":"Tesla Model Y crashes into tractor-trailer, killing driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-crashes-into-tractor-trailer-killing-driver"},{"id":"INC-06084","date":"2021","year":2021,"title":"Tesla kills New York man changing tyre on expressway","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-strikes-and-kills-man-changing-tyre"},{"id":"INC-04869","date":"2023","year":2023,"title":"Snapchat My AI 'goes rogue' by posting its own story","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchats-my-ai-goes-rogue-posts-to-stories"},{"id":"INC-05204","date":"2022","year":2022,"title":"Study: Uber algorithm locks Indian drivers out of accounts","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-algorithm-locks-indian-drivers-out-of-accounts"},{"id":"INC-04571","date":"2023","year":2023,"title":"CivitAI accused of generating synthetic 'child pornography' images","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"CivitAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/civitai-nonconsensual-ai-pornography"},{"id":"INC-04656","date":"2023","year":2023,"title":"Google AI bots expouse slavery, fascism","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-ai-bots-expouse-slavery-fascism"},{"id":"INC-04439","date":"2023","year":2023,"title":"Amazon disables Echo account after hearing racial slur","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-disables-echo-account-after-hearing-racial-slur"},{"id":"INC-04768","date":"2023","year":2023,"title":"MSN publishes AI-generated Brandon Hunter obituary","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Race Track","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/msn-publishes-useless-ai-generated-brandon-hunter-obituary"},{"id":"INC-04969","date":"2023","year":2023,"title":"UK algorithm delays young peoples' liver transplants","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"NHS Blood and Transplant","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/algorithm-delays-young-peoples-liver-transplants"},{"id":"INC-04970","date":"2023","year":2023,"title":"UK automated flood warning system issues late, false alerts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Environment Agency","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-flood-warning-system-false-alerts"},{"id":"INC-04564","date":"2023","year":2023,"title":"China uses AI to accuse US of starting Maui wildfires","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of China","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/china-uses-ai-to-accuse-us-of-starting-maui-wildfires"},{"id":"INC-05669","date":"2021","year":2021,"title":"Google flags medical images of groins as CSAM","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-flags-medical-images-of-groin-as-csam"},{"id":"INC-04534","date":"2023","year":2023,"title":"ChatGPT invents Henrik Enghoff academic citations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invents-henrik-enghoff-academic-citations"},{"id":"INC-05565","date":"2021","year":2021,"title":"Deepfake video alleges France opposes Mali military junta","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Synthesia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-video-alleges-france-opposes-mali-military-junta"},{"id":"INC-07405","date":"2017","year":2017,"title":"Google Autocomplete amplifies Texas massacre shooter Antifa conspiracy","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-texas-massacre-antifa-conspiracy"},{"id":"INC-04529","date":"2023","year":2023,"title":"ChatGPT found to 'easily' generate political messages, campaigns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-generates-political-messages-campaigns"},{"id":"INC-07654","date":"2011","year":2011,"title":"Google Autocomplete falsely associates Italian businessman with 'fraud'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-associates-italian-businessman-with-fraud"},{"id":"INC-07307","date":"2018","year":2018,"title":"Google Autocomplete, Related Search reveal rape victims' names","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-related-search-reveal-rape-victims-names"},{"id":"INC-04587","date":"2023","year":2023,"title":"Cruise investigated as robotaxi hits fire engine","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-robotaxi-hits-fire-engine"},{"id":"INC-04993","date":"2023","year":2023,"title":"VW Brazil Elis Regina deepfake advert","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"AlmapBBDO","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vw-brazil-elis-regina-deepfake"},{"id":"INC-05144","date":"2022","year":2022,"title":"iTutorGroup recruitment algorithmic age discrimination","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ping An Insurance Group/iTutorGroup","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/itutorgroup-recruitment-algorithmic-age-discrimination"},{"id":"INC-04460","date":"2023","year":2023,"title":"Artist's private medical image trains LAION dataset","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"LAION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/artists-private-medical-image-trains-laion-dataset"},{"id":"INC-04846","date":"2023","year":2023,"title":"Robert Kneschke photos used to train LAION model without consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"LAION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/laion-trains-robert-kneschke-photos-without-consent"},{"id":"INC-04390","date":"2023","year":2023,"title":"AI meal planner app suggests chlorine gas recipe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pak ‘n’ Save; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-meal-planner-app-suggests-chlorine-gas-recipe"},{"id":"INC-04445","date":"2023","year":2023,"title":"Amazon sells fake AI Jane Friedman books","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-sells-fake-ai-jane-friedman-books"},{"id":"INC-05006","date":"2023","year":2023,"title":"Zoom uses customer data to train AI models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Zoom Video Communications","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zoom-customer-data-ai-model-training"},{"id":"INC-04557","date":"2023","year":2023,"title":"ChatGPT-powered Fox8 botnet promotes Bitcoin fraud","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-powers-fox8-crypto-promotion-botnet"},{"id":"INC-04699","date":"2023","year":2023,"title":"Instawork accused of algorithmic hotel worker 'union-busting'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Garuda Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instawork-hotel-workers-union-busting"},{"id":"INC-05059","date":"2022","year":2022,"title":"Blenderbot 3 accuses Marietje Schaake of being a 'terrorist'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Beijing Academy of Artificial Intelligence; Bloomberg; DataBricks; EleutherAI; Facebook; Microsoft; OpenAI; Yandex","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/blenderbot-3-accuses-marietje-schaake-of-being-a-terrorist"},{"id":"INC-04806","date":"2023","year":2023,"title":"Porcha Rudruff facial recognition wrongful arrest","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"DataWorks Plus","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/porcha-rudruff-facial-recognition-wrongful-arrest"},{"id":"INC-04607","date":"2023","year":2023,"title":"Deepfake Pope Francis wears deepfake LGBTQ+ flag","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pope-wears-deepfake-lgbtq-flag"},{"id":"INC-04842","date":"2023","year":2023,"title":"Rishi Sunak pulls pint deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rishi-sunak-pulls-pint-deepfake"},{"id":"INC-04387","date":"2023","year":2023,"title":"AI converts Asian-American student into Caucasian","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Playground AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-converts-asian-american-student-into-caucasian"},{"id":"INC-04934","date":"2023","year":2023,"title":"Tesla accused of rigging driving range algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-rigs-driving-range-algorithm"},{"id":"INC-04912","date":"2023","year":2023,"title":"Tenants wrongly declined by faulty TransUnion AI system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"TransUnion Rental Screening Solutions","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tenants-declined-by-faulty-transunion-ai-system"},{"id":"INC-04570","date":"2023","year":2023,"title":"Cigna PxDx accused of accelerating health insurance claim denials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cigna","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cigna-pxdx-health-insurance-claim-reviews"},{"id":"INC-04593","date":"2023","year":2023,"title":"Deepfake 'Pan Africanists' support Burkina Faso military junta","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Synthesia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-pan-africanists-support-burkina-faso-junta"},{"id":"INC-04711","date":"2023","year":2023,"title":"Kerala man loses INR 40,000 to deepfake work colleague","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Personal","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kerala-man-loses-inr-40000-to-deepfake-work-colleague"},{"id":"INC-04654","date":"2023","year":2023,"title":"Gizmodo AI generates error-strewn Star Wars article","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gizmodo-ai-generates-error-strewn-star-wars-article"},{"id":"INC-04776","date":"2023","year":2023,"title":"Netherlands visa applicant over-stay risk assessments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ministry of Foreign Affairs","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/netherlands-visa-applicant-over-stay-risk-assessments"},{"id":"INC-05822","date":"2021","year":2021,"title":"Replika chatbot 'encouraged' Queen Elizabeth II assassination","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Luka Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/replika-encourages-queen-elizabeth-ii-assassination"},{"id":"INC-04882","date":"2023","year":2023,"title":"Stable Diffusion generates job type gender, racial stereotypes","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Stability AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stable-diffusion-racial-stereotyping"},{"id":"INC-04860","date":"2023","year":2023,"title":"Secret Invasion' AI-generated title sequence prompts controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Method Studios","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/secret-invasion-ai-intro-sequence"},{"id":"INC-04592","date":"2023","year":2023,"title":"Deepfake 'Chechnyan' soldier posts false Ukraine war stories","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics; Govt - defence","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-soldier-posts-fake-ukraine-war-stories"},{"id":"INC-04546","date":"2023","year":2023,"title":"ChatGPT role-plays BDSM, describes sex acts with children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-children-sex-acts-bdsm"},{"id":"INC-04623","date":"2023","year":2023,"title":"Discord tricked into sharing napalm, meths instructions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Discord","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/discord-tricked-into-sharing-napalm-meths-instructions"},{"id":"INC-05503","date":"2021","year":2021,"title":"Betfair algorithm misses gambling addict red flags","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Flutter UKI/Betfair","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/algorithm-misses-gambling-addict-red-flags"},{"id":"INC-05129","date":"2022","year":2022,"title":"Greek Intelligence implicated in \"Predatorgate\" AI-powered spyware scandal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cytrox; Intellexa","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/greek-intelligence-implicated-in-ai-powered-spyware-scandal"},{"id":"INC-06975","date":"2020","year":2020,"title":"Tesla Model 3 loses control, kills man at bus shelter","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-loses-control-kills-man-at-bus-shelter"},{"id":"INC-04941","date":"2023","year":2023,"title":"Tesla with FSD reportedly activated drives into tree, injuring driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-fsd-drives-into-tree-injures-driver"},{"id":"INC-04589","date":"2023","year":2023,"title":"Cruise robotaxi obstructs police after mass shooting","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-robotaxi-obstructs-police-after-shooting"},{"id":"INC-06087","date":"2021","year":2021,"title":"Tesla Model 3 strikes over-turned truck, kills driver","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-strikes-over-turned-truck-kills-driver"},{"id":"INC-04849","date":"2023","year":2023,"title":"Ron de Santis deepfake shows Donald Trump hugging Dr Fauci","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ron de Santis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/donald-trump-hugs-dr-fauci-deepfake"},{"id":"INC-04902","date":"2023","year":2023,"title":"study: Instagram enables global paedophile network","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-enables-global-paedophile-network"},{"id":"INC-04694","date":"2023","year":2023,"title":"Inaccurate AI content overwhelms Stack Overflow content moderation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-overwhelms-stack-overflow-content-moderation"},{"id":"INC-04856","date":"2023","year":2023,"title":"Scammer sells fake AI-generated Frank Ocean songs","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Discord; Soundcloud","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scammer-sells-fake-ai-frank-ocean-songs"},{"id":"INC-04710","date":"2023","year":2023,"title":"Just Eat accused of using algorithm to fire employees","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Just Eat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/just-eat-uses-algorithm-to-fire-employees"},{"id":"INC-04883","date":"2023","year":2023,"title":"Stanford Alpaca language model removed after safety, cost concerns","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Stanford University","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stanford-alpaca-large-language-model"},{"id":"INC-07361","date":"2017","year":2017,"title":"Addiction to social media \"contributed\" to Molly Russell suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Instagram; Pinterest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/molly-russell-social-media-suicide"},{"id":"INC-05203","date":"2022","year":2022,"title":"Student stabbed after Evolv weapons detection failure","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Evolv Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/student-stabbed-after-evolv-weapons-detection-failure"},{"id":"INC-04444","date":"2023","year":2023,"title":"Amazon ruled to have used Alexa child data to tune voice algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-uses-alexa-child-data-to-tune-voice-algorithm"},{"id":"INC-04774","date":"2023","year":2023,"title":"NEDA eating disorder chatbot sparks employee backlash","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Cass","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/neda-replaces-eating-disorder-helpline-staff-with-chatbot"},{"id":"INC-04531","date":"2023","year":2023,"title":"ChatGPT invented case citations in Avianca court case","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-invented-case-citations-in-legal-filings"},{"id":"INC-04527","date":"2023","year":2023,"title":"ChatGPT falsely claims to write student essays","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-falsely-claims-to-write-student-essays"},{"id":"INC-04399","date":"2023","year":2023,"title":"AI-cloned Stefanie Sun songs go viral in China","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Bilibili; Kuaishou; QQ Music","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-stefanie-sun"},{"id":"INC-04567","date":"2023","year":2023,"title":"Chinese scammer uses AI to defraud 'friend' of USD 622,000","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Tencent/WeChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-scammer-uses-ai-to-defraud-fiend-of-usd-622000"},{"id":"INC-04800","date":"2023","year":2023,"title":"Pentagon deepfake 'explosion' jitters US stock market","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pentagon-deepfake-explosion"},{"id":"INC-06780","date":"2020","year":2020,"title":"Michael Williams gunshot detection wrongful arrest","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"SoundThinking","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michael-williams-gunshot-detection-wrongful-arrest"},{"id":"INC-04632","date":"2023","year":2023,"title":"Election deepfake falsely links Kemal Kilicdaroglu to PKK","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Russia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kemal-kilicdaroglu-pkk-links-deepfake"},{"id":"INC-04400","date":"2023","year":2023,"title":"AI-generated article calls fake tanning 'racist'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Irish Times","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-generated-article-calls-fake-tanning-racist"},{"id":"INC-04548","date":"2023","year":2023,"title":"ChatGPT used to create fake fatal train accident news","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-man-fakes-train-accident-fatalities-news"},{"id":"INC-04540","date":"2023","year":2023,"title":"ChatGPT powers automated content, spam farms","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-automated-content-spam-farms"},{"id":"INC-04550","date":"2023","year":2023,"title":"ChatGPT writes fake online reviews","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-writes-fake-online-reviews"},{"id":"INC-04857","date":"2023","year":2023,"title":"Scammers clone teenager's voice, threaten kidnapping","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Education","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scammers-clone-teenagers-voice-threaten-kidnapping"},{"id":"INC-04448","date":"2023","year":2023,"title":"Amnesty fake Colombia national strike images","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amnesty-fake-colombia-national-strike-images"},{"id":"INC-04845","date":"2023","year":2023,"title":"RNC smears President Biden with AI ad","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Republican National Committee (GOP)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rnc-smears-president-biden-with-fake-ai-advert"},{"id":"INC-05041","date":"2022","year":2022,"title":"Amazon delivery drone crashes, sparks 25-acre fire","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon/Prime Air","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-delivery-drone-crashes-sparks-22-acre-fire"},{"id":"INC-04956","date":"2023","year":2023,"title":"TikTok For You pushes suicide, violence, misogynism","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tiktok","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-pushes-suicide-content-to-kids"},{"id":"INC-04724","date":"2023","year":2023,"title":"Levi's accused of diversity washing by using AI fashion models","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Lalaland.ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/levis-artificial-diversity-ai-models"},{"id":"INC-04894","date":"2023","year":2023,"title":"Study: ChatGPT lies more in Chinese than English","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-lies-more-in-chinese-than-english"},{"id":"INC-04394","date":"2023","year":2023,"title":"AI photo wins Sony Photography Awards","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Boris Eldagsen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sony-photography-awards-ai-victory"},{"id":"INC-04728","date":"2023","year":2023,"title":"Magazine publishes Michael Schumacher fake AI-generated interview","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Character.AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michael-schumacher-ai-exclusive-interview"},{"id":"INC-04870","date":"2023","year":2023,"title":"Snapchat My AI discovered to access user location data","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-location-access-opacity"},{"id":"INC-04871","date":"2023","year":2023,"title":"Snapchat My AI gives sex advice to 13-year-old","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Snap Inc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/snapchat-ai-gives-sex-advice-to-13-year-old"},{"id":"INC-05321","date":"2022","year":2022,"title":"Tesla catches fire after multi-car crash, kills passenger","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-catches-fire-after-multi-car-crash-kills-passenger"},{"id":"INC-05330","date":"2022","year":2022,"title":"Tesla Model Y rear-ends Yamaha motorcycle, kills rider","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-rear-ends-yamaha-motorcycle-kills-rider"},{"id":"INC-05334","date":"2022","year":2022,"title":"Tesla rear-ends Kawasaki motorcycle, kills rider","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-rear-ends-kawasaki-motorcycle-kills-rider"},{"id":"INC-05325","date":"2022","year":2022,"title":"Tesla Model 3 rear-ends Harley-Davidson, kills rider","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-rear-ends-harley-davidson-kills-rider"},{"id":"INC-04597","date":"2023","year":2023,"title":"Deepfake Donald Trump is arrested","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-donald-trump-arrest-photos"},{"id":"INC-04608","date":"2023","year":2023,"title":"Deepfake Pope Francis wears white puffa jacket","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-pope-francis-wears-white-puffa-jacket"},{"id":"INC-05058","date":"2022","year":2022,"title":"Bing Chat recommends journalist divorce wife","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bing-chat-recommends-journalist-divorce-wife"},{"id":"INC-04586","date":"2023","year":2023,"title":"Cruise AV rear-ends San Francisco transit bus","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-av-rear-ends-san-francisco-transit-bus"},{"id":"INC-04486","date":"2023","year":2023,"title":"Belgian man commits suicide after bot relationship","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Chai Research; EleutherAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/belgian-man-commits-suicide-after-bot-relationship"},{"id":"INC-04518","date":"2023","year":2023,"title":"ChatGPT accuses Australian mayor of bribery","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-accuses-australian-mayor-of-bribery"},{"id":"INC-04519","date":"2023","year":2023,"title":"ChatGPT accuses law professor of sexual harassment","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI; Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-accuses-law-professor-of-sexual-harassment"},{"id":"INC-05328","date":"2022","year":2022,"title":"Tesla Model Y collides with two cars in Taizhou, kills two","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-collides-with-two-cars-in-taizhou-kills-two"},{"id":"INC-04937","date":"2023","year":2023,"title":"Tesla Model S crashes into fire truck, kills driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-crashes-into-fire-truck-kills-driver"},{"id":"INC-04936","date":"2023","year":2023,"title":"Tesla Model 3 crashes into bus in Rui’an, kills one","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-crashes-into-bus-in-ruian-kills-one"},{"id":"INC-04441","date":"2023","year":2023,"title":"Amazon Go fails to inform NYC customers about facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-go-fails-to-inform-nyc-customers-about-facial-recognition"},{"id":"INC-05077","date":"2022","year":2022,"title":"Computer glitch gives hundreds of Scottish offenders wrong risk level","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"MHS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/computer-glitch-gives-hundreds-of-scottish-offenders-wrong-risk-level"},{"id":"INC-04637","date":"2023","year":2023,"title":"FaceMega sexualised face swap ads violate platform policies","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Wondershare/Ufoto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facemega-sexualised-face-swapping"},{"id":"INC-04984","date":"2023","year":2023,"title":"Vermeer Girl with a Pearl Earring AI facsimile causes controversy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Julian van Dieken","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vermeer-girl-with-a-pearl-earring-ai-facsimile"},{"id":"INC-05014","date":"2022","year":2022,"title":"AI system invents 40,000 biochemical warfare agents","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Collaborations Pharmaceuticals","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-invents-40000-biochemical-warfare-agents"},{"id":"INC-04954","date":"2023","year":2023,"title":"TikTok Bold Glamour filter accused of causing anxiety","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-bold-glamour-filter"},{"id":"INC-04765","date":"2023","year":2023,"title":"Mohammed Khadeer facial recognition wrongful arrest","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Medak District Police; Crime and Criminal Tracking Network & Systems (CCTNS)","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mohammed-khadeer-facial-recognition-wrongful-arrest-death"},{"id":"INC-05327","date":"2022","year":2022,"title":"Tesla Model S strikes curb, kills three passengers","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-strikes-curb-kills-three-passengers"},{"id":"INC-05329","date":"2022","year":2022,"title":"Tesla Model Y crash kills two, injures three","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-crash-kills-two-injures-three"},{"id":"INC-07581","date":"2015","year":2015,"title":"Titus Henderson COMPAS parole denial","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Volaris Group/Equivant/Northpointe","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/titus-henderson-compas-parole-denial"},{"id":"INC-05039","date":"2022","year":2022,"title":"Alonzo Sawyer facial recognition wrongful arrest, jailing","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Baltimore Police Department","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/alonzo-sawyer-facial-recognition-mistaken-arrest"},{"id":"INC-07131","date":"2020","year":2020,"title":"Workday accused of building discriminatory AI job screening system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Workday","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/workday-ai-job-screening-tool"},{"id":"INC-04585","date":"2023","year":2023,"title":"Cruise AV impedes San Francisco firefighters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-av-impedes-san-francisco-firefighters"},{"id":"INC-05365","date":"2022","year":2022,"title":"Zarya of the Dawn AI image copyright ownership","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kris Kashtanova; Midjourney","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zarya-of-the-dawn-ai-images-copyright-ownership"},{"id":"INC-05132","date":"2022","year":2022,"title":"Hollie Mengert art used to train Illustration Diffusion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/illustrator-hollie-mengert-converted-into-ai-model"},{"id":"INC-04551","date":"2023","year":2023,"title":"ChatGPT writes Hangzhou traffic disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chatgpt-writes-hangzhou-traffic-disinformation"},{"id":"INC-04736","date":"2023","year":2023,"title":"Men's Journal publishes AI-generated article riddled with errors","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Arena Group/Men's Journal; OpenAI; Jasper","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mens-journal-ai-journalism"},{"id":"INC-04780","date":"2023","year":2023,"title":"Nothing, Forever Jerry Seinfeld clone makes transphobic comments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI; Stability AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nothing-forever-jerry-seinfeld-clone-transphobia"},{"id":"INC-05175","date":"2022","year":2022,"title":"Pro-China deepfake 'spamouflage' campaign","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of China","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pro-china-deepfake-spamouflage-campaign"},{"id":"INC-04775","date":"2023","year":2023,"title":"Netflix 'Dog and Boy' AI film backgrounds cause controversy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Netflix Anime Creators Base; Rinna; WIT Studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/netflix-dog-and-boy-film-ai-backgrounds"},{"id":"INC-05178","date":"2022","year":2022,"title":"Professor Meareg Amare Abrha doxxed on Facebook, murdered","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/professor-meareg-amare-abrha-doxxing-murder"},{"id":"INC-04679","date":"2023","year":2023,"title":"Historical Figures AI-powered chat rapped for false responses","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Sidhant Chaddha","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/historical-figures-chat"},{"id":"INC-05088","date":"2022","year":2022,"title":"Deepfake Mark Ruffalo scams manga artist Chikae Ide","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/manga-artist-chikae-ide-deepfake-scamming"},{"id":"INC-05326","date":"2022","year":2022,"title":"Tesla Model S causes eight-vehicle pile-up","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-crash-causes-eight-vehicle-pile-up"},{"id":"INC-04712","date":"2023","year":2023,"title":"Koko AI mental health counselling 'experiment' fails to obtain user consent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Koko","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/koko-ai-mental-health-counselling-experiment"},{"id":"INC-05070","date":"2022","year":2022,"title":"Chess robot breaks child's finger","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Moscow Chess Federation","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chess-robot-breaks-childs-finger"},{"id":"INC-05048","date":"2022","year":2022,"title":"Apple Crash Detection false positives","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-crash-detection-false-positives"},{"id":"INC-05168","date":"2022","year":2022,"title":"Neuro-sama AI v-tuber denies Holocaust, women's rights","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Vedal987","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/neuro-sama-ai-v-tuber"},{"id":"INC-05057","date":"2022","year":2022,"title":"Binance CCO Partick Hillmann impersonated in deepfake scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/binance-cco-deepfake-impersonation"},{"id":"INC-05171","date":"2022","year":2022,"title":"Oregon drops 'unfair' child abuse Safety at Screening tool","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Oregon Department of Human Services","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/oregon-dhs-safety-at-screening-tool"},{"id":"INC-05097","date":"2022","year":2022,"title":"Edmonton sexual assault DNA phenotyping accused of racial stereotyping","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Parabon NanoLabs","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/edmonton-sexual-assault-dna-phenotyping"},{"id":"INC-05188","date":"2022","year":2022,"title":"San Francisco police 'killer robot' plan shot down","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Remotec; QinetiQ","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/san-francisco-police-killer-robots"},{"id":"INC-05149","date":"2022","year":2022,"title":"KFC Germany Kristallnacht automated marketing alert backfires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"KFC Germany","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kfc-germany-kristallnacht-marketing-automation"},{"id":"INC-04829","date":"2023","year":2023,"title":"RealPage algorithm accused of artificially increasing rents","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"RealPage","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/realpage-algorithm-accused-of-artificially-increasing-rents"},{"id":"INC-05054","date":"2022","year":2022,"title":"Axon plan to develop school security taser drones prompts backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Axon","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/axon-school-security-taser-drones"},{"id":"INC-05322","date":"2022","year":2022,"title":"Tesla crashes into private jet after Smart Summon","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-smart-summon"},{"id":"INC-05557","date":"2021","year":2021,"title":"Coupang fined for own brand search engine rigging","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Coupang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/coupang-own-brand-search-engine-rigging"},{"id":"INC-06807","date":"2020","year":2020,"title":"Naver fined for own brand search engine rigging","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Naver","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/naver-own-brand-search-engine-rigging"},{"id":"INC-05139","date":"2022","year":2022,"title":"Instagram fails to protect women from 90 percent of abusive messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-dm-systemic-abuse-harassment"},{"id":"INC-05081","date":"2022","year":2022,"title":"Cruise driverless car pulls away from police inspection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruise-driverless-cars-traffic-blocking"},{"id":"INC-05104","date":"2022","year":2022,"title":"Facebook downranking system failure leads to misinformation spike","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-downranking-system-failure"},{"id":"INC-05092","date":"2022","year":2022,"title":"Deepfake salespeople swamp LinkedIn","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Business/professional services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/linkedin-deepfake-salespeople"},{"id":"INC-05324","date":"2022","year":2022,"title":"Tesla FSD beta test car hits bollard, driver fired","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-fsd-beta-test-car-hits-bollard-driver-fired"},{"id":"INC-05340","date":"2022","year":2022,"title":"TikTok exposes new users to Russia/Ukraine war disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-russiaukraine-war-disinformation"},{"id":"INC-05098","date":"2022","year":2022,"title":"Estée Lauder fires employees after automated performance assessments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"HireVue","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/estee-lauder-employee-performance-assessments"},{"id":"INC-05091","date":"2022","year":2022,"title":"Deepfake President Zelenskyy instructs Ukraine army to surrender","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/president-zelenskyy-deepfake-surrender"},{"id":"INC-05360","date":"2022","year":2022,"title":"Weight Watchers fined for harvesting US child data","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"WW International/Weight Watchers/Kurbo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/weight-watchers-child-data-harvesting"},{"id":"INC-05186","date":"2022","year":2022,"title":"Russian bots found to be spreading anti-Ukraine disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Government of Russia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/russia-disinformation-bot-farms"},{"id":"INC-05827","date":"2021","year":2021,"title":"Restaurant owner dies after Coupang Eats star rating dispute","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Coupang/Coupang Eats","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/coupang-eats-star-ratings-system"},{"id":"INC-05358","date":"2022","year":2022,"title":"VRChat online virtual reality universe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"VRChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vrchat-virtual-strip-clubs-child-grooming"},{"id":"INC-05099","date":"2022","year":2022,"title":"Ethiopia Bayraktar TB2 drone Tigray school attack","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baykar Defence","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ethiopia-bayraktar-tb2-drone-tigray-school-attack"},{"id":"INC-06147","date":"2021","year":2021,"title":"Ukraine uses Bayraktar TB2 drones to hit Russian targets","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baykar Defence","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ukraine-russia-bayraktar-tb2-drone-attacks"},{"id":"INC-05018","date":"2022","year":2022,"title":"AI-powered Russian influence campaign spreads anti-Ukraine propaganda","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Govt - defence","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kyiv-deepfake-influence-campaign"},{"id":"INC-05071","date":"2022","year":2022,"title":"Children discovered attending Roblox Condo nazi sex parties","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Roblox","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/roblox-condo-nazi-sex-parties"},{"id":"INC-05345","date":"2022","year":2022,"title":"Twitter 'mistakenly' suspends Ukraine OSINT accounts before Russian invasion","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/twitter-ukraine-osint-account-suspensions"},{"id":"INC-05164","date":"2022","year":2022,"title":"MoviePass to monitor viewers using facial recognition and eye tracking","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"MoviePass","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/moviepass-preshow-eye-tracking"},{"id":"INC-05492","date":"2021","year":2021,"title":"Author uses AI to manipulate fake news documentary book","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Jonas Bendiksen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/the-book-of-veles"},{"id":"INC-05347","date":"2022","year":2022,"title":"UK DWP sued for 'unfair' disability benefits fraud detection algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department for Work and Pensions (DWP)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dwp-disability-benefits-fraud-algorithm"},{"id":"INC-05044","date":"2022","year":2022,"title":"Amazon sales of suicide chemical compound is questioned","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-chemical-food-preservative-suicides"},{"id":"INC-05333","date":"2022","year":2022,"title":"Tesla owners report multiple instances of \"phantom braking\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-phantom-braking"},{"id":"INC-05078","date":"2022","year":2022,"title":"Crisis Text Line shares users' mental health data with AI company","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Crisis Text Line","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/crisis-text-line-data-sharing"},{"id":"INC-05876","date":"2021","year":2021,"title":"Teenager attempts to extort Lauren Book using deepfake nude photos","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Jeremy Kampervee","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lauren-book-deepfake-extortion"},{"id":"INC-05133","date":"2022","year":2022,"title":"Houthis attack Abu Dhabi oil deport, airport using kamikaze drones","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ansar Allah","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/houthi-abu-dhabi-drone-attack"},{"id":"INC-05356","date":"2022","year":2022,"title":"Voiceverse NFT caught plagiarising voice lines from AI service","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Voiceverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/voiceverse-nft-voice-theft"},{"id":"INC-05323","date":"2022","year":2022,"title":"Tesla FSD Assertive mode pulled for performing illegal rolling stops","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-fsd-assertive-mode-rolling-stops"},{"id":"INC-05157","date":"2022","year":2022,"title":"Mainz police under fire for misusing COVID-19 tracing app data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Culture4life","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mainz-police-luca-covid-19-abuse"},{"id":"INC-07200","date":"2019","year":2019,"title":"Investigation: BJP app manipulates opinion, harasses opponents","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Bharatiya Janata Party; Persistent Systems","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tek-fog-political-manipulation"},{"id":"INC-05008","date":"2022","year":2022,"title":"100 Muslim women auctioned on Bulli Bai app in India","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Politics","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/bulli-bai-muslim-women-auction"},{"id":"INC-05134","date":"2022","year":2022,"title":"Hyderabad police force activist to remove COVID-19 mask","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"NEC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hyderabad-police-facial-recognition"},{"id":"INC-06085","date":"2021","year":2021,"title":"Tesla Model 3 crash injures one, injures twenty in Paris","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-paris-fatal-crash"},{"id":"INC-05845","date":"2021","year":2021,"title":"Shanghai \"AI prosecutor\" stirs civil liberties concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Shanghai Pudong People’s Procuratorate; Chinese Academy of Sciences","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/shanghai-ai-prosecutor"},{"id":"INC-05451","date":"2021","year":2021,"title":"Amazon Alexa recommends girl touches electric plug","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-penny-challenge"},{"id":"INC-05802","date":"2021","year":2021,"title":"Pony.ai driverless car hits road divider, traffic sign","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pony.ai; Luminar; NVIDIA","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pony-ai-driverless-test-crash"},{"id":"INC-05759","date":"2021","year":2021,"title":"Meta Horizon Worlds beta tester groped by stranger","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta Platforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/horizon-worlds-virtual-groping"},{"id":"INC-05868","date":"2021","year":2021,"title":"Study: Facebook misidentifies 83 percent of political ads","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-political-ads-misidentification"},{"id":"INC-05745","date":"2021","year":2021,"title":"Life360 sells user location data, sparking controversy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Life360","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/life360-location-data-sharing"},{"id":"INC-05465","date":"2021","year":2021,"title":"Amazon sued after DSP van seriously injures Tesla passenger Ans Rana","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-dsp-ans-rana-crash-liability"},{"id":"INC-05844","date":"2021","year":2021,"title":"Self-driving Tesla Model Y crashes in Brea, California","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-fsd-beta-crash"},{"id":"INC-05597","date":"2021","year":2021,"title":"EyeBobs settles over controversial AccessiBe AI accessibility overlay","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"accessiBe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/accessibe-automated-accessibility"},{"id":"INC-06099","date":"2021","year":2021,"title":"Tesla recalls 11,700 cars due to FSD beta software glitch","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-fsd-beta-software-glitch-recall"},{"id":"INC-05375","date":"2021","year":2021,"title":"Adobe Project Morpheus slammed for deepfake uses","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Adobe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adobe-sensei-project-morpheus"},{"id":"INC-06812","date":"2020","year":2020,"title":"New Delhi police rapped for using facial recognition to monitor India citizenship law protests","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Innefu Labs, Staqu","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/india-citizenship-law-protest-surveillance"},{"id":"INC-05695","date":"2021","year":2021,"title":"Huq admits GPS location data sharing privacy breach","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Huq Industries; Kaibits Software; AppSourceHub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/huq-gps-location-data-sharing"},{"id":"INC-05754","date":"2021","year":2021,"title":"Meituan accused of 'intensive' location tracking","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Meituan Dazhong","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meituan-location-tracking"},{"id":"INC-05617","date":"2021","year":2021,"title":"Facebook pushes users into seeing more provocative, negative content","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-meaningful-social-interactions-algorithm"},{"id":"INC-05645","date":"2021","year":2021,"title":"Facial recognition-based FaceTag student networking app prompts backlash","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Yuen Ler Chow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/the-facetag"},{"id":"INC-05457","date":"2021","year":2021,"title":"Amazon India accused of rigging search engine to promote 'own' brands","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-india-search-rigging"},{"id":"INC-05782","date":"2021","year":2021,"title":"NHGSFP collection of Nigerian students' fingerprints sparks controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"HID Global; Plovtech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nhgsfp-school-meal-fingerprint-biometrics"},{"id":"INC-06851","date":"2020","year":2020,"title":"Polish primary school fined for using fingerprint data to verify meal payments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Gdansk Primary School No. 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gdansk-primary-school-no-2-meal-payment-verification"},{"id":"INC-05750","date":"2021","year":2021,"title":"Masayuki Nakamoto arrested for selling deepfaked uncensored porn","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Masayuki Nakamoto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/masayuki-nakamoto-deepfake-uncensored-pornography"},{"id":"INC-05464","date":"2021","year":2021,"title":"Amazon Ring video doorbell ruled to invade neighbour privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-ring-video-doorbell-neighbour-privacy-invasion"},{"id":"INC-05466","date":"2021","year":2021,"title":"Amazon US accused of rigging search engine to promote 'own' brands","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-us-own-brand-search-engine-rigging"},{"id":"INC-05771","date":"2021","year":2021,"title":"MTV Lebanon Beirut bomb victim deepfakes solicits backlash","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"MTV Lebanon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mtv-lebanon-uses-deepfakes-to-commemorate-bomb-victims"},{"id":"INC-05832","date":"2021","year":2021,"title":"Robot war dog with rifle prompts AI weaponisation fears","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ghost Robotics; Sword International","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vision-60spur-quadrupedal-war-robot"},{"id":"INC-05539","date":"2021","year":2021,"title":"Chinese government facial recognition system hacked by tax fraudsters","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"State Taxation Administration","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/china-taxation-department-id-system-hack"},{"id":"INC-05462","date":"2021","year":2021,"title":"Amazon rainforest illegally for sale on Facebook Marketplace","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-marketplace-amazon-rainforest-sales"},{"id":"INC-05672","date":"2021","year":2021,"title":"Google misidentifies software engineer as serial killer","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-misidentifies-engineer-as-serial-killer"},{"id":"INC-05757","date":"2021","year":2021,"title":"Met Police retrospective facial recognition system raises privacy concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NEC","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/met-police-retrospective-facial-recognition"},{"id":"INC-05460","date":"2021","year":2021,"title":"Amazon Mentor delivery driver scoring criticised as inaccurate, invasive","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Solera/eDriving","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-mentor-dsp-delivery-driver-scoring"},{"id":"INC-05455","date":"2021","year":2021,"title":"Amazon Flex algorithm forces delivery drivers to take unsafe routes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-flex-delivery-driver-routing-safety"},{"id":"INC-06192","date":"2021","year":2021,"title":"XPeng P7 on auto navigation crashes into truck, injuring driver","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Xpeng Motors","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xpeng-p7-crashes-into-truck"},{"id":"INC-07658","date":"2011","year":2011,"title":"Sarah Wysocki fired after inaccurate teacher effectiveness assessment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Mathematica Policy Research","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/washington-dc-schools-teacher-value-added-scoring"},{"id":"INC-06090","date":"2021","year":2021,"title":"Tesla Model X on Autopilot crashes into five police officers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-x-crashes-into-five-police-officers"},{"id":"INC-04749","date":"2023","year":2023,"title":"Microsoft Bing claims it spied on Microsoft employees","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-bing-claims-it-spied-on-microsoft-employees"},{"id":"INC-04750","date":"2023","year":2023,"title":"Microsoft Bing repeats ChatGPT COVID-19 conspiracy","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-bing-chatbot-repeats-chatgpt-covid-19-conspiracy"},{"id":"INC-05731","date":"2021","year":2021,"title":"JR East facial recognition system prompts Privacy/surveillance row","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"East Japan Railway Co.","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/jr-east-facial-recognition"},{"id":"INC-05812","date":"2021","year":2021,"title":"Queensland domestic violence predictive policing trial prompts concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Queensland Police Service (QPS)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/queensland-high-risk-domestic-violence-predictions"},{"id":"INC-05609","date":"2021","year":2021,"title":"Facebook data leak exposes Balkan troll farm political disinformation","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM08"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-balkan-troll-farms"},{"id":"INC-05783","date":"2021","year":2021,"title":"NHS Digital, iProov facial recognition deal raises transparency concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"iProov","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nhs-digitaliproov-facial-recognition-data-sharing"},{"id":"INC-05632","date":"2021","year":2021,"title":"Facebook, Google run millions of unsafe 'abortion reversal' ads","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook; Alphabet Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-google-abortion-reversal-ads"},{"id":"INC-05599","date":"2021","year":2021,"title":"Facebook 'aware of' Instagram impact on teen girls' mental health","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-teen-girls-mental-health-harms"},{"id":"INC-05739","date":"2021","year":2021,"title":"LAPD collects personal social media data of every citizen it interviews","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dataminr; Geofeedia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lapd-social-media-data-collection"},{"id":"INC-06118","date":"2021","year":2021,"title":"TikTok USA recommends drugs, alcohol to children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-recommends-adult-content-to-children"},{"id":"INC-05784","date":"2021","year":2021,"title":"NIO ES8 crashes into highway patrol vehicle, killing driver","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Nio; Intel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nio-es8-fatal-crash"},{"id":"INC-06123","date":"2021","year":2021,"title":"Toyota Paralympics self-driving bus hits disabled athlete","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Toyota","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/toyota-paralympics-self-driving-bus-hits-athlete"},{"id":"INC-05692","date":"2021","year":2021,"title":"Hour One 'character' clones accused of allowing misuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Hour One","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hour-one-character-clones"},{"id":"INC-06102","date":"2021","year":2021,"title":"Tesla with Autopilot reportedly activated hits parked police car","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-hits-parked-police-car"},{"id":"INC-06086","date":"2021","year":2021,"title":"Tesla Model 3 hits six children, adult","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-hits-six-children-adult"},{"id":"INC-06190","date":"2021","year":2021,"title":"Worthless' Mater Dei Hospital medicine robots cause mass resignations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deenova","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mater-dei-hospital-medicine-robots"},{"id":"INC-06167","date":"2021","year":2021,"title":"US mortgage approval algorithm more likely to reject people of colour","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Freddie Mac; Fannie Mae","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-mortgage-approval-algorithm-discrimination"},{"id":"INC-05873","date":"2021","year":2021,"title":"Study: US mortgage loans assessment tools suffer from economic, racial bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Banking/financial services","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/credit-score-algorithm-data-economic-racial-bias"},{"id":"INC-05614","date":"2021","year":2021,"title":"Facebook fined for violating privacy of 200,000 South Koreans","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-south-korea-facial-recognition-abuse"},{"id":"INC-05339","date":"2022","year":2022,"title":"Ticketmaster rapped for Bruce Springsteen AI price surge","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Live Nation/Ticketmaster","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ticketmaster-rapped-for-bruce-springsteen-ai-price-surge"},{"id":"INC-06169","date":"2021","year":2021,"title":"US Postal Inspection Service covertly monitors justice protestors","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clearview AI; Zignal Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-postal-inspection-service-icop-covert-monitoring-and-surveillance"},{"id":"INC-07543","date":"2016","year":2016,"title":"US law enforcement able to access facial photos of 117 million Americans","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Federal Bureau of Investigation (FBI)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/us-police-perpetual-facial-line-up"},{"id":"INC-07193","date":"2019","year":2019,"title":"Guns disguised as cases for sale on Facebook Marketplace","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-marketplace-gun-sales"},{"id":"INC-07473","date":"2016","year":2016,"title":"Allocation algorithm wrongly places thousands of teachers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"HP Enterprise Services Italia; Finmeccanica","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/allocation-algorithm-wrongly-places-thousands-of-italian-teachers"},{"id":"INC-07336","date":"2018","year":2018,"title":"Tesla Model S crashes into fire engine with Autopilot 'engaged'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-crashes-into-fire-engine"},{"id":"INC-07403","date":"2017","year":2017,"title":"GM Chevrolet Bolt hits motorbike, injures rider","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"General Motors","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gm-chevrolet-bolt-motorbike-collision"},{"id":"INC-05486","date":"2021","year":2021,"title":"Apple NeuralHash child sexual abuse scanning raises privacy concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-neuralhash-csam-scanning"},{"id":"INC-05461","date":"2021","year":2021,"title":"Amazon One palmprint biometrics accused of opacity, jeopardising privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-one-palmprint-biometrics"},{"id":"INC-06926","date":"2020","year":2020,"title":"Spanish supermarket chain Mercadona fined for facial recognition privacy violations","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Oosto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mercadona-facial-recognition"},{"id":"INC-05777","date":"2021","year":2021,"title":"NATO warships' locations are spoofed","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"International Maritime Organization","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nato-warships-ais-spoofing"},{"id":"INC-05871","date":"2021","year":2021,"title":"Study: Social media firms fail to take down anti-Semitic content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook; YouTube;TikTok; Twitter","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-google-anti-semitic-failure-to-act"},{"id":"INC-06500","date":"2020","year":2020,"title":"Deepfake audio recording used in Dubai child custody battle","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Govt - justice","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dubai-deepfake-court-evidence"},{"id":"INC-06136","date":"2021","year":2021,"title":"Twitter suspension of Japan PM critics prompts censorship accusations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/japan-pm-critics-twitter-suspension"},{"id":"INC-07194","date":"2019","year":2019,"title":"Henn-na Hotel Tapia robots found to have security vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"MJI Robotics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/henn-na-hotel-robot-security"},{"id":"INC-07324","date":"2018","year":2018,"title":"Pepper robot discovered to have security vulnerabilities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Softbank Robotics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/softbank-pepper-robot-security-vulnerabilities"},{"id":"INC-05787","date":"2021","year":2021,"title":"Ocado robots collide, causing fire and local disruption","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ocado","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ocado-robot-collision"},{"id":"INC-07216","date":"2019","year":2019,"title":"Ocado robot charger malfunctions, 370 jobs eliminated","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ocado","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ocado-robot-charger-malfunction"},{"id":"INC-05479","date":"2021","year":2021,"title":"Anthony Bourdain deepfake voice results in ethics backlash","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Focus Features; Morgan Neville","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/anthony-bourdain-voice-deepfake"},{"id":"INC-05507","date":"2021","year":2021,"title":"Black teenager misidentified, barred by Livonia skating rink AI system","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Riverside Arena, Livonia, Michigan","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/livonia-skating-rink-misidentifies-black-teenager"},{"id":"INC-06120","date":"2021","year":2021,"title":"TikTok uses Bev Standing voice wiithout consent to train AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-uses-bev-standing-voice-to-train-ai"},{"id":"INC-07573","date":"2015","year":2015,"title":"Reddit replaces opaque shadowbanning system with account suspensions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Reddit","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/reddit-shadowbanning"},{"id":"INC-07592","date":"2014","year":2014,"title":"Automated pricing glitch on Amazon UK causes retailers' losses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Repricer Express","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-automated-pricing-glitch"},{"id":"INC-05650","date":"2021","year":2021,"title":"Foodinho fined for breaching privacy and labour laws in Italy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Glovo/Foodinho","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/foodinho-fined-for-breaching-privacy-and-labour-laws-in-italy"},{"id":"INC-05712","date":"2021","year":2021,"title":"Instagram offers Xanax, exctasy, opioid 'pipeline' to kids","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-offers-xanax-exctasy-opioid-pipeline-to-kids"},{"id":"INC-05450","date":"2021","year":2021,"title":"Amazon accused of \"unfairly\" firing Flex delivery drivers by algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-flex-algorithm-delivery-driver-firings"},{"id":"INC-05501","date":"2021","year":2021,"title":"Beijing runs fake influence campaign saying life in Xinjiang is happy","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Government of China","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/beijing-uyghur-fake-influence-campaign"},{"id":"INC-06082","date":"2021","year":2021,"title":"Tesla China recalls cars over Autopilot Cruise Control activation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-autopilot-cruise-control-activation"},{"id":"INC-06110","date":"2021","year":2021,"title":"TikTok fails to stop beheading video going viral","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-beheading-video-splicing"},{"id":"INC-07281","date":"2018","year":2018,"title":"CaliBurger Flippy robot fired after one day","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Miso Robotics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/caliburger-flippy-robot"},{"id":"INC-06211","date":"2020","year":2020,"title":"Aespa virtual members raise robot sexualisation concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"SM Entertainment","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/aespa-virtual-k-pop"},{"id":"INC-05674","date":"2021","year":2021,"title":"Google patient data deal with HCA Healthcare accused of violating patient privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/googlehca-healthcare-patient-data-sharing"},{"id":"INC-05817","date":"2021","year":2021,"title":"RCMP violated Canadians' privacy using Clearview AI facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clearview AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rcmp-ai-facial-recognition-surveillance"},{"id":"INC-05826","date":"2021","year":2021,"title":"Researchers highlight Epic Deterioration Index lack of transparency","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Epic Systems Corporation","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/epic-systems-epic-deterioration-index"},{"id":"INC-06160","date":"2021","year":2021,"title":"US CPB covertly uses facial recognition to process asylum seekers","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Customs and Border Protection","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cpb-one-asylum-seeker-app-privacy"},{"id":"INC-05762","date":"2021","year":2021,"title":"Microsoft accused of censoring Tiananmen Square 'tank man'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-bing-tiananmen-square-tank-man"},{"id":"INC-06749","date":"2020","year":2020,"title":"Kargu-2 fully autonomous drone attacks Libyan armed forces","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"STM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kargu-2-autonomous-drone-attack"},{"id":"INC-07272","date":"2018","year":2018,"title":"Apple facial recognition system misidentifies 'shoplifter' Ousmane Bah","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Security Industry Specialists (SIS)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/applesis-misidentification-wrongful-arrest"},{"id":"INC-05743","date":"2021","year":2021,"title":"Lemonade use of emotion recognition to assess insurance claims prompts backlash","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Lemonade Inc","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lemonade-non-verbal-assessments"},{"id":"INC-05870","date":"2021","year":2021,"title":"Study: Large language models can mimic QAnon","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-3-mimics-qanon"},{"id":"INC-05442","date":"2021","year":2021,"title":"AI-powered Uyghur emotion detection system prompts rights concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Zhejiang Dahua Technology; China Electronics Technology Group/Hikvision","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uyghur-emotion-detection-testing"},{"id":"INC-05748","date":"2021","year":2021,"title":"Manipulation of Cambodia torture victims' photos draws backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Matt Loughrey","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cambodia-torture-victims-photo-manipulation"},{"id":"INC-05872","date":"2021","year":2021,"title":"Study: Top social media platforms 'unsafe' for LGBTQ users","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook; TikTok; xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktokinstagramfacebook-lgbtq-discrimination"},{"id":"INC-05142","date":"2022","year":2022,"title":"Italian car insurers discriminate using place of birth","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Linear; Genertel; Mps; Quixa; Con.Te","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/italian-car-insurance-birthplace-discrimination"},{"id":"INC-07328","date":"2018","year":2018,"title":"Sao Paulo Metro ordered to stop using platform door facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"AdMobilize","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sao-paulo-metro-advertising-facial-biometrics"},{"id":"INC-07321","date":"2018","year":2018,"title":"New Zealand immigration overstayer predictions fuel racial profiling fears","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Immigration New Zealand```","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/new-zealand-immigration-overstayer-predictions"},{"id":"INC-05867","date":"2021","year":2021,"title":"Study: Airbnb Smart Pricing algorithm exacerbates racial inequality","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Airbnb","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/airbnb-smart-pricing-algorithm-racism"},{"id":"INC-05820","date":"2021","year":2021,"title":"Rear seat driver abuses Tesla Autopilot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/driver-abuses-tesla-autopilot-by-sitting-in-rear-seat"},{"id":"INC-05524","date":"2021","year":2021,"title":"China runs co-ordinated fake diplomatic Twitter influence campaign","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook; xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/china-diplomatic-fake-influence-campaign"},{"id":"INC-07249","date":"2019","year":2019,"title":"TikTok UK fined for misusing childrens' data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-uk-misuses-childrens-data"},{"id":"INC-06552","date":"2020","year":2020,"title":"Facebook 'quickly' approves COVID-19 misinformation ads","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-covid-19-misinformation-ad-approvals"},{"id":"INC-05561","date":"2021","year":2021,"title":"Dartmouth College medical school accuses students of remote exam cheating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dartmouth College","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dartmouth-medical-school-remote-exam-cheating"},{"id":"INC-05612","date":"2021","year":2021,"title":"Facebook enables advertisers to target people interested in pseudoscience","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-pseudoscience-ad-targeting"},{"id":"INC-05382","date":"2021","year":2021,"title":"AI Dungeon offensive speech filter upgrade generates child porn","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Latitude; OpenAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-dungeon-offensive-speech-filter"},{"id":"INC-06195","date":"2021","year":2021,"title":"YouTube ads hate speech blocklist is 'inconsistent' and barely applied","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"YouTube","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-ads-hate-speech-blocklist"},{"id":"INC-07158","date":"2019","year":2019,"title":"Amazon Alexa reinforces female stereotyping","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-reinforces-gender-bias"},{"id":"INC-05598","date":"2021","year":2021,"title":"Facebook #resignmodi block prompts censorship accusations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-blocks-resignmodi-hashtag"},{"id":"INC-05744","date":"2021","year":2021,"title":"Leonid Volkov' deepfake video calls target European politicians","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Russia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/leonid-volkov-deepfake-video-calls"},{"id":"INC-07010","date":"2020","year":2020,"title":"TUI airline classifies women as children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"TUI Group/TUI Airways","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tui-airline-classifies-women-as-children"},{"id":"INC-06077","date":"2021","year":2021,"title":"Tesla Autopilot is 'easily' tricked into driverless driving","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-autopilot-tricked-into-driverless-driving"},{"id":"INC-05866","date":"2021","year":2021,"title":"Study: AI satellite images can easily create fake news","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Zhao, B., Zhang, Z., Xu, C., Sun, Y., Deng, C.","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-satellite-location-spoofing"},{"id":"INC-04620","date":"2023","year":2023,"title":"Designers accuse Shein of using AI to recreate their work","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Shein","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/designers-sue-shein-for-using-ai-to-recreate-their-work"},{"id":"INC-06979","date":"2020","year":2020,"title":"Tesla on Autopilot kills Norwegian truck driver standing on road","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-kills-truck-driver-pedestrian"},{"id":"INC-07340","date":"2018","year":2018,"title":"Tesla on Autopilot kills Kanagawa pedestrian","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-x-kills-pedestrian"},{"id":"INC-06075","date":"2021","year":2021,"title":"Tesla Autopilot confused by billboard","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-autopilot-confused-by-billboard"},{"id":"INC-06088","date":"2021","year":2021,"title":"Tesla Model S crashes into tree, kills two passengers","severity":"Critical","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-crashes-into-tree-kills-two-passengers"},{"id":"INC-06094","date":"2021","year":2021,"title":"Tesla on Autopilot crashes into parked police car outside Lansing, Michigan","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-crashes-into-parked-police-car"},{"id":"INC-06091","date":"2021","year":2021,"title":"Tesla Model Y crashes into tractor-trailer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-y-crashes-into-tractor-trailer"},{"id":"INC-05569","date":"2021","year":2021,"title":"DeepScore trustworthiness assessments accused of bias","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"DeepScore","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepscore-trustworthiness-assessments"},{"id":"INC-05121","date":"2022","year":2022,"title":"GitHub Copilot accused of copying code from developers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"GitHub; Microsoft; OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/github-copilot-sued-for-copying-code-from-developers"},{"id":"INC-04684","date":"2023","year":2023,"title":"iFlyTek generates essay criticising Chairman Mao","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"iFlytek","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/iflytek-generates-essay-criticising-chairman-mao"},{"id":"INC-07662","date":"2010","year":2010,"title":"Algorithmic trading causes US financial markets \"flash crash\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Navinder Singh Saroa","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/2010-us-financial-markets-flash-crash"},{"id":"INC-05073","date":"2022","year":2022,"title":"Cleveland State University bedroom scans ruled 'unconstitutional'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Honorlock; Respondus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cleveland-state-university-online-proctor-room-scanning"},{"id":"INC-05807","date":"2021","year":2021,"title":"Proctorio uses 'racist' algorithms to detect students' faces","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Proctorio","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/proctorio-racist-facial-detection"},{"id":"INC-05370","date":"2021","year":2021,"title":"4 Little Trees (4LT) student emotion recognition system prompts criticism","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Find Solution AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/4-little-trees-4lt"},{"id":"INC-05794","date":"2021","year":2021,"title":"Pennslyvania woman allegedly frames daughter's rivals using deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Education; Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/raffaela-spone-deepfake-reputational-attacks"},{"id":"INC-05571","date":"2021","year":2021,"title":"Delhi government schools accused of facial recognition 'privacy abuse'","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Government of Delhi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/delhi-government-schools-facial-recognition"},{"id":"INC-05811","date":"2021","year":2021,"title":"QCovid risk prediction algorithm wrongly identifies high-risk patients","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"University of Oxford; NHS Digital","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nhs-qcovid-risk-prediction-algorithm"},{"id":"INC-05608","date":"2021","year":2021,"title":"Facebook content moderation system mistakenly flags French town \"Bitche\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-ville-de-bitche"},{"id":"INC-05566","date":"2021","year":2021,"title":"Deepfake' Burma minister confesses to Aung San Suu Kyi corruption","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government of Myanmar;","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/myanmar-minister-deepfake-corruption-confession"},{"id":"INC-07503","date":"2016","year":2016,"title":"Ji-Chang Son Tesla Model X suddenly accelerates, injuring passenger","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/son-ji-chang-tesla-model-x-sudden-acceleration"},{"id":"INC-05366","date":"2022","year":2022,"title":"Zhengzhou authorities turn bank protestors' health codes red","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba/Alipay; Tencent/WeChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zhengzhou-authorities-turn-bank-protestors-health-codes-red"},{"id":"INC-05860","date":"2021","year":2021,"title":"Spotify plan to use emotion recognition deemed 'manipulative'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Spotify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/spotify-emotion-recognition"},{"id":"INC-05737","date":"2021","year":2021,"title":"Kim Kwang-Seok voice recreated for TV show","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Supertone","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kim-kwang-seok-voice-recreation"},{"id":"INC-05570","date":"2021","year":2021,"title":"DeepTomCruise fake videos impersonate actor on TikTok","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chris Ume; Miles Fisher","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tom-cruise-deepfakes"},{"id":"INC-05775","date":"2021","year":2021,"title":"MyHeritage Deep Nostalgia deceased animations","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"D-ID; MyHeritage","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/myheritage-deep-nostalgia"},{"id":"INC-05559","date":"2021","year":2021,"title":"Cruzcampo Lola Flores deepfake ad draws ethics complaints","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"WPP/Ogilvy; Metropolitana; DeepFaceLab","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cruzcampo-lola-flores-deepfake-ad"},{"id":"INC-05509","date":"2021","year":2021,"title":"BMW, Kohler, MaxMara covertly used facial recognition to track Chinese shoppers","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Kohler; BMW; MaxMara","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kohler-bmw-maxmara-china-facial-recognition"},{"id":"INC-05202","date":"2022","year":2022,"title":"State Farm automated fraud detection discriminates against Black homeowners","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"State Farm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/state-farm-automated-fraud-detection-discriminates-against-black-homeowners"},{"id":"INC-05472","date":"2021","year":2021,"title":"Amazon, Waterstones algorithms promote vaccine misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon; Foyles; Waterstones","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-algorithms-promote-vaccine-misinformation"},{"id":"INC-05562","date":"2021","year":2021,"title":"Deepfake 'Amazon FC Ambassadors' sow confusion","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Transport/logistics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-amazon-fc-ambassadors-sow-confusion"},{"id":"INC-05140","date":"2022","year":2022,"title":"Israel AI robot machine guns fire tear gas at Palestinian protestors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Smart Shooter","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/israel-ai-robot-machine-guns-fire-tear-gas-at-palestinian-protestors"},{"id":"INC-05622","date":"2021","year":2021,"title":"Facebook US political group recommendations volte-face","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-political-group-recommendations"},{"id":"INC-05616","date":"2021","year":2021,"title":"Facebook political ad ban drives Georgia political partisanship","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-georgia-political-partisanship"},{"id":"INC-05600","date":"2021","year":2021,"title":"Facebook advertises military gear during US attempted coup","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-military-gear-advertising"},{"id":"INC-05604","date":"2021","year":2021,"title":"Facebook algorithm blocks images of 'sexual' cows, office buildings","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-blocks-sexual-cows"},{"id":"INC-05606","date":"2021","year":2021,"title":"Facebook Australia algorithm blocks news, civil society organisations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-australia-news-civil-society-blocks"},{"id":"INC-05673","date":"2021","year":2021,"title":"Google Nest Hub 2 sleep sensing data uses","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Google/Nest","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-nest-hub-2-sleep-tracking"},{"id":"INC-05694","date":"2021","year":2021,"title":"Huawei discovered running deepfake campaign against Belgian government","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Huawei","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/huawei-5g-influence-campaign"},{"id":"INC-05697","date":"2021","year":2021,"title":"IBM Project Debater prompts manipulation, accountability concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"IBM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ibm-project-debater"},{"id":"INC-05767","date":"2021","year":2021,"title":"Microsoft reincarnation chatbot raises legal, ethical concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-reincarnation-chatbot"},{"id":"INC-05549","date":"2021","year":2021,"title":"CLIP computer vision system fooled by handwritten notes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/clip-computer-vision-system-fooled-by-handwritten-notes"},{"id":"INC-05869","date":"2021","year":2021,"title":"Study: GPT-3 associates Muslims with violence","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-3-anti-muslim-bias"},{"id":"INC-07231","date":"2019","year":2019,"title":"Student uses GPT-2 to dupe Medicaid","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-2-dupes-medicaid"},{"id":"INC-05848","date":"2021","year":2021,"title":"SimCLR, iGPT image generation systems found to contain racial bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google; OpenAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/simclr-igpt-racial-bias-stereotyping"},{"id":"INC-05741","date":"2021","year":2021,"title":"Lee Luda AI chatbot spouts offensive comments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Scatter Lab","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lee-luda-chatbot"},{"id":"INC-05878","date":"2021","year":2021,"title":"Teleperformance AI employee monitoring scheme prompts backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Teleperformance","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/teleperformancetp-observer-employee-monitoring"},{"id":"INC-06111","date":"2021","year":2021,"title":"TikTok fined for selling personal data of US users without consent","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-personal-data-harvesting-sales"},{"id":"INC-06174","date":"2021","year":2021,"title":"Verkada facial recognition camera hack prompts security, ethics concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Verkada","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/verkada-surveillance-cameras-data-breach"},{"id":"INC-05453","date":"2021","year":2021,"title":"Amazon Driveri delivery driver monitoring slammed as inaccurate, unfair","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Netradyne","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-delivery-driver-safety-cameras"},{"id":"INC-07169","date":"2019","year":2019,"title":"Chinese motorist fined for scratching his face whilst driving","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"DiDi Chuxing; Shandong University","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-motorist-fined-for-scratching-his-face-whilst-driving"},{"id":"INC-05573","date":"2021","year":2021,"title":"Deliveroo Italy algorithm ruled to discriminate against \"reliable\" riders","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Deliveroo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deliveroo-italy-rider-shift-management-algorithm"},{"id":"INC-05574","date":"2021","year":2021,"title":"Deliveroo UK riders protest poor safety and pay","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Deliveroo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deliveroo-uk-rider-management-algorithm"},{"id":"INC-05579","date":"2021","year":2021,"title":"Drivers reject Doordash order matching algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Doordash","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/doordash-order-matching-algorithm"},{"id":"INC-05813","date":"2021","year":2021,"title":"Racist' Uber Eats facial ID check gets Pa Edrissa Manjang fired","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/racist-uber-eats-facial-id-check-gets-pa-edrissa-manjang-fired"},{"id":"INC-07356","date":"2018","year":2018,"title":"Waze directs tourists to drive into Vermont lake","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waze-directs-tourists-to-drive-into-vermont-lake"},{"id":"INC-06967","date":"2020","year":2020,"title":"Tesla driver charged with dangerous driving after sleeping on Alberta highway with Autopilot engaged","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sleeping-driver-speeds-on-highway-with-autopilot-switched-on"},{"id":"INC-06977","date":"2020","year":2020,"title":"Tesla Model X crashes into wall, killing passenger","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-x-crashes-into-wall-killing-passenger"},{"id":"INC-06974","date":"2020","year":2020,"title":"Tesla Model 3 crashes into overturned truck","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-crashes-into-overturned-truck-in-the-middle-of-the-highway"},{"id":"INC-06976","date":"2020","year":2020,"title":"Tesla Model S driver watches movie, crashes into police car","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-driver-watches-movie-crashes-into-police-car"},{"id":"INC-06965","date":"2020","year":2020,"title":"Tesla Autopilot tricked into accelerating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-autopilot-tricked-into-accelerating"},{"id":"INC-06982","date":"2020","year":2020,"title":"Tesla tricked into reacting to false lane markers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/allstate-car-insurance-suckers-list-overcharging"},{"id":"INC-07673","date":"2009","year":2009,"title":"Pedestrian following Google Maps hit by motorcyclist","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pedestrian-following-google-maps-hit-by-motorcyclist"},{"id":"INC-06948","date":"2020","year":2020,"title":"Teenager freezes to death after Google Maps provides wrong turn","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/teenager-freezes-to-death-after-google-maps-provides-wrong-turn"},{"id":"INC-06393","date":"2020","year":2020,"title":"Barclays employee 'spyware' trial halted after backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Sapience Analytics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/barclays-employee-spyware-monitoring"},{"id":"INC-06804","date":"2020","year":2020,"title":"Nanning real estate company customers defrauded using facial recognition","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Alipay","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nanning-real-estate-sales-office-facial-recognition"},{"id":"INC-06674","date":"2020","year":2020,"title":"GPT-3 advises patient to kill themselves","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-3-advises-patient-to-kill-themselves"},{"id":"INC-06932","date":"2020","year":2020,"title":"Student GPT-3 fake blog posts pass as human","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/students-gpt-3-fake-blog-posts-pass-as-human"},{"id":"INC-06902","date":"2020","year":2020,"title":"Scammers bypass WePay facial recognition security using gifs","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Tencent/WeChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/scammers-bypass-wechat-pay-facial-recognition-security-using-gifs"},{"id":"INC-06933","date":"2020","year":2020,"title":"Student reading aloud during remote exam is falsely accused of cheating","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Meazure Learning/ProctorU","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/student-reading-aloud-during-exam-is-falsely-accused-of-cheating"},{"id":"INC-06781","date":"2020","year":2020,"title":"Michigan online bar exam cyberattack raises privacy concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Turnitin/ExamSoft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/michigan-online-bar-exam-cyberattack-raises-privacy-concerns"},{"id":"INC-04967","date":"2023","year":2023,"title":"UBC academic, students accuse Proctorio of privacy abuse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Proctorio","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ubc-academic-students-accuse-proctorio-of-privacy-abuse"},{"id":"INC-06862","date":"2020","year":2020,"title":"Proctortrack data breach raises privacy concerns","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Verificient Technologies","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/proctortrack-data-breach-raises-privacy-concerns"},{"id":"INC-06824","date":"2020","year":2020,"title":"Ofqal algorithm skews student grade predictions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ofqual","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ofqal-algorithm-skews-student-grade-predictions"},{"id":"INC-06231","date":"2020","year":2020,"title":"AI influence campaign promotes Beijing interests in SE Asia","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Government of China","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-influence-campaign-promotes-beijing-interests-in-se-asia"},{"id":"INC-06680","date":"2020","year":2020,"title":"Hangzhou 'Personal health code' scoring expansion triggers backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba/DingTalk/Alipay; Tencent/WeChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hangzhou-personal-health-code-scoring-system"},{"id":"INC-07032","date":"2020","year":2020,"title":"Tyndall Air Force base robot patrol dogs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ghost Robotics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tyndall-air-force-base-robot-patrol-dogs"},{"id":"INC-06429","date":"2020","year":2020,"title":"Child sexual abuse investigation deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Govt - police","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/child-sexual-abuse-investigation-deepfakes"},{"id":"INC-06411","date":"2020","year":2020,"title":"Buenos Aires government uses live facial recognition to identify child criminals","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Danaide/NtechLab","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/buenos-aires-identifies-child-criminals-using-live-facial-recognition"},{"id":"INC-06993","date":"2020","year":2020,"title":"TikTok Netherlands fined for violating child privacy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"TikTok","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tiktok-netherlands-fined-for-violating-child-privacy"},{"id":"INC-06834","date":"2020","year":2020,"title":"Pasco County police predictive policing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pasco County Sheriff's Department","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pasco-county-police-predictive-policing"},{"id":"INC-06882","date":"2020","year":2020,"title":"Robot falls down shoping mall escalator, knocks over passengers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Fuzhou Zhongfang Wanbaocheng Shopping Mall","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-falls-down-fuzhou-shopping-mall-escalator-knocks-over-shoppers"},{"id":"INC-06818","date":"2020","year":2020,"title":"Nijeer Parks facial recognition wrongful arrest","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clearview AI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/nijeer-parks-facial-recognition-wrongful-arrest"},{"id":"INC-06418","date":"2020","year":2020,"title":"California police licence plate data sharing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"DRN; Motorola Solutions/Vigilant Solutions","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/california-police-licence-plate-data-sharing"},{"id":"INC-06509","date":"2020","year":2020,"title":"DGFiP tax fraud detection","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Direction Générale des Finances Publiques","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/dgfip-tax-fraud-detection"},{"id":"INC-06218","date":"2020","year":2020,"title":"AI benefits for medical imaging 'exaggerated'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Health","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-benefits-for-medical-imaging-exaggerated"},{"id":"INC-06346","date":"2020","year":2020,"title":"Amazon Halo Band slammed as highly \"invasive\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-halo-band-slammed-as-highly-invasive"},{"id":"INC-05061","date":"2022","year":2022,"title":"BlenderBot 3 makes offensive, inaccurate and bizarre statements","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/blenderbot-3-makes-offensive-inaccurate-and-bizarre-statements"},{"id":"INC-06867","date":"2020","year":2020,"title":"Queen Elizabeth II impersonated in deepfake Christmas message","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Channel 4; Framestore","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-queens-christmas-message"},{"id":"INC-07111","date":"2020","year":2020,"title":"Vocal Synthesis Jay-Z AI voice impersonations","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Vocal Synthesis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/vocal-synthesis-jay-z-ai-voice-impersonations"},{"id":"INC-06773","date":"2020","year":2020,"title":"MBN deepfake 24/7 news anchor seen to threaten jobs","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"DeepBrain/Money Brain","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mbn-deepfake-247-news-anchor"},{"id":"INC-06853","date":"2020","year":2020,"title":"PornHub banner appears on CNN Magic Wall","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"CNN","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/pornhub-banner-appears-on-cnn-magic-wall"},{"id":"INC-06511","date":"2020","year":2020,"title":"Donald Trump joins RT as anchor deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"RT News","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/donald-trump-joins-rt-as-anchor-deepfake"},{"id":"INC-07292","date":"2018","year":2018,"title":"Deepfake Donald Trump calls for climate agreement exit","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Vooruit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-donald-trump-calls-for-climate-agreement-exit"},{"id":"INC-06502","date":"2020","year":2020,"title":"Deepfake Belgium PM links COVID-19 with climate crisis","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Extinction Rebellion Belgium","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-belgium-pm-links-covid-19-with-climate-crisis"},{"id":"INC-06504","date":"2020","year":2020,"title":"Deepfake Joe Biden threatens to defund US police","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Steve Scalise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/joe-biden-police-defunding-deepfake-interview"},{"id":"INC-06772","date":"2020","year":2020,"title":"Matt Gaetz disinfo deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Phil Ehr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/matt-gaetz-disinfo-deepfake"},{"id":"INC-06865","date":"2020","year":2020,"title":"Putin/Kim Jong-un fake political ad campaign","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"RepresentUs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/putin-kim-jong-un-fake-political-ad-campaign"},{"id":"INC-06610","date":"2020","year":2020,"title":"Fake middle-east journalists hoodwink media sites","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-middle-east-journalists-hoodwink-media-sites"},{"id":"INC-06768","date":"2020","year":2020,"title":"Malaysia minister discourages Singaporean visits deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/malaysia-minister-discourages-singaporeans-from-visiting-malaysia"},{"id":"INC-06611","date":"2020","year":2020,"title":"Fake security analyst peddles Hunter Biden intelligence document","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Apple Daily; Christopher Balding","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/fake-security-analyst-peddles-hunter-biden-intelligence-document"},{"id":"INC-07030","date":"2020","year":2020,"title":"Twitter verifies fake Congressional candidate","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"xAI; Ballotpedia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/twitter-verifies-fake-congressional-candidate"},{"id":"INC-06770","date":"2020","year":2020,"title":"Manoj Tiwari attacks political adversary with deepfake Haryanvi broadcast","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"The Ideaz Factory","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/manoj-tiwari-deepfake-haryanvi-broadcast"},{"id":"INC-06485","date":"2020","year":2020,"title":"COVID-19 misinfo tweet bots","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/covid-19-misinfo-tweet-bots"},{"id":"INC-06472","date":"2020","year":2020,"title":"Climate change denialism tweet bots","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/climate-change-denialism-tweet-bots"},{"id":"INC-06505","date":"2020","year":2020,"title":"Deepfake romance scammer swindles California widow","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Banking/financial services; Govt - police","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-romance-scammer-swindles-california-widow"},{"id":"INC-06349","date":"2020","year":2020,"title":"Amazon serious injuries rise with warehouse robots","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-serious-injuries-rise-with-warehouse-robots"},{"id":"INC-06345","date":"2020","year":2020,"title":"Amazon COVID-19 Distance Assistant prompts privacy concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-covid-19-distance-assistant-prompts-privacy-concerns"},{"id":"INC-07135","date":"2020","year":2020,"title":"YouPlus 'AI' intelligence engine investor fraud","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"YouPlus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youplus-investor-fraudd"},{"id":"INC-06931","date":"2020","year":2020,"title":"Stochastic Parrots study questions large language models","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/stochastic-parrots-study-questions-large-language-model-size"},{"id":"INC-06495","date":"2020","year":2020,"title":"Deepfake \"student\" accuses couple of being terrorist sympathisers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NSO Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-student-accuses-couple-of-being-terrorist-sympathisers"},{"id":"INC-06200","date":"2020","year":2020,"title":"\"Robodebt\" system falsely accused Australians of welfare debt","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Services Australia","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/australia-scraps-robodebt-welfare-debt-recovery-scheme"},{"id":"INC-07138","date":"2020","year":2020,"title":"YouTube promotes, profits from climate change denialism","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-promotes-profits-from-climate-change-denialism"},{"id":"INC-06718","date":"2020","year":2020,"title":"Instagram removes images of black, plus-size British model","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-removes-images-of-black-plus-size-british-model"},{"id":"INC-06941","date":"2020","year":2020,"title":"Study: Instagram prioritises \"scantily clad\" photos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-instagram-prioritises-scantily-clad-photos"},{"id":"INC-06726","date":"2020","year":2020,"title":"ISIS successfully evades Facebook detection","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/isis-successfully-evades-facebook-detection"},{"id":"INC-07219","date":"2019","year":2019,"title":"Poland forced to scrap unemployed worker profiling system","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ministry of Family, Labor and Social Policy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/poland-forced-to-scrap-unemployed-worker-profiling-system"},{"id":"INC-06554","date":"2020","year":2020,"title":"Facebook actively promotes holocaust denial","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-actively-promotes-holocaust-denial"},{"id":"INC-06551","date":"2020","year":2020,"title":"Facebook \"censors\" Kisan Ekta Morcha farmers' protest","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-censors-kisan-ekta-morcha-farmers-protest"},{"id":"INC-06940","date":"2020","year":2020,"title":"Study: Facebook fails to label 42 percent of debunked political misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-fails-to-label-42-of-debunked-political-misinformation"},{"id":"INC-06553","date":"2020","year":2020,"title":"Facebook accused of hampering DIY COVID-19 mask makers","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-hampers-diy-covid-19-mask-makers"},{"id":"INC-06559","date":"2020","year":2020,"title":"Facebook blocks onion seed ad as 'overtly sexual'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-blocks-onion-seed-ad-as-overtly-sexual"},{"id":"INC-07107","date":"2020","year":2020,"title":"Verkada employees use facial recognition to surveil colleagues","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Verkada","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/verkada-employees-use-facial-recognition-to-surveil-colleagues"},{"id":"INC-06792","date":"2020","year":2020,"title":"Microsoft's replacement of journalists with AI prompts industry fears","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft/MSN","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-replaces-journalists-with-ai"},{"id":"INC-06776","date":"2020","year":2020,"title":"Meituan, Eleme food delivery algorithms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meituan; Eleme","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/meituan-eleme-food-delivery-algorithms"},{"id":"INC-07235","date":"2019","year":2019,"title":"Tesla Model 3 crashes into 18-wheeler truck, kills owner","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-crashes-into-18-wheeler-truck-kills-owner"},{"id":"INC-07172","date":"2019","year":2019,"title":"Driverless Tesla Model 3 negotiates parking lot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/driverless-tesla-model-3-negotiates-parking-lot"},{"id":"INC-07237","date":"2019","year":2019,"title":"Tesla Model 3 hits tow truck, explodes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-hits-tow-truck-explodes"},{"id":"INC-07240","date":"2019","year":2019,"title":"Tesla Model S tricked into veering into wrong lane","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-tricked-into-veering-into-wrong-lane"},{"id":"INC-07212","date":"2019","year":2019,"title":"Mobileye 630 PRO tricked by drones, projectors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Mobileye","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mobileye-630-pro-tricked-by-drones-projectors"},{"id":"INC-06202","date":"2020","year":2020,"title":"3D masks fool payment, airport facial recognition systems","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Huawei; LG; OnePlus; Samsung","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/3d-masks-fool-payment-airport-facial-recognition-systems"},{"id":"INC-07239","date":"2019","year":2019,"title":"Tesla Model S runs red light, kills two","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-runs-red-light-kills-two"},{"id":"INC-07185","date":"2019","year":2019,"title":"Generated Photos 'infinite diversity' face collection prompts controversy","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Icons8; Prototypr.io","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/generated-photos-infinite-diversity-face-collection"},{"id":"INC-07400","date":"2017","year":2017,"title":"Gangs Matrix data leak puts young Londoners in \"serious danger\"","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Metropolitan Police Service (MPS)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gangs-matrix-data-leak-puts-young-londoners-in-serious-danger"},{"id":"INC-07202","date":"2019","year":2019,"title":"Jordan Peterson fake voice generator makes offensive remarks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Chris Vigorito","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/jordan-peterson-fake-voice-generator"},{"id":"INC-07252","date":"2019","year":2019,"title":"Victoria schools student attendance facial recognition trial prompts backlash","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"LoopSafe/LoopLearn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/victoria-schools-looplearn-facial-recognition"},{"id":"INC-07236","date":"2019","year":2019,"title":"Tesla Model 3 crashes into Ford, kills passenger","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-3-rear-ends-ford-kills-passenger"},{"id":"INC-06675","date":"2020","year":2020,"title":"GPT-3 bot posts Reddit comments unnoticed","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gpt-3-bot-posts-reddit-comments-unnoticed"},{"id":"INC-07205","date":"2019","year":2019,"title":"LinkedIn political espionage","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"LinkedIn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/linkedin-political-espionage"},{"id":"INC-07222","date":"2019","year":2019,"title":"Project Nightingale patient data sharing slammed for violating privacy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Ascension; Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/project-nightingale-health-data-sharing-slammed-for-poor-privacy"},{"id":"INC-07209","date":"2019","year":2019,"title":"Matteo Renzi off-air interview comments","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Canale 5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/matteo-renzi-off-air-interview-comments"},{"id":"INC-07221","date":"2019","year":2019,"title":"President Balsonaro/Chapulin Colorado deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bruno Sartori","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/president-balsonaro-chapulin-colorado-deepfake"},{"id":"INC-07149","date":"2019","year":2019,"title":"Adidas/Arsenal #DaretoCreate campaign","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Arsenal FC; Adidas","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/adidas-arsenal-daretocreate-campaign"},{"id":"INC-07175","date":"2019","year":2019,"title":"Epoch Media Group pro-Trump disinfo campaign","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Epoch Media Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/epoch-media-group-pro-trump-disinfo-campaign"},{"id":"INC-07208","date":"2019","year":2019,"title":"Mark Zuckerberg 'Spectre' data sharing deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bill Posters; Daniel Howe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mark-zuckerberg-spectre-data-sharing-deepfake"},{"id":"INC-07381","date":"2017","year":2017,"title":"Barcelona robot brothel triggers local backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lumi Dolls","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/barcelona-robot-brothel-triggers-local-backlash"},{"id":"INC-07157","date":"2019","year":2019,"title":"Amazon Alexa records children's voices without consent","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-records-childrens-voices-without-consent"},{"id":"INC-07207","date":"2019","year":2019,"title":"Malaysia minister, aide gay sex 'deepfake'","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/malaysia-minister-aide-gay-sex-deepfake"},{"id":"INC-07220","date":"2019","year":2019,"title":"President Ali Bongo health recovery video accused of being a deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Politics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/president-ali-bongo-recovery-deepfake-broadcast"},{"id":"INC-07687","date":"2008","year":2008,"title":"Publishers withdraw over 120 gibberish AI-generated papers","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"IEEE; Springer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/publishers-withdraw-over-120-gibberish-ai-generated-papers"},{"id":"INC-07259","date":"2019","year":2019,"title":"YouTube recommendation algorithm radicalisation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-recommendation-algorithm-radicalisation"},{"id":"INC-07258","date":"2019","year":2019,"title":"YouTube paedophilia monetisation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-paedophilia-monetisation"},{"id":"INC-07176","date":"2019","year":2019,"title":"Facebook admits it secretly listened to users' Messenger calls","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-admits-it-listened-to-users-messenger-calls"},{"id":"INC-07177","date":"2019","year":2019,"title":"Facebook fails to manage Christchurch mosque shooting livestreaming","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-fails-to-manage-christchurch-mosque-shooting-livestreaming"},{"id":"INC-07198","date":"2019","year":2019,"title":"Instagram exacerbates eating disorders, self-harm","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/instagram-exacerbates-eating-disorders-self-harm"},{"id":"INC-04708","date":"2023","year":2023,"title":"Joe Rogan libido booster Alpha Grind deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Health","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/joe-rogan-libido-booster-alpha-grind-ad-deepfake"},{"id":"INC-07262","date":"2019","year":2019,"title":"ZAO face swapping app raises privacy, fraud concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Changsha Shenduronghe Network Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/zao-face-swap-app"},{"id":"INC-07156","date":"2019","year":2019,"title":"Amazon accused of promoting anti-vaccine propaganda","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-accused-of-promoting-anti-vaccine-propaganda"},{"id":"INC-07159","date":"2019","year":2019,"title":"Amazon Echo Dot Kids remembers kids' conversations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-echo-dot-kids-remembers-kids-conversations"},{"id":"INC-07225","date":"2019","year":2019,"title":"Researchers dispute OpenAI's claim that robot solved Rubik's cube","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/researchers-dispute-openais-claim-that-robot-solved-rubiks-cube"},{"id":"INC-07226","date":"2019","year":2019,"title":"SenseNets facial recognition data breach reveals Beijing Uyghur surveillance","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Netposa Technologies/SenseNets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sensenets-data-breach-reveals-beijing-uyghur-surveillance"},{"id":"INC-07196","date":"2019","year":2019,"title":"Hive Box smart lockers hacked by primary school kids","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Hive Box","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hive-box-smart-lockers-hacked-by-primary-school-kids"},{"id":"INC-07341","date":"2018","year":2018,"title":"Tesla on Autopilot veers off highway into concrete barrier, kills driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-x-veers-off-highway-into-concrete-barrier-killing-driver"},{"id":"INC-07353","date":"2018","year":2018,"title":"Uber self-driving car kills Arizona pedestrian","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-self-driving-car-pedestrian-fatality"},{"id":"INC-07305","date":"2018","year":2018,"title":"GM Cruise fails to yield to pedestrian at crosswalk","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Motors/Cruise LLC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gm-cruise-fails-to-yield-to-pedestrian-at-crosswalk"},{"id":"INC-07586","date":"2015","year":2015,"title":"Wells Fargo software error leads to hundreds of wrongful home foreclosures","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Wells Fargo","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wells-fargo-software-error-leads-to-hundreds-of-wrongful-home-foreclosures"},{"id":"INC-07363","date":"2017","year":2017,"title":"AI automated trades cost investor USD 20 million","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tyndaris SAM; Raffaele Costa","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ai-automated-trades-cost-investor-usd-20-million"},{"id":"INC-07283","date":"2018","year":2018,"title":"Chinese schools 'intelligent uniform' student monitoring prompts backlash","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"Guanyu Technology","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-schools-intelligent-uniform-monitoring"},{"id":"INC-07309","date":"2018","year":2018,"title":"Hangzhou No. 11 Middle School student surveillance","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"China Electronics Technology Group/Hikvision","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/hangzhou-no-11-middle-school-student-surveillance"},{"id":"INC-07327","date":"2018","year":2018,"title":"Robot-children influence","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Research/academia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-children-influence"},{"id":"INC-07320","date":"2018","year":2018,"title":"MIT scientists' psychopathic AI paints dark future","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"MIT","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/mit-scientists-psychopathic-ai-paints-dark-future"},{"id":"INC-07316","date":"2018","year":2018,"title":"Kiwibot food delivery robot catches fire","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Kiwibot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kiwibot-food-delivery-robot-catches-fire"},{"id":"INC-05102","date":"2022","year":2022,"title":"Facebook approves ads inciting violence against the Rohingya","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-approves-ads-inciting-violence-against-the-rohingya"},{"id":"INC-07282","date":"2018","year":2018,"title":"Chinese police facial recognition sunglasses prompt privacy, civil liberties concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"LLVision Technology","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chinese-police-facial-recognition-sunglasses-prompt-concerns"},{"id":"INC-07352","date":"2018","year":2018,"title":"Uber ID algorithm suspends transgender drivers","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-id-algorithm-suspends-transgender-drivers"},{"id":"INC-07312","date":"2018","year":2018,"title":"IBM Watson recommends \"unsafe and incorrect\" cancer treatments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"IBM; Memorial Sloan Kettering Hospital","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ibm-watson-recommends-unsafe-and-incorrect-cancer-treatments"},{"id":"INC-06869","date":"2020","year":2020,"title":"Regulator raises doubts about Babylon Health triage system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Babylon Health","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/regulator-raises-doubts-about-babylon-health-triage-system"},{"id":"INC-07317","date":"2018","year":2018,"title":"Malfunctioning robot impales Chinese factory worker","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Zhuzhou porcelain factory, Hunan province","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/malfunctioning-robot-impales-chinese-factory-worker"},{"id":"INC-07358","date":"2018","year":2018,"title":"Xinhua deepfake news anchors stir scepticism, distrust","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Sogou","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xinhua-deepfake-news-anchors-stir-scepticism-distrust"},{"id":"INC-07453","date":"2017","year":2017,"title":"Video of Gal Gadot having sex with stepbrother exposed as deepfake","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/video-of-gal-gagot-having-sex-with-stepbrother-exposed-as-deepfake"},{"id":"INC-07291","date":"2018","year":2018,"title":"Deepfake Barack Obama calls Donald Trump \"a total and complete dipshit\"","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Jordan Peele; Jonah Peretti","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/deepfake-barack-obama-calls-donald-trump-a-total-and-complete-dipshit"},{"id":"INC-07285","date":"2018","year":2018,"title":"Christie's Portrait of Edmond Belamy sale prompts authenticity controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Obvious Art","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/christies-portrait-of-edmond-belamy-sale-prompts-authenticity-controversy"},{"id":"INC-07314","date":"2018","year":2018,"title":"Indian journalist Rana Ayyub attacked with deepfake porn video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Media/entertainment/sports/arts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/rana-ayyub-deepfake-porn-attack-doxxing"},{"id":"INC-07575","date":"2015","year":2015,"title":"Robot crushes and kills Ventra Ionia technician","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Nachi Robotic Systems; Lincoln Electric Company; FANUC America Corp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-crushes-and-kills-ventra-ionia-technician"},{"id":"INC-07264","date":"2018","year":2018,"title":"Alec Baldwin Donald Trump deepfake sparks disinformation fears","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"derpfakes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/alec-baldwin-deepfake-spoofs-donald-trump"},{"id":"INC-04515","date":"2023","year":2023,"title":"ChaosGPT plans to \"destroy humanity\" prompts autonomous system fears","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"xAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/chaosgpt-plans-to-destroy-humanity"},{"id":"INC-07269","date":"2018","year":2018,"title":"Amazon robot accident hospitalises 24 workers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-robot-accident-hospitalises-24-workers"},{"id":"INC-07347","date":"2018","year":2018,"title":"TV advert propels Amazon Alexa to order cat food","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tv-advert-makes-amazon-alexa-order-cat-food"},{"id":"INC-07333","date":"2018","year":2018,"title":"Study: Google hate speech detection system tricked by typos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-hate-speech-detection-tricked-by-typos"},{"id":"INC-07479","date":"2016","year":2016,"title":"Cambridge Analytica uses AI political manipulation to build Donald Trump support","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cambridge Analytica","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/cambridge-analytica-political-manipulation"},{"id":"INC-07636","date":"2012","year":2012,"title":"Facebook algorithms accused of fueling anti-Rohingya hatred, violence","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-accused-of-fueling-anti-rohingya-hatred-violence"},{"id":"INC-07298","date":"2018","year":2018,"title":"Facebook accused of inciting violence against Muslims in Sri Lanka","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-helped-incite-violence-against-muslims-in-sri-lanka"},{"id":"INC-07275","date":"2018","year":2018,"title":"Automated flight stablising system caused Lion Air crash that killed 189 people","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Boeing","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/lion-air-flight-610-crash-kills-189-people"},{"id":"INC-07426","date":"2017","year":2017,"title":"Las Vegas self-driving shuttle bus crashes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Keolia/NAVYA","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/las-vegas-self-driving-shuttle-bus-crashes"},{"id":"INC-07450","date":"2017","year":2017,"title":"Uber self-driving car crashes, flips on side","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-self-driving-car-crashes-flips-on-side"},{"id":"INC-07448","date":"2017","year":2017,"title":"Twins spoof HSBC UK AI-powered voice recognition system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"HSBC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/twins-spoof-hsbc-voice-recognition-system"},{"id":"INC-07420","date":"2017","year":2017,"title":"Insurers accused of charging drivers in minority areas 30 percent more","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Geico; Safeco; Nationwide","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/insurers-accused-of-charging-drivers-in-minority-areas-30-percent-more"},{"id":"INC-07423","date":"2017","year":2017,"title":"Knightscope K5 security robot 'drowns' in fountain","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Knightscope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/knightscope-k5-security-robot-drowns-in-fountain"},{"id":"INC-07401","date":"2017","year":2017,"title":"Gaydar AI that predicts sexual orientation accused of poor ethics","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Michal Kosinski; Yilung Wang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/gaydar-ai-sexual-orientation-predictions"},{"id":"INC-07471","date":"2016","year":2016,"title":"Ajin USA worker crushed to death by robotic arm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Ajin USA","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ajin-usa-worker-crushed-to-death-by-robot"},{"id":"INC-07414","date":"2017","year":2017,"title":"Houston ISD automated teacher evaluation system slammed as opaque","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"SAS Institute","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/houston-isd-teacher-performance-evaluation-opacity"},{"id":"INC-07444","date":"2017","year":2017,"title":"Temple of Heaven Park public toilet facial recognition raises hackles","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Shoulian Zhineng","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/temple-of-heaven-park-uses-facial-recognition-to-stop-toilet-paper-theft"},{"id":"INC-07454","date":"2017","year":2017,"title":"Violent spoof Peppa Pig videos bypass YouTube filters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/spoof-peppa-pig-videos-bypass-youtube-filters"},{"id":"INC-07419","date":"2017","year":2017,"title":"iFlytek automated speech recognition system prompts human rights concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ministry of Public Security; iFlytek","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/iflytek-automated-speech-recognition-surveillance"},{"id":"INC-07416","date":"2017","year":2017,"title":"IBM AI oncology tool suggests unsafe treatments","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"IBM; PwC","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/ibms-oncology-expert-advisor-fails-to-deliver-on-promises"},{"id":"INC-07496","date":"2016","year":2016,"title":"Google DeepMind, Royal Free London rapped for patient data sharing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"Google/Deepmind; NHS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-deepmind-royal-free-data-sharing"},{"id":"INC-07451","date":"2017","year":2017,"title":"Uber under fire for surge pricing after London terror attack","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uber","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-under-fire-for-surge-pricing-after-london-terror-attack"},{"id":"INC-07443","date":"2017","year":2017,"title":"Study: Wikipedia bots engage in editing \"wars\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Wikipedia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/wikipedia-editing-bot-wars"},{"id":"INC-07374","date":"2017","year":2017,"title":"Apple Face ID fails to distinguish identical twins","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-iphone-x-face-id-fails-to-distinguish-brothers"},{"id":"INC-07376","date":"2017","year":2017,"title":"Apple Face ID unlocked by work colleague","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-iphone-x-unlocked-by-work-colleague"},{"id":"INC-07377","date":"2017","year":2017,"title":"Arab boy unlocks mother's phone using Face ID","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/arab-boy-unlocks-mothers-phone-using-face-id"},{"id":"INC-07375","date":"2017","year":2017,"title":"Apple Face ID hacked with 3D mask","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/apple-iphone-x-face-id-hacked-with-masks"},{"id":"INC-07461","date":"2017","year":2017,"title":"XiaoBing, BabyQ chatbots criticise Chinese government","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft; Turing Robot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xiaobing-babyq-chatbots"},{"id":"INC-07442","date":"2017","year":2017,"title":"Sophia robot Saudi citizenship prompts controversy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Hanson Robotics","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sophia-show-robot-granted-saudi-citizenship"},{"id":"INC-07370","date":"2017","year":2017,"title":"Amazon Alexa holds 2am party when owner is out","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-holds-2am-party-when-owner-is-out"},{"id":"INC-07371","date":"2017","year":2017,"title":"Amazon Alexa mistakenly orders USD 160 dollhouse","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-mistakenly-orders-usd-160-dollhouse"},{"id":"INC-07270","date":"2018","year":2018,"title":"Amazon warehouse worker tracking wristband prompts backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-warehouse-worker-tracking-wristband-prompts-backlash"},{"id":"INC-07396","date":"2017","year":2017,"title":"Facebook negotiation chatbots create secret language","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-negotiation-chatbots-create-secret-language"},{"id":"INC-07394","date":"2017","year":2017,"title":"Facebook accused of helping advertisers exclude older workers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-accused-of-helping-advertisers-exclude-older-workers"},{"id":"INC-07393","date":"2017","year":2017,"title":"Facebook accused of enabling advertisers to target anti-semites","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta Platforms","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-accused-of-enabling-advertisers-to-target-anti-semites"},{"id":"INC-07404","date":"2017","year":2017,"title":"Google Allo Smart Reply gives offensive responses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-allo-smart-reply-gives-offensive-responses"},{"id":"INC-07407","date":"2017","year":2017,"title":"Google hate detection AI mistakes bullying for civility","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-hate-detection-ai-mistakes-bullying-for-civility"},{"id":"INC-07457","date":"2017","year":2017,"title":"Waze, Google Maps direct users into San Francisco wildfires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google/Waze","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waze-directs-users-into-san-francisco-wildfires"},{"id":"INC-07408","date":"2017","year":2017,"title":"Google Home Mini speaker is caught eavesdropping","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-home-mini-speaker-caught-eavesdropping"},{"id":"INC-07409","date":"2017","year":2017,"title":"Google, Twitter let advertisers target people using racist keywords","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google; xAI","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-twitter-let-advertisers-target-racist-keywords"},{"id":"INC-07463","date":"2017","year":2017,"title":"YouTube Autocomplete suggests paedophiliac phrases","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-autocomplete-suggests-paedophiliac-phrases"},{"id":"INC-07465","date":"2017","year":2017,"title":"YouTube slammed for amplifying Las Vegas shooting fake conspiracies","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-amplifies-las-vegas-shooting-fake-conspiracies"},{"id":"INC-07462","date":"2017","year":2017,"title":"Yandex's Alice chatbot supports wife-beating, suicide","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Yandex","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/yandex-alicealisa-smart-personal-assistant"},{"id":"INC-07527","date":"2016","year":2016,"title":"Tesla Model S crashes into road-sweeper, kills driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-crashes-into-road-sweeper-kills-driver"},{"id":"INC-07526","date":"2016","year":2016,"title":"Tesla Model S collides with tractor-trailor, kills driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-collides-with-tractor-trailor-truck-kills-driver"},{"id":"INC-07539","date":"2016","year":2016,"title":"Udbetaling Danmark welfare payments optimisation system prompts controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"ADT; The Agency for Labour Market and Recruitment (STAR)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/udbetaling-danmark-welfare-payments-optimisation"},{"id":"INC-07528","date":"2016","year":2016,"title":"Tesla Model S remotely controlled by hackers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/tesla-model-s-remotely-controlled-by-hackers"},{"id":"INC-07545","date":"2016","year":2016,"title":"Waymo self-driving car hits public bus","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waymo-self-driving-car-hits-public-bus"},{"id":"INC-07537","date":"2016","year":2016,"title":"Uber self-driving car runs red light in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uber-self-driving-car-runs-red-light"},{"id":"INC-07544","date":"2016","year":2016,"title":"USD 50m siphoned in The DAO hack","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM04","LLM08"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"The DAO; Slock.it","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/the-dao-smart-contracts-hack"},{"id":"INC-07504","date":"2016","year":2016,"title":"Knightscope K5 security robot hits child","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Knightscope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/knightscope-k5-security-robot-hits-child"},{"id":"INC-07480","date":"2016","year":2016,"title":"Chinese AI criminality prediction study criticised as unethical","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xiaolin Wu; Xi Zhang; Shanghai Jiao Tong University","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/study-predicts-criminality-by-analysing-facial-features"},{"id":"INC-07510","date":"2016","year":2016,"title":"New Zealand student passport application denied by 'racist' AI photo checker","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"NEC","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/new-zealand-passport-photo-checker-racial-bias"},{"id":"INC-07488","date":"2016","year":2016,"title":"Eric Loomis algorithmic risk assessment accused of denying due process","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Volaris Group/Equivant/Northpointe","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/eric-loomis-compas-prison-sentencing"},{"id":"INC-07514","date":"2016","year":2016,"title":"Police use of robot to kill Dallas shooting suspect prompts controversy","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Exponent Inc","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/police-robot-kills-dallas-shooting-suspect"},{"id":"INC-07487","date":"2016","year":2016,"title":"Elite Dangerous AI update causes spaceships to create superweapons","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Frontier","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/elite-dangerous-ai-spaceships-create-superweapons"},{"id":"INC-07474","date":"2016","year":2016,"title":"Amazon Alexa responds to child with pornographic response","severity":"Medium","attack_vector":"other","owasp_llm":["LLM08","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/amazon-alexa-plays-child-pornography"},{"id":"INC-07521","date":"2016","year":2016,"title":"Russian sex workers targeted using FindFace","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"NtechLab","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/russian-sex-workers-targeted-using-findface"},{"id":"INC-07467","date":"2016","year":2016,"title":"AI beauty contest accused of racial bias","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youth Laboratories","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/beauty-ai-2-0-beauty-contest-racial-bias"},{"id":"INC-07498","date":"2016","year":2016,"title":"Google search prioritises Holocaust denial website","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-search-prioritises-holocaust-denial-website"},{"id":"INC-07507","date":"2016","year":2016,"title":"Microsoft Tay chatbot generates offensive tweets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Microsoft","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/microsoft-tay-chatbot"},{"id":"INC-07489","date":"2016","year":2016,"title":"Facebook accused of illegally letting housing ads exclude ethnic minorities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-lets-housing-ads-exclude-ethnic-minorities"},{"id":"INC-07546","date":"2016","year":2016,"title":"Xiao Pang robot goes haywire at technology fair","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Beijing Science and Technology Co.","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/xiao-pang-robot-goes-haywire-at-technology-fair"},{"id":"INC-07300","date":"2018","year":2018,"title":"Facebook sued for failing to protect content moderators from PTSD","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook; Cognizant; Pro Unlimited","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-content-moderators-develop-ptsd"},{"id":"INC-07576","date":"2015","year":2015,"title":"Robot crushes and kills VW contractor","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Volkswagen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-crushes-and-kills-vw-contractor"},{"id":"INC-07564","date":"2015","year":2015,"title":"Google, Delphi self-driving cars in 'near miss'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo; Aptive/Delphi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-delphi-self-driving-cars-near-miss"},{"id":"INC-07579","date":"2015","year":2015,"title":"Study: Robotic surgery \"responsible for\" 144 deaths, 1,000+ injuries","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Health","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robotic-surgery-linked-to-144-deaths-1000-injuries"},{"id":"INC-07578","date":"2015","year":2015,"title":"SKH Metals worker killed by pre-programmed robotic arm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"SKH Metals","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/robot-kills-skh-metals-worker"},{"id":"INC-07588","date":"2015","year":2015,"title":"YouTube Kids accused of recommending adult content, advertising","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"YouTube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/youtube-kids-app-features-adult-content"},{"id":"INC-07556","date":"2015","year":2015,"title":"Facebook sued for tagging users' faces without consent","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/facebook-tags-users-faces-without-consent"},{"id":"INC-07562","date":"2015","year":2015,"title":"Google Autocomplete links health researcher to false blackmail accusations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-links-health-researcher-to-false-blackmail-accusations"},{"id":"INC-07563","date":"2015","year":2015,"title":"Google Photos mislabels black Americans as 'gorillas'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-photos-mislabels-black-americans-as-gorillas"},{"id":"INC-07677","date":"2009","year":2009,"title":"UK Post Office used faulty accounting software to wrongly accuse over 900 subpostmasters of theft and fraud","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Fujitsu/ICL","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-post-office-scandal"},{"id":"INC-07561","date":"2015","year":2015,"title":"Google AdSense shows lower-paying jobs to women","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-adsense-shows-lower-paying-jobs-to-women"},{"id":"INC-07600","date":"2014","year":2014,"title":"Inaccurate test finds most English language test students 'cheated'","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Educational Testing Service (ETS)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/uk-visa-foreign-language-test-cheating"},{"id":"INC-07609","date":"2014","year":2014,"title":"Steve Talley facial recognition wrongful arrest","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Federal Bureau of Investigation (FBI)","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/steve-talley-facial-recognition-wrongful-arrest"},{"id":"INC-07615","date":"2014","year":2014,"title":"Waving arms found to trigger Nest Protect false alarms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google/Nest Labs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/waving-arms-trigger-nest-protect-false-alarms"},{"id":"INC-07607","date":"2014","year":2014,"title":"Predictive policing makes Robert McDaniel criminal target","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chicago Police Department; Illinois Institute of Technology","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/predictive-policing-makes-robert-mcdaniel-criminal-target"},{"id":"INC-07599","date":"2014","year":2014,"title":"Google Autocomplete connects Albert Yeung with triads","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-connects-albert-yeung-with-triads"},{"id":"INC-07632","date":"2012","year":2012,"title":"Algorithmic personality assessment results in bipolar sufferer suicide","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"UKG/Kronos","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/kyle-behm-kroger-algorithmic-personality-assessment"},{"id":"INC-07625","date":"2013","year":2013,"title":"Paul Zilly sentencing prompts algorithmic fairness controversy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Volaris Group/Equivant/Northpointe","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/paul-zilly-compas-sentencing-risk-assessment"},{"id":"INC-07640","date":"2012","year":2012,"title":"Google Autocomplete suggests Australian surgeon is 'bankrupt'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-suggests-australian-surgeon-is-bankrupt"},{"id":"INC-07622","date":"2013","year":2013,"title":"Google Autocomplete unfairly links German businessman to Scientology","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-unfairly-links-businessman-to-scientology"},{"id":"INC-07633","date":"2012","year":2012,"title":"Automated equity order routing glitch disrupts NY stock exchange","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Knight Capital Group","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/knight-capital-group-equity-order-routing-system-glitch"},{"id":"INC-07593","date":"2014","year":2014,"title":"Court overturns Sheri G. Lederman teacher effectiveness rating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Mathematica Policy Research","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/sheri-g-lederman-nyc-teacher-effectiveness-assessment"},{"id":"INC-07638","date":"2012","year":2012,"title":"Google Autocomplete falsely conflates Bettina Wulff with 'prostitute'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-conflates-bettina-wulff-with-prostitute"},{"id":"INC-07639","date":"2012","year":2012,"title":"Google Autocomplete says Rupert Murdoch, Jon Hamm are 'Jewish'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"auto","tier":"landmark","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-says-rupert-murdoch-jon-hamm-are-jewish"},{"id":"INC-07637","date":"2012","year":2012,"title":"Google Autocomplete falsely associates Japanese man with crimes","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03","LLM08"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-autocomplete-falsely-associates-japanese-man-with-crimes"},{"id":"INC-07641","date":"2012","year":2012,"title":"Google Images links music promoter to criminal underworld","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.aiaaic.org/aiaaic-repository/ai-algorithmic-and-automation-incidents/google-images-links-music-promoter-to-criminal-underworld"},{"id":"INC-07566","date":"2015-05-19","year":2015,"title":"Google’s YouTube Kids App Presents Inappropriate Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1/"},{"id":"INC-07354","date":"2018-12-05","year":2018,"title":"Warehouse robot ruptures can of bear spray and injures workers","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/2/"},{"id":"INC-07289","date":"2018-10-27","year":2018,"title":"Crashes with Maneuvering Characteristics Augmentation System (MCAS)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Boeing","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/3/"},{"id":"INC-07351","date":"2018-03-18","year":2018,"title":"Uber AV Killed Pedestrian in Arizona","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/4/"},{"id":"INC-07553","date":"2015-07-13","year":2015,"title":"Collection of Robotic Surgery Malfunctions","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Doctors, Hospitals, Intuitive Surgical","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/5/"},{"id":"INC-07508","date":"2016-03-24","year":2016,"title":"Microsoft's TayBot Allegedly Posts Racist, Sexist, and Anti-Semitic Content to Twitter","severity":"High","attack_vector":"other","owasp_llm":["LLM01","LLM05","LLM07","LLM10"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/6/"},{"id":"INC-07459","date":"2017-02-24","year":2017,"title":"Wikipedia Vandalism Prevention Bot Loop","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Wikipedia","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/7/"},{"id":"INC-07611","date":"2014-08-15","year":2014,"title":"Uber Autonomous Cars Running Red Lights","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/8/"},{"id":"INC-07646","date":"2012-02-25","year":2012,"title":"New York City Reportedly Released Disputed Value-Added Teacher Ratings for Thousands of Teachers","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"New York City Department Of Education","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/9/"},{"id":"INC-07601","date":"2014-08-14","year":2014,"title":"Kronos Scheduling Algorithm Allegedly Caused Financial Issues for Starbucks Employees","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kronos, Starbucks","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/10/"},{"id":"INC-07512","date":"2016-05-23","year":2016,"title":"Northpointe Risk Models","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Northpointe","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/11/"},{"id":"INC-07483","date":"2016-07-21","year":2016,"title":"Common Biases of Vector Embeddings","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Boston University, Google, Microsoft Research","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/12/"},{"id":"INC-07412","date":"2017-02-27","year":2017,"title":"High-Toxicity Assessed on Text Involving Women and Minority Groups","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/13/"},{"id":"INC-07383","date":"2017-10-26","year":2017,"title":"Biased Sentiment Analysis","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/14/"},{"id":"INC-07681","date":"2008-05-23","year":2008,"title":"Amazon Censors Gay Books","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/15/"},{"id":"INC-07567","date":"2015-11-03","year":2015,"title":"Inappropriate Gmail Smart Reply Suggestions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/17/"},{"id":"INC-07560","date":"2015-04-04","year":2015,"title":"Gender Biases of Google Image Search","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/18/"},{"id":"INC-07627","date":"2013-01-23","year":2013,"title":"Sexist and Racist Google Adsense Advertisements","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/19/"},{"id":"INC-07482","date":"2016-06-30","year":2016,"title":"A Collection of Tesla Autopilot-Involved Crashes","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI05","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/20/"},{"id":"INC-07533","date":"2016-07-14","year":2016,"title":"Tougher Turing Test Exposes Chatbots’ Stupidity (migrated to Issue)","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Researchers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/21/"},{"id":"INC-07456","date":"2017-12-06","year":2017,"title":"Waze Navigates Motorists into Wildfires","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/22/"},{"id":"INC-07425","date":"2017-11-08","year":2017,"title":"Las Vegas Self-Driving Bus Involved in Accident","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Keolis North America, Navya","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/23/"},{"id":"INC-07608","date":"2014-07-15","year":2014,"title":"Robot kills worker at German Volkswagen plant","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Volkswagen","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/24/"},{"id":"INC-07570","date":"2015-06-23","year":2015,"title":"Google and Delphi Self-Driving Prototypes Allegedly Involved in Near-Miss on San Antonio Road, Palo Alto","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Delphi Technologies, Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/25/"},{"id":"INC-07410","date":"2017-09-13","year":2017,"title":"Hackers Break Apple Face ID","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/26/"},{"id":"INC-07714","date":"1983-09-26","year":1983,"title":"Nuclear False Alarm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Soviet Union","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/27/"},{"id":"INC-07661","date":"2010-05-08","year":2010,"title":"2010 Market Flash Crash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Barclays Capital, Navinder Sarao, Waddell And Reed","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/28/"},{"id":"INC-07655","date":"2011-09-20","year":2011,"title":"Image Classification of Battle Tanks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"United States Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/29/"},{"id":"INC-07515","date":"2016-10-08","year":2016,"title":"Poor Performance of Tesla Factory Robots","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/30/"},{"id":"INC-07389","date":"2017-12-03","year":2017,"title":"Driverless Train in Delhi Crashes due to Braking Failure","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Delhi Metro Rail Corporation, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/31/"},{"id":"INC-07418","date":"2017-09-13","year":2017,"title":"Identical Twins Can Open Apple FaceID Protected Devices","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/32/"},{"id":"INC-07372","date":"2017-11-09","year":2017,"title":"Amazon Alexa Plays Loud Music when Owner is Away","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/33/"},{"id":"INC-07551","date":"2015-12-05","year":2015,"title":"Amazon Alexa Responding to Environmental Inputs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/34/"},{"id":"INC-07594","date":"2014-10-18","year":2014,"title":"Employee Automatically Terminated by Computer Program","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/35/"},{"id":"INC-07325","date":"2018-11-06","year":2018,"title":"Picture of Woman on Side of Bus Shamed for Jaywalking","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ningbo Traffic Police","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/36/"},{"id":"INC-07476","date":"2016-08-10","year":2016,"title":"Amazon’s Experimental Hiring Tool Allegedly Displayed Gender Bias in Candidate Rankings","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/37/"},{"id":"INC-07495","date":"2016-06-02","year":2016,"title":"Game AI System Produces Imbalanced Game","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Frontier Development","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/38/"},{"id":"INC-07387","date":"2017-07-01","year":2017,"title":"Deepfake Obama Introduction of Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Fakeapp, University Of Washington","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/39/"},{"id":"INC-07484","date":"2016-05-23","year":2016,"title":"COMPAS Algorithm Reportedly Performs Poorly in Crime Recidivism Prediction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Equivant","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/40/"},{"id":"INC-07265","date":"2018-04-02","year":2018,"title":"All Image Captions Produced are Violent","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Mit Media Lab","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/41/"},{"id":"INC-07712","date":"1996-04-03","year":1996,"title":"Inefficiencies in the United States Resident Matching Program","severity":"Medium","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"National Resident Matching Program","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/42/"},{"id":"INC-07711","date":"1998-03-05","year":1998,"title":"St George's Hospital Medical School allegedly Automated Admissions with Discriminatory Results","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dr. Geoffrey Franglen, St George's Hospital Medical School","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/43/"},{"id":"INC-07685","date":"2008-07-01","year":2008,"title":"Machine Personal Assistants Failed to Maintain Social Norms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Usc Information Sciences Institute","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/44/"},{"id":"INC-07653","date":"2011-04-05","year":2011,"title":"Defamation via AutoComplete","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/45/"},{"id":"INC-07605","date":"2014-01-21","year":2014,"title":"Nest Smoke Alarm Erroneously Stops Alarming","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Nest Labs","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/46/"},{"id":"INC-07505","date":"2016-09-06","year":2016,"title":"LinkedIn Search Prefers Male Names","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Linkedin","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/47/"},{"id":"INC-07513","date":"2016-12-07","year":2016,"title":"Passport checker Detects Asian man's Eyes as Closed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"New Zealand","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/48/"},{"id":"INC-07468","date":"2016-09-05","year":2016,"title":"AI Beauty Judge Did Not Like Dark Skin","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youth Laboratories","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/49/"},{"id":"INC-07531","date":"2016-06-17","year":2016,"title":"The DAO Hack","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"The Dao","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/50/"},{"id":"INC-07523","date":"2016-07-12","year":2016,"title":"Security Robot Rolls Over Child in Mall","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Knightscope, Stanford Shopping Center","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/51/"},{"id":"INC-07529","date":"2016-07-01","year":2016,"title":"Tesla on AutoPilot Killed Driver in Crash in Florida while Watching Movie","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/52/"},{"id":"INC-07478","date":"2016-03-31","year":2016,"title":"Biased Google Image Results","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/53/"},{"id":"INC-07571","date":"2015-11-18","year":2015,"title":"Predictive Policing Biases of PredPol","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Oakland Police Department, Predpol","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/54/"},{"id":"INC-07472","date":"2016-12-30","year":2016,"title":"Alexa Plays Pornography Instead of Kids Song","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/55/"},{"id":"INC-07365","date":"2017-07-10","year":2017,"title":"AI-Designed Phone Cases Are Unexpected","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"My Handy Design","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/56/"},{"id":"INC-07550","date":"2015-07-01","year":2015,"title":"Australian Automated Debt Assessment System Issued False Notices to Thousands","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Australian Department Of Human Services, Centrelink","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/57/"},{"id":"INC-07439","date":"2017-10-12","year":2017,"title":"Russian Chatbot Supports Stalin and Violence","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Yandex","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/58/"},{"id":"INC-07402","date":"2017-04-13","year":2017,"title":"Gender Biases in Google Translate","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/59/"},{"id":"INC-07391","date":"2017-04-25","year":2017,"title":"FaceApp Racial Filters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Faceapp","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/60/"},{"id":"INC-07433","date":"2017-05-01","year":2017,"title":"Overfit Kaggle Models Discouraged Data Science Competitors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Individual Kaggle Competitors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/61/"},{"id":"INC-07379","date":"2017-12-23","year":2017,"title":"Bad AI-Written Christmas Carols","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Janelle Shane","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/62/"},{"id":"INC-07308","date":"2018-01-25","year":2018,"title":"Google Photo Merge Decapitates Subject","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/63/"},{"id":"INC-07290","date":"2018-01-22","year":2018,"title":"Customer Service Robot Scares Away Customers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Heriot Watt University, Margiotta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/64/"},{"id":"INC-07518","date":"2016-12-22","year":2016,"title":"Reinforcement Learning Reward Functions in Video Games","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/65/"},{"id":"INC-07385","date":"2017-08-02","year":2017,"title":"Chinese Chatbots Question Communist Party","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft, Tencent Holdings, Turing Robot","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/66/"},{"id":"INC-07331","date":"2018-12-01","year":2018,"title":"Sleeping Driver on Tesla AutoPilot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Motorist, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/67/"},{"id":"INC-07440","date":"2017-07-17","year":2017,"title":"Security Robot Drowns Itself in a Fountain","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Knightscope","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/68/"},{"id":"INC-07587","date":"2015-07-02","year":2015,"title":"Worker killed by robot in welding accident at car parts factory in India","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Skh Metals, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/69/"},{"id":"INC-07524","date":"2016-02-10","year":2016,"title":"Self-driving cars in winter","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Volvo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/70/"},{"id":"INC-07499","date":"2016-02-14","year":2016,"title":"Google Waymo Vehicle and Bus Allegedly Collide in California","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/71/"},{"id":"INC-07398","date":"2017-10-17","year":2017,"title":"Facebook translates 'good morning' into 'attack them', leading to arrest","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/72/"},{"id":"INC-07502","date":"2016-03-01","year":2016,"title":"Is Pokémon Go racist? How the app may be redlining communities of color","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Niantic Labs","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/73/"},{"id":"INC-07642","date":"2012-01-05","year":2012,"title":"Google Instant's Allegedly 'Anti-Semitic' Results Lead To Lawsuit In France","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/75/"},{"id":"INC-06762","date":"2020-10-09","year":2020,"title":"Live facial recognition is tracking kids suspected of being criminals","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Buenos Aires City Government, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/76/"},{"id":"INC-07203","date":"2019-10-04","year":2019,"title":"Knightscope's Park Patrol Robot Ignored Bystander Pressing Emergency Button to Alert Police about Fight","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Knightscope","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/77/"},{"id":"INC-06774","date":"2020-07-06","year":2020,"title":"International Baccalaureate’s 2020 Calculated-Grades Model Reportedly Lowered Students' Scores and College Prospects","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"International Baccalaureate Organization","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/78/"},{"id":"INC-07710","date":"1999-03-16","year":1999,"title":"Kidney Testing Method Allegedly Underestimated Risk of Black Patients","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chronic Kidney Disease Epidemiology Collaboration","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/79/"},{"id":"INC-06232","date":"2020-10-24","year":2020,"title":"AI mistakes referee’s bald head for football — hilarity ensued","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Inverness Caledonian Thistle Football Club, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/80/"},{"id":"INC-06877","date":"2020-10-21","year":2020,"title":"Researchers find evidence of racial, gender, and socioeconomic bias in chest X-ray classifiers","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Aidoc, Darwinai, Google, Mount Sinai Hospitals, Qure.ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/81/"},{"id":"INC-06201","date":"2020-10-21","year":2020,"title":"#LekkiMassacre: Why Facebook labelled content from October 20 incident ‘false’","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/82/"},{"id":"INC-06245","date":"2020-10-22","year":2020,"title":"AI Spam Filters Allegedly Block Legitimate Emails Based on Biased Keyword Detection","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Gmail, Gmx, Google, Laposte, Microsoft, Outlook, Yahoo","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/83/"},{"id":"INC-07004","date":"2020-10-09","year":2020,"title":"Tiny Changes Let False Claims About COVID-19, Voting Evade Facebook Fact Checks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/84/"},{"id":"INC-06217","date":"2020-10-09","year":2020,"title":"AI attempts to ease fear of robots, blurts out it can’t ‘avoid destroying humankind’","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/85/"},{"id":"INC-07052","date":"2020-10-07","year":2020,"title":"UK passport photo checker shows bias against dark-skinned women","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uk Home Office","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/87/"},{"id":"INC-07246","date":"2019-03-15","year":2019,"title":"The Christchurch shooter and YouTube’s radicalization trap","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/89/"},{"id":"INC-06629","date":"2020-12-18","year":2020,"title":"Frontline workers protest at Stanford after hospital distributed vaccine to administrators","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Stanford Medical Center","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/91/"},{"id":"INC-07164","date":"2019-11-11","year":2019,"title":"Apple Card's Credit Assessment Algorithm Allegedly Discriminated against Women","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Apple, Goldman Sachs","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/92/"},{"id":"INC-07311","date":"2018-08-13","year":2018,"title":"HUD charges Facebook with enabling housing discrimination","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/93/"},{"id":"INC-06483","date":"2020-11-27","year":2020,"title":"Court Rules Deliveroo Used 'Discriminatory' Algorithm","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deliveroo","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/94/"},{"id":"INC-07201","date":"2019-11-06","year":2019,"title":"Job Screening Service Halts Facial Analysis of Applicants","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Hirevue","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/95/"},{"id":"INC-07415","date":"2017-05-08","year":2017,"title":"Houston ISD's EVAAS Teacher-Evaluation System Reportedly Put Teachers' Jobs at Risk Through Unverifiable Scores","severity":"High","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI10"],"cve_ids":[],"affected":"Houston Independent School District, Sas Institute","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/96/"},{"id":"INC-06959","date":"2020-10-22","year":2020,"title":"Tesla Autopilot Mistakes Red Letters on Flag for Red Traffic Lights","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/97/"},{"id":"INC-05776","date":"2021-04-28","year":2021,"title":"N.Y.P.D. Robot Dog’s Run Is Cut Short After Fierce Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Boston Dynamics, New York City Police Department","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/98/"},{"id":"INC-07643","date":"2012-01-01","year":2012,"title":"Major Universities Are Reportedly Using Race as a 'High Impact Predictor' of Student Success","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eab, Georgia State University, More Than 500 Colleges, Texas Aandm University, University Of Houston, University Of…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/99/"},{"id":"INC-05693","date":"2021-03-17","year":2021,"title":"How French welfare services are creating ‘robo-debt’","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"French Welfare Offices, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/100/"},{"id":"INC-07293","date":"2018-09-01","year":2018,"title":"Dutch Families Wrongfully Accused of Tax Fraud Due to Discriminatory Algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dutch Tax Authority, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/101/"},{"id":"INC-06838","date":"2020-03-23","year":2020,"title":"Personal voice assistants struggle with black voices, new study shows","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Apple, Google, Ibm, Microsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/102/"},{"id":"INC-07031","date":"2020-09-18","year":2020,"title":"Twitter’s Image Cropping Tool Allegedly Showed Gender and Racial Bias","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Twitter","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/103/"},{"id":"INC-05514","date":"2021-02-12","year":2021,"title":"California's Algorithm Considered ZIP Codes in Vaccine Distribution, Allegedly Excluding Low-Income Neighborhoods and Communities of Color","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Blue Shield Of California, California Department Of Public Health","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/104/"},{"id":"INC-07238","date":"2019-08-24","year":2019,"title":"Tesla Model 3 on Autopilot Crashed into a Ford Explorer Pickup, Killing a Fifteen-Year-Old in California","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/105/"},{"id":"INC-07736","date":"2020-12-23","year":2020,"title":"Korean Chatbot Luda Reportedly Made Offensive Remarks Towards Minority Groups in South Korea","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Facebook Messenger, Scatter Lab","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/106/"},{"id":"INC-07284","date":"2018-07-20","year":2018,"title":"Chinese Tech Firms Allegedly Developed Facial Recognition to Identify People by Race, Targeting Uyghur Muslims","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Alibaba, Baibu, Huawei, Megvii, None, Sensetime","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/107/"},{"id":"INC-05851","date":"2021-07-10","year":2021,"title":"Skating Rink’s Facial Recognition Cameras Misidentified Black Teenager as Banned Troublemaker","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Riverside Arena Skating Rink, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/108/"},{"id":"INC-07435","date":"2017-01-01","year":2017,"title":"PimEyes's Facial Recognition AI Allegedly Lacked Safeguards to Prevent Itself from Being Abused","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Pimeyes","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/109/"},{"id":"INC-07477","date":"2016-01-01","year":2016,"title":"Arkansas's Opaque Algorithm to Allocate Health Care Excessively Cut Down Hours for Beneficiaries","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Arkansas Department Of Human Services, Interrai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/110/"},{"id":"INC-07552","date":"2015-09-25","year":2015,"title":"Amazon Flex Drivers Allegedly Fired via Automated Employee Evaluations","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Amazon, Amazon Flex","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/111/"},{"id":"INC-07648","date":"2012-10-09","year":2012,"title":"Police Departments Reported ShotSpotter as Unreliable and Wasteful","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Chicago Police Department, Fall River Police Department, New York City Police Department, San Antonio Police…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/112/"},{"id":"INC-06586","date":"2020-06-27","year":2020,"title":"Facebook's AI Put \"Primates\" Label on Video Featuring Black Men","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/113/"},{"id":"INC-07271","date":"2018-07-26","year":2018,"title":"Amazon's Rekognition Falsely Matched Members of Congress to Mugshots","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/114/"},{"id":"INC-06631","date":"2020-07-28","year":2020,"title":"Genderify’s AI to Predict a Person’s Gender Revealed by Free API Users to Exhibit Bias","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Genderify","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/115/"},{"id":"INC-05468","date":"2021-09-20","year":2021,"title":"Amazon's AI Cameras Incorrectly Penalized Delivery Drivers for Mistakes They Did Not Make","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon, Netradyne","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/116/"},{"id":"INC-06995","date":"2020-02-24","year":2020,"title":"TikTok's \"Suggested Accounts\" Algorithm Allegedly Reinforced Racial Bias through Feedback Loops","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/117/"},{"id":"INC-06828","date":"2020-08-06","year":2020,"title":"OpenAI's GPT-3 Associated Muslims with Violence","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/118/"},{"id":"INC-06193","date":"2021-08-03","year":2021,"title":"Xsolla Employees Fired by CEO Allegedly via Big Data Analytics of Work Activities","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Unknown, Xsolla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/119/"},{"id":"INC-06840","date":"2020-09-01","year":2020,"title":"Philosophy AI Allegedly Used To Generate Mixture of Innocent and Harmful Reddit Posts","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI02","ASI09","ASI10"],"cve_ids":[],"affected":"Murat Ayfer, Openai, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/120/"},{"id":"INC-06383","date":"2020-03-27","year":2020,"title":"Autonomous Kargu-2 Drone Allegedly Remotely Used to Hunt down Libyan Soldiers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Stm, Tripoli Based Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/121/"},{"id":"INC-07558","date":"2015-06-14","year":2015,"title":"Facebook’s \"Tag Suggestions\" Allegedly Stored Biometric Data without User Consent","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/122/"},{"id":"INC-05588","date":"2021-08-01","year":2021,"title":"Epic Systems’s Sepsis Prediction Algorithms Revealed to Have High Error Rates on Seriously Ill Patients","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Epic Systems, University Of Michigan Hospital","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/123/"},{"id":"INC-07155","date":"2019-10-24","year":2019,"title":"Optum Algorithmic Health Risk Scores Reportedly Underestimated Black Patients' Needs","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Optum, Unnamed Large Academic Hospital","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/124/"},{"id":"INC-06355","date":"2020-09-29","year":2020,"title":"Amazon’s Robotic Fulfillment Centers Have Higher Serious Injury Rates","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/125/"},{"id":"INC-06105","date":"2021-07-16","year":2021,"title":"Three Robots Collided, Sparking Fire in a Grocer's Warehouse in UK","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ocado","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/126/"},{"id":"INC-06793","date":"2020-06-06","year":2020,"title":"Microsoft’s Algorithm Allegedly Selected Photo of the Wrong Mixed-Race Person Featured in a News Story","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Microsoft, Msn.com","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/127/"},{"id":"INC-07445","date":"2017-08-01","year":2017,"title":"Tesla Sedan on Autopilot Reportedly Drove Over Dividing Curb in Washington, Resulting in Minor Vehicle Damage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/128/"},{"id":"INC-05631","date":"2021-03-01","year":2021,"title":"Facebook's Automated Tools Failed to Adequately Remove Hate Speech, Violence, and Incitement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/129/"},{"id":"INC-06861","date":"2020-12-04","year":2020,"title":"Proctoring Algorithm in Online California Bar Exam Flagged an Unusually High Number of Alleged Cheaters","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"California Bar's Committee Of Bar Examiners, Examsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/131/"},{"id":"INC-07002","date":"2020-12-27","year":2020,"title":"TikTok’s Content Moderation Allegedly Failed to Adequately Take down Videos Promoting Eating Disorders","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/132/"},{"id":"INC-06827","date":"2020-12-15","year":2020,"title":"Online Trolls Allegedly Abused TikTok’s Automated Content Reporting System to Discriminate against Marginalized Creators","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/133/"},{"id":"INC-06883","date":"2020-12-25","year":2020,"title":"Robot in Chinese Shopping Mall Fell off the Escalator, Knocking down Passengers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Fuzhou Zhongfang Marlboro Mall, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/134/"},{"id":"INC-07650","date":"2012-12-01","year":2012,"title":"UT Austin's GRADE Algorithm Reportedly Reduced Review of Lower-Scored PhD Applicants Amid Bias Concerns","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Austin Waters, Risto Miikkulainen, University Of Texas At Austin's Department Of Computer Science, University Of Texas…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/135/"},{"id":"INC-06408","date":"2020-12-06","year":2020,"title":"Brand Safety Tech Firms Falsely Claimed Use of AI, Blocking Ads Using Simple Keyword Lists","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Brand Safety Tech Firms, None","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/136/"},{"id":"INC-05725","date":"2021-01-11","year":2021,"title":"Israeli Tax Authority Reportedly Used an Opaque Automated System to Issue a Fine, Declining to Explain or Disclose the Underlying Calculation","severity":"High","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI05","ASI10"],"cve_ids":[],"affected":"Israeli Tax Authority","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/137/"},{"id":"INC-06340","date":"2020-03-23","year":2020,"title":"University of Illinois' Proctorio Remote-Proctoring Deployment Reportedly Raised Student Rights Concerns","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Proctorio, University Of Illinois Urbana Champaign","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/138/"},{"id":"INC-05473","date":"2021-01-21","year":2021,"title":"Amazon’s Search and Recommendation Algorithms Found by Auditors to Have Boosted Products That Contained Vaccine Misinformation","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/139/"},{"id":"INC-06863","date":"2020-06-01","year":2020,"title":"University of Toronto's ProctorU Deployment Reportedly Disadvantaged BIPOC Students During Exam Check-Ins","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Proctoru, University Of Toronto","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/140/"},{"id":"INC-05512","date":"2021-02-05","year":2021,"title":"California Police Turned on Music to Allegedly Trigger Instagram’s DCMA to Avoid Being Live-Streamed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/141/"},{"id":"INC-05635","date":"2021-02-11","year":2021,"title":"Facebook's Advertisement Moderation System Allegedly Routinely Misidentified Adaptive Fashion Products as Medical Equipment and Blocked Their Sellers","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/142/"},{"id":"INC-05636","date":"2021-02-16","year":2021,"title":"Facebook’s and Twitter's Automated Content Moderation Reportedly Failed to Effectively Enforce Violation Rules for Small Language Groups","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Facebook, Twitter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/143/"},{"id":"INC-07143","date":"2020-06-28","year":2020,"title":"YouTube's AI Mistakenly Banned Chess Channel over Chess Language Misinterpretation","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/144/"},{"id":"INC-06079","date":"2021-07-23","year":2021,"title":"Tesla's Autopilot Misidentified the Moon as Yellow Stop Light","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/145/"},{"id":"INC-05824","date":"2021-10-22","year":2021,"title":"Research Prototype AI, Delphi, Reportedly Gave Racially Biased Answers on Ethics","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Allen Institute For Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/146/"},{"id":"INC-06872","date":"2020-01-15","year":2020,"title":"Reported AI-Cloned Voice Used to Deceive Hong Kong Bank Manager in Purported $35 Million Fraud Scheme","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/147/"},{"id":"INC-06184","date":"2021-11-21","year":2021,"title":"Web Accessibility Vendors Allegedly Falsely Claimed to Provide Compliance Using AI","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Accessibe, Accessus.ai, Allyable, Maxaccess.io, Userway","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/148/"},{"id":"INC-06198","date":"2021-11-02","year":2021,"title":"Zillow Shut Down Zillow Offers Division Allegedly Due to Predictive Pricing Tool's Insufficient Accuracy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Zillow, Zillow Offers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/149/"},{"id":"INC-07334","date":"2018-07-21","year":2018,"title":"Swedish Contraceptive App, Natural Cycles, Allegedly Failed to Correctly Map Menstrual Cycle","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Natural Cycles","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/150/"},{"id":"INC-05513","date":"2021-10-28","year":2021,"title":"California Regulator Suspended Pony.ai's Driverless Testing Permit Following a Non-Fatal Collision","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pony.ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/151/"},{"id":"INC-05856","date":"2021-07-13","year":2021,"title":"SoftBank's Humanoid Robot, Pepper, Reportedly Frequently Made Errors, Prompting Dismissal","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Aldebaran, Softbank, Softbank Robotics","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/152/"},{"id":"INC-05147","date":"2022-01-26","year":2022,"title":"Justice Department’s Recidivism Risk Algorithm PATTERN Allegedly Caused Persistent Disparities Along Racial Lines","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Us Department Of Justice","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/154/"},{"id":"INC-05671","date":"2021-12-27","year":2021,"title":"Google Maps Allegedly Directed Sierra Nevada Travelers to Dangerous Roads amid Winter Storm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google Maps","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/155/"},{"id":"INC-05043","date":"2022-02-04","year":2022,"title":"Amazon Reportedly Sold Products and Recommended Frequently Bought Together Items That Aid Suicide Attempts","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/156/"},{"id":"INC-05471","date":"2021-03-15","year":2021,"title":"Amazon's Monitoring System Allegedly Pushed Delivery Drivers to Prioritize Speed over Safety, Leading to Crash","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/157/"},{"id":"INC-05644","date":"2021-02-01","year":2021,"title":"Remote Proctoring Facial-Detection Software Reportedly Failed to Detect Black Student During Lab Quiz","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown Remote Proctoring Software Developers, Unnamed Ohio College","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/158/"},{"id":"INC-07233","date":"2019-03-29","year":2019,"title":"Tesla Autopilot’s Lane Recognition Allegedly Vulnerable to Adversarial Attacks","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/159/"},{"id":"INC-07180","date":"2019-04-03","year":2019,"title":"Facebook's Ad Delivery Reportedly Excluded Audience along Racial and Gender Lines","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/161/"},{"id":"INC-07595","date":"2014-01-01","year":2014,"title":"ETS Used Allegedly Flawed Voice Recognition Evidence to Accuse and Assess Scale of Cheating, Causing Thousands to be Deported from the UK","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ets","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/162/"},{"id":"INC-05637","date":"2021-11-21","year":2021,"title":"Facebook’s Hate Speech Detection Algorithms Allegedly Disproportionately Failed to Remove Racist Content towards Minority Groups","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/163/"},{"id":"INC-07297","date":"2018-10-01","year":2018,"title":"Facebook \"News Feed\" Allegedly Boosted Misinformation and Violating Content Following Use of MSI Metric","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/164/"},{"id":"INC-06691","date":"2020-06-20","year":2020,"title":"Image Upscaling Algorithm PULSE Allegedly Produced Facial Images with Caucasian Features More Often","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Duke Researchers","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/165/"},{"id":"INC-06809","date":"2020-02-07","year":2020,"title":"Networking Platform Giggle Employs AI to Determine Users’ Gender, Allegedly Excluding Transgender Women","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Giggle, Kairos","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/166/"},{"id":"INC-07436","date":"2017-09-07","year":2017,"title":"Researchers' Homosexual-Men Detection Model Denounced as a Threat to LGBTQ People’s Safety and Privacy","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Michal Kosinski, Yilun Wang","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/167/"},{"id":"INC-05075","date":"2022-03-01","year":2022,"title":"Collaborative Filtering Prone to Popularity Bias, Resulting in Overrepresentation of Popular Items in the Recommendation Outputs","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Linkedin, Netflix, Twitter, Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/168/"},{"id":"INC-07299","date":"2018-08-15","year":2018,"title":"Facebook Allegedly Failed to Police Anti-Rohingya Hate Speech Content That Contributed to Violence in Myanmar","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/169/"},{"id":"INC-07704","date":"2003-06-01","year":2003,"title":"Target Suggested Maternity-Related Advertisements to a Teenage Girl's Home, Allegedly Correctly Predicting Her Pregnancy via Algorithm","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Target","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/170/"},{"id":"INC-06125","date":"2021-10-18","year":2021,"title":"Traffic Camera Misread Text on Pedestrian's Shirt as License Plate, Causing UK Officials to Issue Fine to an Unrelated Person","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Bath Government, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/171/"},{"id":"INC-06805","date":"2020-07-01","year":2020,"title":"NarxCare’s Risk Score Model Allegedly Lacked Validation and Trained on Data with High Risk of Bias","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Appriss, Avertd, Narxcare","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/172/"},{"id":"INC-05396","date":"2021-07-30","year":2021,"title":"AI Tools Failed to Sufficiently Predict COVID Patients, Some Potentially Harmful","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/173/"},{"id":"INC-05021","date":"2022-02-28","year":2022,"title":"Fake LinkedIn Profiles Created Using GAN Photos","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/174/"},{"id":"INC-05080","date":"2022-04-01","year":2022,"title":"Cruise Autonomous Taxi Allegedly Bolted off from Police After Being Pulled over in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/175/"},{"id":"INC-05200","date":"2022-03-02","year":2022,"title":"Starship’s Autonomous Food Delivery Robot Allegedly Stranded at Railroad Crossing in Oregon, Run over by Freight Train","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Oregon State University, Starship Technologies","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/176/"},{"id":"INC-05127","date":"2022-04-19","year":2022,"title":"Google’s Assistive Writing Feature Provided Allegedly Unnecessary and Clumsy Suggestions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google Docs","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/177/"},{"id":"INC-05022","date":"2022-04-21","year":2022,"title":"Tesla Owner Activated \"Smart Summon\" Feature, Causing a Collision with an Aircraft in a Washington Airport","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/178/"},{"id":"INC-05084","date":"2022-04-01","year":2022,"title":"DALL-E 2 Reported for Gender and Racially Biased Outputs","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/179/"},{"id":"INC-06330","date":"2020-02-19","year":2020,"title":"Algorithm Used by the Malaysian Judiciary Reportedly Recommended Unusually High Sentencing to a Drug Possession Case","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Malaysian Courts, Malaysian Judiciary, Sarawak Information Systems","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/180/"},{"id":"INC-05062","date":"2022-02-11","year":2022,"title":"BMW Sedan Made a Prohibited Left Turn, Colliding with a Cruise Autonomous Vehicle","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/181/"},{"id":"INC-07348","date":"2018-06-11","year":2018,"title":"Two Cruise Autonomous Vehicles Collided with Each Other in California","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/182/"},{"id":"INC-07368","date":"2017-07-01","year":2017,"title":"Airbnb's Trustworthiness Algorithm Allegedly Banned Users without Explanation, and Discriminated against Sex Workers","severity":"Critical","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Airbnb, Trooly","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/183/"},{"id":"INC-07304","date":"2018-04-12","year":2018,"title":"Facial Recognition Program in São Paulo Metro Stations Suspended for Illegal and Disproportionate Violation of Citizens’ Right to Privacy","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Companhia Do Metropolitano De Sao Paulo, Securos","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/184/"},{"id":"INC-05341","date":"2022-03-01","year":2022,"title":"TikTok's \"For You\" Algorithm Directed New Users towards Disinformation about the War in Ukraine","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/185/"},{"id":"INC-07689","date":"2007-07-26","year":2007,"title":"Algorithm Assessing Risk Faced by Victims of Gender Violence Misclassified Low-Risk Cases, Allegedly Leading to Homicide of Women and Children in Spain","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Spanish Ministry Of Interior, Spanish Secretary Of State For Security","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/186/"},{"id":"INC-05023","date":"2022-02-04","year":2022,"title":"YouTuber Tested Tesla on Self Driving Mode, Colliding with Street Pylons","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Ai Addict, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/187/"},{"id":"INC-07263","date":"2018-04-11","year":2018,"title":"Argentinian City Government Deployed Teenage-Pregnancy Predictive Algorithm Using Invasive Demographic Data","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft, Salta City Government","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/188/"},{"id":"INC-07217","date":"2019-10-15","year":2019,"title":"Opaque Fraud Detection Algorithm by the UK’s Department of Work and Pensions Allegedly Discriminated against People with Disabilities","severity":"Critical","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uipath, Uk Department Of Work And Pensions","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/189/"},{"id":"INC-07384","date":"2017-01-15","year":2017,"title":"ByteDance Allegedly Trained \"For You\" Algorithm Using Content Scraped without Consent from Other Social Platforms","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Bytedance","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/190/"},{"id":"INC-14605","date":"2020-10-06","year":2020,"title":"Korean Internet Portal Giant Naver Manipulated Shopping and Video Search Algorithms to Favor In-House Services","severity":"Critical","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"Naver","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/191/"},{"id":"INC-05338","date":"2022-03-17","year":2022,"title":"Three Make-Up Artists Lost Jobs Following Black-Box Automated Decision by HireVue","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Estee Lauder, Hirevue","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/192/"},{"id":"INC-07620","date":"2013-11-27","year":2013,"title":"Excessive Automated Monitoring Alerts Ignored by Staff, Resulting in Private Data Theft of Seventy Million Target Customers","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI08"],"cve_ids":[],"affected":"Fireeye, Target","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/193/"},{"id":"INC-07274","date":"2018-02-01","year":2018,"title":"Australian Telco’s Incident Management Bot Excessively Sent Technicians in the Field by Mistake, Allegedly Costing Millions","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Unknown, Unnamed Australian Telecommunications Company","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/194/"},{"id":"INC-07572","date":"2015-09-01","year":2015,"title":"Predictive Policing Program by Florida Sheriff’s Office Allegedly Violated Residents’ Rights and Targeted Children of Vulnerable Groups","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Pasco Sheriff's Office, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/195/"},{"id":"INC-07619","date":"2013-09-01","year":2013,"title":"Compromise of National Biometric ID Card System Leads to Reverification and Change of Status","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pakistan National Database And Registration Authority","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/196/"},{"id":"INC-05615","date":"2021-10-01","year":2021,"title":"Facebook Internally Reported Failure of Ranking Algorithm, Exposing Harmful Content to Viewers over Months","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/197/"},{"id":"INC-07183","date":"2019-03-01","year":2019,"title":"Fraudsters Used AI to Mimic Voice of a UK-Based Firm's CEO's Boss","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/200/"},{"id":"INC-06471","date":"2020-04-14","year":2020,"title":"Climate Action Group Posted Deepfake of Belgian Prime Minister Urging Climate Crisis Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Extinction Rebellion Belgium, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/201/"},{"id":"INC-05738","date":"2021-12-06","year":2021,"title":"Korean Politician Employed Deepfake as Campaign Representative","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown, Yoon Suk Yeol, Yoon Suk Yeol's Campaign","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/202/"},{"id":"INC-05346","date":"2022-02-10","year":2022,"title":"Uber Launched Opaque Algorithm That Changes Drivers' Payments in the US","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI10"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/203/"},{"id":"INC-05011","date":"2022-02-11","year":2022,"title":"A Chinese Tech Worker at Zhihu Fired Allegedly via a Resignation Risk Prediction Algorithm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Sangfor Technologies, Zhihu","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/204/"},{"id":"INC-08162","date":"2022-02-25","year":2022,"title":"AI-Generated Profiles Used in Disinformation Campaign Targeting Ukrainians","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Individuals In Russia, Individuals In The Donbass Region, Media Organizations In Crimea, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/205/"},{"id":"INC-07580","date":"2015-03-01","year":2015,"title":"Tinder's Personalized Pricing Algorithm Found to Offer Higher Prices for Older Users","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tinder","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/206/"},{"id":"INC-05689","date":"2021-01-10","year":2021,"title":"Hawaii Police Deployed Robot Dog to Patrol a Homeless Encampment","severity":"High","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Boston Dynamics, Honolulu Police Department","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/207/"},{"id":"INC-05443","date":"2020-10-20","year":2020,"title":"Tesla Disabled “Rolling Stop” Functionality Associated with the “Aggressive” Driving Mode","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/209/"},{"id":"INC-06709","date":"2020-04-28","year":2020,"title":"Indian Political App Tek Fog Allegedly Hijacked Trends and Manipulated Public Opinion on Other Social Media Platforms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bharatiya Janata Yuva Morcha, Persistent Systems","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/210/"},{"id":"INC-05371","date":"2021-12-11","year":2021,"title":"A Tesla Taxi Cab Involved in an Accident in Paris with Twenty Injuries","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Taxis G7, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/211/"},{"id":"INC-06191","date":"2021-01-01","year":2021,"title":"XPeng Motors Fined For Illegal Collection of Consumers’ Faces Using Facial Recognition Cameras","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Unknown, Xpeng Motors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/212/"},{"id":"INC-06590","date":"2020-07-01","year":2020,"title":"Facebook’s Political Ad Detection Reportedly Showed High and Geographically Uneven Error Rates","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/213/"},{"id":"INC-06918","date":"2020-01-02","year":2020,"title":"SN Technologies Reportedly Lied to a New York State School District about Its Facial and Weapon Detection Systems’ Performance","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lockport City School District, Sn Technologies","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/214/"},{"id":"INC-06561","date":"2020-04-01","year":2020,"title":"Facebook Content Moderators Demand Better Working Conditions Due to Allegedly Inadequate AI Content Moderation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/215/"},{"id":"INC-07458","date":"2017-10-10","year":2017,"title":"WeChat’s Machine Translation Gave a Racist English Translation for the Chinese Term for “Black Foreigner”","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Wechat","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/216/"},{"id":"INC-07519","date":"2016-11-16","year":2016,"title":"Robot at a Chinese Tech Fair Smashed a Glass Booth, Injuring a Visitor","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Evolver","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/217/"},{"id":"INC-06978","date":"2020-06-01","year":2020,"title":"Tesla on Autopilot Crashed into Flipped Truck on Taiwan Highway","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI05","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/218/"},{"id":"INC-06845","date":"2020-11-15","year":2020,"title":"Poachers Evaded AI Cameras and Killed Four Rhinos","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ezemvelo Kzn Wildlife, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/219/"},{"id":"INC-06566","date":"2020-11-11","year":2020,"title":"Facebook Mistakenly Blocked Small Business Ads","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/220/"},{"id":"INC-05184","date":"2022-03-07","year":2022,"title":"A Road Engineer Killed Following a Collision Involving a Tesla on Autopilot","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/221/"},{"id":"INC-06987","date":"2020-07-18","year":2020,"title":"Thoughts App Allegedly Created Toxic Tweets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Satria Technologies","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/222/"},{"id":"INC-07195","date":"2019-10-09","year":2019,"title":"Hive Box Facial-Recognition Locks Hacked by Fourth Graders Using Intended Recipient’s Facial Photo","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Hive Box","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/223/"},{"id":"INC-07120","date":"2020-07-01","year":2020,"title":"WeChat Pay's Facial Recognition Security Evaded by Scammers Using Victims’ Social Media Content","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Wechat, Wechat Pay","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/224/"},{"id":"INC-07417","date":"2017-04-07","year":2017,"title":"IBM Watson for Oncology Criticized by Customers for Allegedly Unsafe and Inaccurate Cancer Treatment Recommendations","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ibm Watson Health, Jupiter Hospital, Memorial Sloan Kettering","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/225/"},{"id":"INC-07585","date":"2015-04-01","year":2015,"title":"Waze Allegedly Clogged Streets and Directed Drivers to Make Unsafe Traffic Decisions","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waze","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/226/"},{"id":"INC-07355","date":"2018-01-12","year":2018,"title":"Waze App Allegedly Caused Tourists’ Car to End up in Lake Champlain, Vermont","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waze","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/227/"},{"id":"INC-07165","date":"2019-02-01","year":2019,"title":"Apple Maps Allegedly Directed Ski Trip Couple Onto Unpaved Road in the Mountains","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/228/"},{"id":"INC-07288","date":"2018-04-23","year":2018,"title":"Content Using Bestiality Thumbnails Allegedly Evaded YouTube’s Thumbnail Monitoring System","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/229/"},{"id":"INC-07213","date":"2019-03-01","year":2019,"title":"Model 3 Tesla on Autopilot Crashed into a Truck in Florida, Killing Driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/230/"},{"id":"INC-07466","date":"2016-01-20","year":2016,"title":"A Tesla Crashed into and Killed a Road Sweeper on a Highway in China","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/231/"},{"id":"INC-07338","date":"2018-04-29","year":2018,"title":"Tesla Model X on Autopilot Missed Parked Vehicles and Pedestrians, Killing Motorcyclist in Japan","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/232/"},{"id":"INC-07346","date":"2018-12-03","year":2018,"title":"Tumblr Automated Pornography-Detecting Algorithms Erroneously Flagged Inoffensive Images as Explicit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tumblr","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/233/"},{"id":"INC-07253","date":"2019-09-06","year":2019,"title":"Waze Allegedly Frequently Routed Drivers through the Town of Los Gatos, Blocking Its Single Wildfire Escape Route","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waze","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/234/"},{"id":"INC-07481","date":"2016-04-15","year":2016,"title":"Chinese Insurer Ping An Employed Facial Recognition to Determine Customers’ Untrustworthiness, Which Critics Alleged to Likely Make Errors and Discriminate","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ping An","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/235/"},{"id":"INC-05017","date":"2022-04-13","year":2022,"title":"AI-Generated Faces Used by Scammers to Pose as a Law Firm in Boston","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/236/"},{"id":"INC-07323","date":"2018-10-01","year":2018,"title":"Oregon’s Screening Tool for Child Abuse Cases Discontinued Following Concerns of Racial Bias","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Oregon Department Of Human Services","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/238/"},{"id":"INC-07668","date":"2009-09-01","year":2009,"title":"Algorithmic Teacher Evaluation Program Reportedly Failed to Improve Student Outcomes and Was Alleged to Have Harmed Teachers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Intensive Partnerships For Effective Teaching","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/239/"},{"id":"INC-05656","date":"2021-06-29","year":2021,"title":"GitHub Copilot, Copyright Infringement and Open Source Licensing","severity":"High","attack_vector":"rce","owasp_llm":["LLM02","LLM03","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"Github, Programmers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/240/"},{"id":"INC-05024","date":"2022-07-21","year":2022,"title":"Chess-Playing Robot Broke Child's Finger in Russia","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Russian Chess Federation, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/241/"},{"id":"INC-05749","date":"2021-02-24","year":2021,"title":"Manufacturing Robot Failure Caused Factory Worker's Death in India","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Chakan Plant Of Automotive Stampings And Assemblies, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/242/"},{"id":"INC-06407","date":"2020-01-01","year":2020,"title":"Bots Allegedly Made up Roughly Half of Twitter Accounts in Discussions Surrounding COVID-19 Related Issues","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/243/"},{"id":"INC-06475","date":"2020-08-03","year":2020,"title":"Colorado Police’s Automated License Plate Reader (ALPR) Matched a Family’s Minivan’s Plate to That of a Stolen Vehicle Allegedly, Resulting in Detainment at Gunpoint","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Aurora Police Department, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/244/"},{"id":"INC-07679","date":"2009-03-30","year":2009,"title":"Unverified Misreading by Automated Plate Reader Led to Traffic Stop and Restraint of an Innocent Person at Gunpoint in California","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"San Francisco Police Department, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/245/"},{"id":"INC-07603","date":"2014-04-16","year":2014,"title":"Misreading of an Automated License Plate Reader (ALPR) Unverified by Police, Resulting in Traffic Stop in Missouri","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Prairie Village Police Department, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/246/"},{"id":"INC-07326","date":"2018-11-23","year":2018,"title":"Reported Automated License Plate Reader Alert on Previously Stolen Rental Car Leads to Alleged Wrongful Detainment in California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Contra Costa County Sheriff, Vigilant Solutions","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/248/"},{"id":"INC-07500","date":"2016-10-01","year":2016,"title":"Government Deployed Extreme Surveillance Technologies to Monitor and Target Muslim Minorities in Xinjiang","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chinese Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/249/"},{"id":"INC-07485","date":"2016-02-01","year":2016,"title":"Dutch City Court Defended Home Value Generated by Black-Box Algorithm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI10"],"cve_ids":[],"affected":"Castricum Municipality","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/250/"},{"id":"INC-07266","date":"2018-08-01","year":2018,"title":"Amazon Allegedly Tweaked Search Algorithm to Boost Its Own Products","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/251/"},{"id":"INC-05025","date":"2022-06-01","year":2022,"title":"Remotely Operated Taser-Armed Drones Proposed by Taser Manufacturer as Defense for School Shootings in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Axon Enterprise, None","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/252/"},{"id":"INC-07565","date":"2015-05-01","year":2015,"title":"Google’s Face Grouping Allegedly Collected and Analyzed Users’ Facial Structure without Consent, Violated BIPA","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/254/"},{"id":"INC-06331","date":"2020-05-31","year":2020,"title":"Unreliable ShotSpotter Audio Previously Used to Convict Chicago Man in Murder Case","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Chicago Police Department, Shotspotter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/255/"},{"id":"INC-05581","date":"2021-11-07","year":2021,"title":"DUI Arrest Case Allegedly Based Only on ShotSpotter's Alert","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Chicago Police Department, Shotspotter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/256/"},{"id":"INC-07649","date":"2012-05-04","year":2012,"title":"Police Reportedly Deployed ShotSpotter Sensors Disproportionately in Neighborhoods of Color","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Atlanta Police Department, Chicago Police Department, Cleveland Division Of Police, Kansas City Police Department,…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/257/"},{"id":"INC-05053","date":"2022-05-13","year":2022,"title":"Australian Retailers Reportedly Captured Face Prints of Their Customers without Consent","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Bunnings, Kmart, The Good Guys, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/258/"},{"id":"INC-05364","date":"2022-06-03","year":2022,"title":"YouTuber Built, Made Publicly Available, and Released Model Trained on Toxic 4chan Posts as Prank","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Yannic Kilcher","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/259/"},{"id":"INC-07614","date":"2014-08-26","year":2014,"title":"US DHS’s Opaque Vetting Software Allegedly Relied on Poor-Quality Data and Discriminated against Immigrants","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Us Citizenship And Immigration Services, Us Department Of Homeland Security","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/260/"},{"id":"INC-07437","date":"2017-11-15","year":2017,"title":"Robot Deployed by Animal Shelter to Patrol Sidewalks outside Its Office, Warding off Homeless People in San Francisco","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Knightscope, Society For The Prevention Of Cruelty To Animals","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/261/"},{"id":"INC-05085","date":"2022-06-11","year":2022,"title":"DALL-E Mini Reportedly Reinforced or Exacerbated Societal Biases in Its Outputs as Gender and Racial Stereotypes","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Boris Dayma, Khalid Saifullah, Luke Melas, Pedro Cuenca, Phuc Le Khac, Ritobrata Ghosh, Suraj Patil, Tanishq Abraham","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/262/"},{"id":"INC-07590","date":"2015-09-01","year":2015,"title":"YouTube Recommendations Implicated in Political Radicalization of User","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/263/"},{"id":"INC-05016","date":"2022-03-01","year":2022,"title":"AI-Based Vehicle Speed Estimation App Denounced by UK Drivers as Surveillance Technology","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Speedcam Anywhere","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/264/"},{"id":"INC-05508","date":"2021-04-01","year":2021,"title":"Black Uber Eats Driver Allegedly Subjected to Excessive Photo Checks and Dismissed via FRT Results","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uber Eats","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/265/"},{"id":"INC-05180","date":"2022-01-15","year":2022,"title":"Replika's \"AI Companions\" Reportedly Abused by Its Users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Replika","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/266/"},{"id":"INC-07386","date":"2017-06-15","year":2017,"title":"Clearview AI Algorithm Built on Photos Scraped from Social Media Profiles without Consent","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM05","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Clearview Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/267/"},{"id":"INC-06332","date":"2020-03-16","year":2020,"title":"Permanent Removal of Social Media Content via Automated Tools Allegedly Prevented Investigative Efforts","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook, Twitter, Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/268/"},{"id":"INC-07651","date":"2011-04-18","year":2011,"title":"Apple Tweaked App Store Ranking Algorithms, Allegedly Resulted in Demotion of Local Apps in China","severity":"High","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/270/"},{"id":"INC-05026","date":"2022-07-24","year":2022,"title":"Tesla Model 3 Sedan on Autopilot Killed Motorcyclist in a Rear-End Collision in Utah","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/271/"},{"id":"INC-07191","date":"2019-10-08","year":2019,"title":"Grab Tweaked Matchmaking Algorithm, Providing Preferential Treatment to Drivers Registered with Affiliated Car Rental Service","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grab","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/272/"},{"id":"INC-06549","date":"2020-12-24","year":2020,"title":"FaceApp Predicted Different Genders for Similar User Photos with Slight Variations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Faceapp","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/273/"},{"id":"INC-07706","date":"2003-07-01","year":2003,"title":"Virginia Courts’ Algorithmic Recidivism Risk Assessment Failed to Lower Incarceration Rates","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Virginia Courts, Virginia Department Of Criminal Justice Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/274/"},{"id":"INC-06589","date":"2020-06-11","year":2020,"title":"Facebook’s Moderation Algorithm Banned Users for Historical Evidence of Slavery","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/275/"},{"id":"INC-05156","date":"2022-01-01","year":2022,"title":"Local South Korean Government’s Use of CCTV Footage Analysis via Facial Recognition to Track COVID Cases Raised Concerns about Privacy, Retention, and Potential Misuse","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Bucheon City Government, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/276/"},{"id":"INC-05355","date":"2022-01-14","year":2022,"title":"Voices Created Using Publicly Available App Stolen and Resold as NFT without Attribution","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"15.ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/277/"},{"id":"INC-05160","date":"2022-08-07","year":2022,"title":"Meta’s BlenderBot 3 Chatbot Demo Made Offensive Antisemitic Comments","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/278/"},{"id":"INC-08163","date":"2019-07-01","year":2019,"title":"TikTok’s “For You” Algorithm Exposed Young Users to Pro-Eating Disorder Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/279/"},{"id":"INC-07617","date":"2013-07-30","year":2013,"title":"Coffee Meets Bagel’s Algorithm Reported by Users Disproportionately Showing Them Matches of Their Own Ethnicities Despite Selecting “No Preference”","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Coffee Meets Bagel","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/280/"},{"id":"INC-07260","date":"2019-02-04","year":2019,"title":"YouTube's Algorithms Failed to Remove Violating Content Related to Suicide and Self-Harm","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/281/"},{"id":"INC-06588","date":"2020-10-03","year":2020,"title":"Facebook’s Algorithm Mistook an Advertisement of Onions as Sexual Suggestive Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/282/"},{"id":"INC-07301","date":"2018-07-02","year":2018,"title":"Facebook’s Automated Content Moderation Tool Flagged a Post Containing Parts of the Declaration of Independence as Hate Speech by Mistake","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/283/"},{"id":"INC-07302","date":"2018-05-01","year":2018,"title":"Facebook’s Automated Removal of Content Featuring Nudity-Containing Artworks Denounced as Censorship","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/284/"},{"id":"INC-05124","date":"2022-07-18","year":2022,"title":"Google Lens’s Camera-Based Translation Feature Provided an Offensive Mistranslation of a Book Title in Korean","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/285/"},{"id":"INC-06829","date":"2020-10-27","year":2020,"title":"OpenAI’s GPT-3 Reported as Unviable in Medical Tasks by Healthcare Firm","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Nabla, None, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/287/"},{"id":"INC-06928","date":"2020-06-15","year":2020,"title":"Starship Delivery Robot Scuffed Bumper of a Resident’s Car in Texas, Allegedly Refusing to Release Footage of the Accident","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/289/"},{"id":"INC-05110","date":"2022-06-03","year":2022,"title":"False Negatives for Water Quality-Associated Beach Closures","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Toronto City Government, Toronto Public Health","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/290/"},{"id":"INC-05487","date":"2021-09-01","year":2021,"title":"Apple’s AVs Reportedly Struggled to Navigate Streets in Silicon Valley Test Drives","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/292/"},{"id":"INC-05083","date":"2022-06-03","year":2022,"title":"Cruise’s Self-Driving Car Involved in a Multiple-Injury Collision at an San Francisco Intersection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/293/"},{"id":"INC-07335","date":"2018-05-26","year":2018,"title":"Tesla Autopilot Allegedly Malfunctioned in a Non-Fatal Collision in Greece","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/294/"},{"id":"INC-07357","date":"2018-11-08","year":2018,"title":"Wrongful Attempted Arrest for Apple Store Thefts Due to NYPD’s Facial Misidentification","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"New York Police Department, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/295/"},{"id":"INC-07535","date":"2016-02-10","year":2016,"title":"Twitter Recommender System Amplified Right-Leaning Tweets","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Twitter","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/296/"},{"id":"INC-14606","date":"2020-02-20","year":2020,"title":"EasyMile Self-Driving Shuttle Unexpectedly Stopped Mid-Route, Injuring a Passenger","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Easymile, Smart Columbus","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/297/"},{"id":"INC-05864","date":"2021-10-21","year":2021,"title":"Student-Developed Facial Recognition App Raised Ethical Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Yuen Ler Chow","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/298/"},{"id":"INC-06746","date":"2020-12-15","year":2020,"title":"Japanese Porn Depixelated by Man using Deepfake","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Masayuki Nakamoto, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/299/"},{"id":"INC-05342","date":"2022-01-15","year":2022,"title":"TikTok's \"For You\" Algorithm Allegedly Abused by Online Personality to Promote Anti-Women Hate","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/300/"},{"id":"INC-05205","date":"2022-02-15","year":2022,"title":"Honorlock's AI Proctoring System Reportedly Led Broward College to Accuse a Teenager of Cheating","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Broward College, Honorlock","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/301/"},{"id":"INC-05865","date":"2021-03-15","year":2021,"title":"Dartmouth's Geisel School of Medicine Reportedly Used Canvas Activity Logs to Accuse Students of Cheating","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Canvas, Geisel School Of Medicine, Geisel School Of Medicine's Technology Staff","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/302/"},{"id":"INC-05027","date":"2022-08-21","year":2022,"title":"Google’s Automated Child Abuse Detection Wrongfully Flagged a Parent’s Naked Photo of His Child","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/303/"},{"id":"INC-06096","date":"2021-11-03","year":2021,"title":"Tesla on FSD Reportedly Drove into the Wrong Lane in California","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/304/"},{"id":"INC-07261","date":"2019-02-01","year":2019,"title":"YouTube’s Recommendation Algorithm Allegedly Promoted Climate Misinformation Content","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/305/"},{"id":"INC-07530","date":"2016-05-26","year":2016,"title":"Tesla on Autopilot TACC Crashed into Van on European Highway","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/306/"},{"id":"INC-07421","date":"2017-11-01","year":2017,"title":"iPhone Face ID Failed to Recognize Users’ Morning Faces","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/307/"},{"id":"INC-07378","date":"2017-07-03","year":2017,"title":"Atlas Robot Fell off Stage at Conference","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Boston Dynamics","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/308/"},{"id":"INC-07399","date":"2017-08-26","year":2017,"title":"Facial Recognition Trial Performed Poorly at Notting Hill Carnival","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Metropolitan Police Service, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/309/"},{"id":"INC-07411","date":"2017-06-03","year":2017,"title":"High False Positive Rate by SWP's Facial Recognition Use at Champion's League Final","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Nec, South Wales Police","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/310/"},{"id":"INC-07137","date":"2020-05-02","year":2020,"title":"YouTube Auto-Moderation Mistakenly Banned Women of Sex Tech Conference","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/311/"},{"id":"INC-05862","date":"2021-08-15","year":2021,"title":"Startup's Accent Translation AI Denounced as Reinforcing Racial Bias","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Sanas","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/312/"},{"id":"INC-05060","date":"2022-08-25","year":2022,"title":"BlenderBot 3 Cited Dutch Politician as a Terrorist","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/313/"},{"id":"INC-05194","date":"2022-08-17","year":2022,"title":"Stable Diffusion Abused by 4chan Users to Deepfake Celebrity Porn","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"Compvis Lmu, Eleutherai, Laion, Runway, Stability Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/314/"},{"id":"INC-07493","date":"2016-04-09","year":2016,"title":"Facial Recognition Service Abused to Target Russian Porn Actresses","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ntechlab","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/315/"},{"id":"INC-07490","date":"2016-06-02","year":2016,"title":"Facebook Ad-Approval Algorithm Allegedly Missed Fraudulent Ads via Simple URL Checks","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/316/"},{"id":"INC-06412","date":"2020-03-17","year":2020,"title":"Bug in Facebook’s Anti-Spam Filter Allegedly Blocked Legitimate Posts about COVID-19","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/317/"},{"id":"INC-05618","date":"2021-01-13","year":2021,"title":"Facebook Recommended Military Gear Ads Despite Pause on Weapons Accessories Ads","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/318/"},{"id":"INC-07242","date":"2019-12-29","year":2019,"title":"Tesla on Autopilot Fatally Crashed into Parked Fire Truck in Indiana","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/319/"},{"id":"INC-07339","date":"2018-01-22","year":2018,"title":"Tesla on Autopilot Collided with Parked Fire Truck on California Freeway","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/320/"},{"id":"INC-07337","date":"2018-03-23","year":2018,"title":"Tesla Model X on Autopilot Crashed into California Highway Barrier, Killing Driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/321/"},{"id":"INC-07234","date":"2019-12-07","year":2019,"title":"Tesla Model 3 Crashed into Police Patrol Car on Connecticut Highway","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/322/"},{"id":"INC-05020","date":"2018-05-29","year":2018,"title":"Tesla on Autopilot Crashed into Parked Police Car in California","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI01","ASI08","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/323/"},{"id":"INC-07184","date":"2019-11-12","year":2019,"title":"GAN Faces Deployed by The BL's Fake Account Network to Push Pro-Trump Content on Meta Platforms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"The Bl, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/324/"},{"id":"INC-07432","date":"2017-09-21","year":2017,"title":"Offensive Instagram User Content Displayed as Facebook Ad","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/325/"},{"id":"INC-07597","date":"2014-12-09","year":2014,"title":"Facebook Automated Year-in-Review Highlights Showed Users Painful Memories","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/326/"},{"id":"INC-07559","date":"2015-03-24","year":2015,"title":"Facebook’s On-This-Day Feature Mistakenly Showed Painful Memories to Users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/327/"},{"id":"INC-06609","date":"2020-06-13","year":2020,"title":"Fake Accounts Using GAN Faces Deployed by Propaganda Campaign on Social Platforms","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Spamouflage Dragon, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/328/"},{"id":"INC-07373","date":"2017-09-18","year":2017,"title":"Amazon Reportedly Recommends Explosive-Producing Ingredients as 'Frequently Bought Together' Items for Chemicals","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/329/"},{"id":"INC-07548","date":"2016-12-15","year":2016,"title":"“Amazon’s Choice” Algorithm Failed to Recommend Functional Products and Prone to Review Manipulation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/330/"},{"id":"INC-06413","date":"2020-08-05","year":2020,"title":"Bug in Instagram’s “Related Hashtags” Algorithm Allegedly Caused Disproportionate Treatment of Political Hashtags","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Instagram","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/331/"},{"id":"INC-07497","date":"2016-04-05","year":2016,"title":"Google Image Showed Racially Biased Results for “Professional” Hairstyles","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/332/"},{"id":"INC-06093","date":"2021-03-17","year":2021,"title":"Tesla on Autopilot Crashed Parked Michigan Police Car on Interstate","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM03","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/333/"},{"id":"INC-07612","date":"2014-10-01","year":2014,"title":"Uber Deployed Secret Program To Deny Local Authorities Rides","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/334/"},{"id":"INC-07583","date":"2015-03-01","year":2015,"title":"UK Visa Streamline Algorithm Allegedly Discriminated Based on Nationality","severity":"Critical","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Uk Home Office, Uk Visas And Immigration","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/335/"},{"id":"INC-07582","date":"2015-03-01","year":2015,"title":"UK Home Office's Sham Marriage Detection Algorithm Reportedly Flagged Certain Nationalities Disproportionately","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uk Home Office","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/336/"},{"id":"INC-06089","date":"2021-04-17","year":2021,"title":"Tesla Model S on ACC Crashed into Tree in Texas, Killing Two People","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/337/"},{"id":"INC-05170","date":"2022-09-15","year":2022,"title":"Students Reportedly Used Generative Text Tools to Complete School Assignments and Exams","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Students, Sudowrite","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/339/"},{"id":"INC-07413","date":"2017-02-01","year":2017,"title":"Honda's CMBS False Positives Allegedly Caused Accidents to Customers","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Honda","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/340/"},{"id":"INC-07430","date":"2017-04-06","year":2017,"title":"Nissan's \"Automatic Emergency Braking\" False Positives Posed Traffic Risks to Drivers","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Nissan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/341/"},{"id":"INC-05634","date":"2021-07-11","year":2021,"title":"Facebook, Instagram, and Twitter Failed to Proactively Remove Targeted Racist Remarks via Automated Systems","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Instagram, Twitter","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/343/"},{"id":"INC-05691","date":"2021-07-01","year":2021,"title":"Hiring Algorithms Provided Invalid Positive Results for Interview Responses in German","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Curious Thing, Myinterview","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/344/"},{"id":"INC-05493","date":"2021-04-13","year":2021,"title":"Auto-Insurance Photo-Based Estimation Allegedly Gave Inaccurate Repair Prices Frequently","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ccc Information Services, Insurance Companies, Tractable","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/345/"},{"id":"INC-07520","date":"2016-06-15","year":2016,"title":"Robots in Japanese Hotel Annoyed Guests and Failed to Handle Simple Tasks","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Henn Na Hotel, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/346/"},{"id":"INC-06182","date":"2021-05-06","year":2021,"title":"Waymo Self-Driving Taxi Reportedly Behaved Unexpectedly, Driving away from Support Crew","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/347/"},{"id":"INC-07139","date":"2020-11-01","year":2020,"title":"YouTube Recommendation Reportedly Pushed Election Fraud Content to Skeptics Disproportionately","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/348/"},{"id":"INC-05100","date":"2022-03-22","year":2022,"title":"Evolv AI Weapons Detection System Allegedly Misrepresents Accuracy, Leading to School Security Gaps","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Charlotte Mecklenburg School District, Evolv Technology","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/349/"},{"id":"INC-05028","date":"2022-09-13","year":2022,"title":"Delivery Robot Rolled Through Crime Scene","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Serve Robotics","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/350/"},{"id":"INC-05029","date":"2022-09-13","year":2022,"title":"\"The Little Mermaid\" Clip Doctored Using Generative AI to Replace Black Actress with White Character","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@tengazillioiniq, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/351/"},{"id":"INC-05128","date":"2022-09-15","year":2022,"title":"GPT-3-Based Twitter Bot Hijacked Using Prompt Injection Attacks","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Openai, Stephan De Vries","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/352/"},{"id":"INC-07241","date":"2019-03-01","year":2019,"title":"Tesla on Autopilot Crashed into Trailer Truck in Florida, Killing Driver","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/353/"},{"id":"INC-07036","date":"2020-06-20","year":2020,"title":"Uber Allegedly Violated GDPR by Failing to Provide Sufficient Notice on Automated Profiling for Drivers","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/354/"},{"id":"INC-07349","date":"2018-07-07","year":2018,"title":"Uber Allegedly Wrongfully Accused Drivers of Fraud via Automated Systems","severity":"High","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI09","ASI10"],"cve_ids":[],"affected":"Uber","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/355/"},{"id":"INC-06839","date":"2020-09-15","year":2020,"title":"Philosophy AI Tentatively Produced Offensive Results for Certain Prompts","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Murat Ayfer, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/356/"},{"id":"INC-07189","date":"2019-02-14","year":2019,"title":"GPT-2 Reportedly Reproduced Personal Data from Its Training Data","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/357/"},{"id":"INC-07280","date":"2018-06-01","year":2018,"title":"Calgary Malls Deployed Facial Recognition without Customer Consent","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Cadillac Fairview, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/358/"},{"id":"INC-05633","date":"2021-05-23","year":2021,"title":"Facebook, Instagram, and Twitter Cited Errors in Automated Systems as Cause for Blocking pro-Palestinian Content on Israeli-Palestinian Conflict","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Instagram, Twitter","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/359/"},{"id":"INC-05753","date":"2021-10-15","year":2021,"title":"McDonald's AI Drive-Thru Allegedly Collected Biometric Customer Data without Consent, Violating BIPA","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Apprente, Mcd Tech Labs, Mcdonald's","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/360/"},{"id":"INC-07268","date":"2018-05-11","year":2018,"title":"Amazon Echo Mistakenly Recorded and Sent Private Conversation to Random Contact","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/361/"},{"id":"INC-05629","date":"2021-07-20","year":2021,"title":"Facebook's Automated Moderation Flagged Gardening Group's Language Use by Mistake","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/362/"},{"id":"INC-05630","date":"2021-01-15","year":2021,"title":"Facebook's Automated Moderation Mistakenly Flagged Landmark's Name as Offensive","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/363/"},{"id":"INC-07116","date":"2020-04-15","year":2020,"title":"Walmart's Bagging-Detection False Positives Exposed Workers to Health Risk","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Everseen, Walmart","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/364/"},{"id":"INC-06942","date":"2020-09-20","year":2020,"title":"Suicide Clips Evaded TikTok's Automated Moderation in Coordinated Attack","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/366/"},{"id":"INC-06689","date":"2020-06-17","year":2020,"title":"iGPT, SimCLR Learned Biased Associations from Internet Training Data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/367/"},{"id":"INC-07494","date":"2016-06-01","year":2016,"title":"Facial Recognition Smart Phone App \"Blue Wolf\" Monitored Palestinians in West Bank","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Anyvision, The Israel Military","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/368/"},{"id":"INC-05116","date":"2022-08-29","year":2022,"title":"GAN Artwork Won First Place at State Fair Competition","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Jason Allen, Midjourney","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/369/"},{"id":"INC-07406","date":"2017-09-27","year":2017,"title":"Google Fined for Changing Shopping Algorithms in EU to Favor Own Service","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/370/"},{"id":"INC-07250","date":"2019-11-29","year":2019,"title":"Uganda Deployed Huawei's Facial Recognition to Monitor Political Opposition and Protests","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Huawei, Ugandan Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/371/"},{"id":"INC-05353","date":"2022-07-22","year":2022,"title":"Users Reported Security Issues with Google Pixel 6a's Fingerprint Unlocking","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/372/"},{"id":"INC-07623","date":"2013-10-01","year":2013,"title":"Michigan's Unemployment Benefits Algorithm MiDAS Issued False Fraud Claims to Thousands of People","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Csg Government Solutions, Fast Enterprises, Michigan Unemployment Insurance Agency","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/373/"},{"id":"INC-07051","date":"2020-08-13","year":2020,"title":"UK Ofqual's Algorithm Disproportionately Provided Lower Grades Than Teachers' Assessments","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI08","ASI09"],"cve_ids":[],"affected":"Uk Office Of Qualifications And Examinations Regulation","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/374/"},{"id":"INC-07245","date":"2019-09-29","year":2019,"title":"Thai Wallet App's Facial Recognition Errors Created Registration Issues for Government Programs","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Krungthai Bank","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/375/"},{"id":"INC-07469","date":"2016-09-01","year":2016,"title":"RealPage Algorithm Allegedly Inflates Rents and Reduces Competition in Housing Market","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Jeffrey Roper, Realpage, Thoma Bravo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/376/"},{"id":"INC-05359","date":"2022-10-11","year":2022,"title":"Weibo Model Had Difficulty Detecting Shifts in Censored Speech","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Weibo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/377/"},{"id":"INC-05344","date":"2022-04-06","year":2022,"title":"TuSimple Truck Steered into Interstate Freeway Divide","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tusimple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/378/"},{"id":"INC-07713","date":"1992-05-25","year":1992,"title":"Error in Pepsi's Number Generation System Led to Decades-Long Damages in the Philippines","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"D.g. Consultores, Pepsi","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/379/"},{"id":"INC-07598","date":"2014-03-04","year":2014,"title":"Facebook's Auto-Generated Targeting Ad Categories Contained Anti-Semitic Options","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/380/"},{"id":"INC-06384","date":"2020-10-29","year":2020,"title":"Autonomous Roborace Car Drove Directly into a Wall","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Sit Acronis Autonomous","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/381/"},{"id":"INC-07366","date":"2017-11-21","year":2017,"title":"Instagram's Exposure of Harmful Content Contributed to Teenage Girl’s Suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/382/"},{"id":"INC-05123","date":"2022-10-04","year":2022,"title":"Google Home Mini Speaker Reportedly Read N-Word in Song Title Aloud","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google Home","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/383/"},{"id":"INC-05122","date":"2022-10-03","year":2022,"title":"Glovo Driver in Italy Fired via Automated Email after Being Killed in Accident","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Glovo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/384/"},{"id":"INC-05063","date":"2022-10-04","year":2022,"title":"Canadian Police's Release of Suspect's AI-Generated Facial Photo Reportedly Reinforced Racial Profiling","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Edmonton Police Service, Parabon Nanolabs","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/385/"},{"id":"INC-07160","date":"2019-07-03","year":2019,"title":"Amazon’s \"Time Off Task\" System Made False Assumptions about Workers' Time Management","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/386/"},{"id":"INC-07606","date":"2014-12-22","year":2014,"title":"Oracle's Algorithmic Data Processing System Alleged as Unlawful and Violating Privacy Rights","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Oracle","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/387/"},{"id":"INC-07303","date":"2018-12-01","year":2018,"title":"Facial Recognition Pilot in Bahia Reportedly Targeted Black and Poor People","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bahia's Secretary Of Public Security, Huawei, The Government In Bahia","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/388/"},{"id":"INC-05093","date":"2022-06-28","year":2022,"title":"Deepfakes Reportedly Deployed in Online Interviews for Remote Work Positions","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/390/"},{"id":"INC-05108","date":"2022-07-26","year":2022,"title":"Facial Recognition Trial by UK Southern Co-op Alleged as Unlawful","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Hikvision, Southern Co Op","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/391/"},{"id":"INC-07549","date":"2015-06-01","year":2015,"title":"Facebook's AI-Supported Moderation Failed to Classify Terrorist Content in East African Languages","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/392/"},{"id":"INC-05444","date":"2021-12-08","year":2021,"title":"Facebook AI-Supported Moderation for Ads Failed to Detect Violating Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/393/"},{"id":"INC-07441","date":"2017-03-15","year":2017,"title":"Social Media's Automated Word-Flagging without Context Shifted Content Creators' Language Use","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram, Tiktok, Twitch, Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/394/"},{"id":"INC-05456","date":"2021-03-02","year":2021,"title":"Amazon Forced Deployment of AI-Powered Cameras on Delivery Drivers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Amazon, Netradyne","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/395/"},{"id":"INC-07344","date":"2018-07-04","year":2018,"title":"Transgender Uber Drivers Mistakenly Kicked off App for Appearance Change during Gender Transitions","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uber","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/396/"},{"id":"INC-05162","date":"2022-09-11","year":2022,"title":"Misinformation Reported in TikTok's Search Results Despite Moderation by AI and Human","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/397/"},{"id":"INC-05030","date":"2022-08-15","year":2022,"title":"Tesla Autopilot Misidentified On-Road Horse-Drawn Carriage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/398/"},{"id":"INC-05031","date":"2022-11-15","year":2022,"title":"Meta AI's Scientific Paper Generator Reportedly Produced Inaccurate and Harmful Content","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/399/"},{"id":"INC-05126","date":"2022-02-23","year":2022,"title":"Google Search Returned Fewer Results for Abortion Services in Rural Areas","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/400/"},{"id":"INC-05733","date":"2021-06-03","year":2021,"title":"Kannada Insulted by Google's Featured Answer as \"Ugliest Language in India\"","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/401/"},{"id":"INC-05798","date":"2021-04-01","year":2021,"title":"Players Manipulated GPT-3-Powered Game to Generate Sexually Explicit Material Involving Children","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Latitude, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/402/"},{"id":"INC-07306","date":"2018-01-15","year":2018,"title":"Gmail’s Inbox Sorting System Reportedly Reduced Visibility of Political Emails and Campaign Calls-to-Action","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/403/"},{"id":"INC-07229","date":"2019-06-25","year":2019,"title":"Sound Intelligence's Aggression Detector Misidentified Innocuous Sounds","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Pinecrest Academy Horizon, Rock Hill Schools, Sound Intelligence","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/404/"},{"id":"INC-07329","date":"2018-11-28","year":2018,"title":"Schufa Credit Scoring in Germany Reported for Unreliable and Imbalanced Scores","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Schufa Holding Ag","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/405/"},{"id":"INC-07557","date":"2015-07-15","year":2015,"title":"Facebook's Friend Suggestion Feature Recommends Patients of Psychiatrist to Each Other","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/406/"},{"id":"INC-07538","date":"2016-02-03","year":2016,"title":"Uber's Surge Pricing Reportedly Offered Disproportionate Service Quality along Racial Lines","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Uber","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/407/"},{"id":"INC-07397","date":"2017-04-15","year":2017,"title":"Facebook Reportedly Outed Sex Workers through Friend Recommendations","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/408/"},{"id":"INC-07621","date":"2013-09-13","year":2013,"title":"Facial Recognition Researchers Used YouTube Videos of Transgender People without Consent","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Gayathri Mahalingam, Karl Ricanek, University Of North Carolina Wilmington","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/409/"},{"id":"INC-05150","date":"2022-11-09","year":2022,"title":"KFC Sent Insensitive Kristallnacht Promotion via Holiday Detection System","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Kfc","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/410/"},{"id":"INC-05032","date":"2022-11-27","year":2022,"title":"Chinese Accounts Spammed Twitter Feed Allegedly to Obscure News of Protests","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Twitter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/411/"},{"id":"INC-06618","date":"2020-01-15","year":2020,"title":"Finnish Police Were Reportedly Reprimanded After National Bureau of Investigation Unit Allegedly Used Clearview AI to Identify Potential Abuse Victims","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Clearview Ai, Facial Recognition System Developers, Finland National Bureau Of Investigation, Finnish National Police…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/412/"},{"id":"INC-05337","date":"2022-11-30","year":2022,"title":"Thousands of Incorrect ChatGPT-Produced Answers Posted on Stack Overflow","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/413/"},{"id":"INC-06565","date":"2020-01-18","year":2020,"title":"Facebook Gave Vulgar English Translation of Chinese President's Name","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/414/"},{"id":"INC-06567","date":"2020-07-28","year":2020,"title":"Facebook Provided Offensive Translation for King of Thailand's Birthday Ceremony","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/415/"},{"id":"INC-05106","date":"2022-12-01","year":2022,"title":"Facebook's Job Ad Algorithm Allegedly Biased against Older and Female Workers","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/416/"},{"id":"INC-07178","date":"2019-11-15","year":2019,"title":"Facebook Feed Algorithms Exposed Low Digitally Skilled Users to More Disturbing Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/417/"},{"id":"INC-07449","date":"2017-03-13","year":2017,"title":"Uber Locked Indian Drivers out of Accounts Allegedly Due to Facial Recognition Fails","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Azure Cognitive Services, Uber","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/418/"},{"id":"INC-05105","date":"2022-12-01","year":2022,"title":"Facebook's Automated Moderation Allowed Ads Threatening Election Workers to be Posted","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/419/"},{"id":"INC-05352","date":"2022-11-30","year":2022,"title":"Users Bypassed ChatGPT's Content Filters with Ease","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/420/"},{"id":"INC-05089","date":"2022-11-22","year":2022,"title":"Deepfake of FTX's Former CEO Posted on Twitter Aiming to Scam FTX Collapse Victims","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/422/"},{"id":"INC-07066","date":"2020-03-09","year":2020,"title":"Canadian Universities' AI Proctoring Tools Reportedly Collected Student Biometric Data Without Adequate Consent","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Canadian Universities, Educators, Examity, Proctorexam, Proctorio, Proctortrack, Proctoru, Professors, Respondus…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/424/"},{"id":"INC-05863","date":"2021-06-12","year":2021,"title":"State Farm Allegedly Discriminated against Black Customers in Claim Payout","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"State Farm","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/425/"},{"id":"INC-05361","date":"2022-09-23","year":2022,"title":"XPeng P7 Crashed into Truck in Shangdong While on Automatic Navigation Assisted Driving","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Xpeng","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/426/"},{"id":"INC-05082","date":"2022-03-15","year":2022,"title":"Cruise Taxis' Sudden Braking Allegedly Put People at Risk","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/427/"},{"id":"INC-07382","date":"2017-05-19","year":2017,"title":"BBC Reporter's Twin Brother Cracked HSBC's Voice ID Authentication","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Hsbc Uk, Nuance Communications","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/428/"},{"id":"INC-07541","date":"2016-04-01","year":2016,"title":"Unreliable ShotSpotter Audio Convicted Black Rochester Man of Shooting Police","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Rochester Police Department, Shotspotter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/429/"},{"id":"INC-05152","date":"2022-12-19","year":2022,"title":"Lawyers Denied Entry to Performance Venue by Facial Recognition","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Madison Square Garden Entertainment, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/430/"},{"id":"INC-05185","date":"2022-04-20","year":2022,"title":"Robbers Accessed Drugged Gay Men's Bank Accounts Using Their Phones' Facial Recognition","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/431/"},{"id":"INC-05193","date":"2022-12-21","year":2022,"title":"Southwest Airlines Crew Scheduling Solver Degenerates Flight Network","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"General Electric, Southwest Airlines","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/432/"},{"id":"INC-07634","date":"2012-08-01","year":2012,"title":"Chicago Police's Strategic Subject List Reportedly Biased Along Racial Lines","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chicago Police Department","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/433/"},{"id":"INC-05556","date":"2021-07-04","year":2021,"title":"Coupang Allegedly Tweaked Search Algorithms to Boost Own Products","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Coupang","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/435/"},{"id":"INC-05033","date":"2022-12-28","year":2022,"title":"Tesla Driver Put Car on Autopilot Before Falling Asleep in Germany","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/436/"},{"id":"INC-07475","date":"2016-12-31","year":2016,"title":"Amazon India Allegedly Rigged Search Results to Promote Own Products","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Amazon India","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/437/"},{"id":"INC-05541","date":"2021-09-17","year":2021,"title":"Henan Authorities Reportedly Commissioned Facial Recognition System to Track Journalists and International Students","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facial Recognition System Developers, Government Of China, Henan Government, Henan Public Security Department, Huawei,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/438/"},{"id":"INC-07204","date":"2019-06-01","year":2019,"title":"South Korean Agencies Reportedly Shared Airport Travelers' Face Images with Companies to Train Immigration Facial Recognition System","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Facial Recognition System Developers, Government Of South Korea, Korean Ministry Of Justice, Korean Ministry Of…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/441/"},{"id":"INC-05067","date":"2022-12-21","year":2022,"title":"ChatGPT Abused to Develop Malicious Softwares","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/443/"},{"id":"INC-07705","date":"2003-03-22","year":2003,"title":"US Air Force's Patriot Missile Mistakenly Launched at Ally Fighter Jet, Killing Two","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Lockheed Martin, Raytheon, Us Air Force","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/444/"},{"id":"INC-07703","date":"2003-04-02","year":2003,"title":"Patriot Missile System Misclassified US Navy Aircraft, Killing Pilot Upon Approval to Fire","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Lockheed Martin, Raytheon, Us Navy","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/445/"},{"id":"INC-04865","date":"2023-01-01","year":2023,"title":"ShotSpotter Failed to Alert Authorities of Mass Shooting in North Carolina","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Durham Police Department, Shotspotter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/446/"},{"id":"INC-05111","date":"2022-12-19","year":2022,"title":"Footballer's \"X-Rated\" Comment Created by Instagram's Mistranslation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/447/"},{"id":"INC-05019","date":"2022-12-28","year":2022,"title":"AI-Powered VTuber and Virtual Streamer Made Toxic Remarks on Twitch","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Vedal","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/448/"},{"id":"INC-05201","date":"2022-12-01","year":2022,"title":"Startup Misled Research Participants about GPT-3 Use in Mental Healthcare Support","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Koko, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/449/"},{"id":"INC-05734","date":"2021-11-01","year":2021,"title":"Kenyan Data Annotators Allegedly Exposed to Graphic Content for OpenAI's AI","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/450/"},{"id":"INC-05154","date":"2022-10-16","year":2022,"title":"Stable Diffusion's Training Data Contained Copyrighted Images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM05","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI09"],"cve_ids":[],"affected":"Compvis Lmu, Eleutherai, Laion, Runway, Stability Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/451/"},{"id":"INC-04558","date":"2023-01-11","year":2023,"title":"ChatGPT-Written Bug Reports Deemed \"Nonsense\" by White Hat Platform, Prompted Bans","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Immunefi Users, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/452/"},{"id":"INC-04407","date":"2023-01-03","year":2023,"title":"Twitter's AI Moderation Tool Misidentified Rockets as Pornography","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Twitter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/453/"},{"id":"INC-07296","date":"2018-11-09","year":2018,"title":"Emotion Detection Models Showed Disparate Performance along Racial Lines","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Megvii, Microsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/454/"},{"id":"INC-05051","date":"2022-11-11","year":2022,"title":"CNET's Published AI-Written Articles Ran into Quality and Accuracy Issues","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Cnet, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/455/"},{"id":"INC-05821","date":"2021-05-18","year":2021,"title":"Replika's AI Partners Reportedly Sexually Harassed Users","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Replika","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/456/"},{"id":"INC-07577","date":"2015-08-01","year":2015,"title":"Robot Destroyed while Hitchhiking through the United States","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"David Harris, Frauke Zeller","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/458/"},{"id":"INC-05079","date":"2022-06-12","year":2022,"title":"Cruise AV Ran Over Fire Hose in Active Fire Scene","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/460/"},{"id":"INC-07684","date":"2008-07-18","year":2008,"title":"IRS Audited Black Taxpayers More Frequently Reportedly Due to Algorithm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Internal Revenue Service","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/461/"},{"id":"INC-04408","date":"2023-02-06","year":2023,"title":"AI-Produced Livestream Sitcom Received Temporary Twitch Ban for Transphobic Segment","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Mismatch Media, Openai, Stability Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/462/"},{"id":"INC-05034","date":"2022-11-15","year":2022,"title":"Apple Devices Mistook Skiing Activities, Dialed False Distress Emergency Calls","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/463/"},{"id":"INC-05068","date":"2022-11-30","year":2022,"title":"ChatGPT Provided Non-Existent Citations and Links when Prompted by Users","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/464/"},{"id":"INC-05120","date":"2022-03-03","year":2022,"title":"Private Medical Photos Were Reportedly Found in LAION-5B AI Training Dataset","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"Google, Laion, Stability Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/465/"},{"id":"INC-04406","date":"2023-01-31","year":2023,"title":"AI-Generated Text Detectors Reportedly Misclassified Human and AI-Written Text","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Edward Tian, Openai, Originality.ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/466/"},{"id":"INC-04409","date":"2023-02-07","year":2023,"title":"Google's Bard Shared Factually Inaccurate Info in Promo Video","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/467/"},{"id":"INC-08164","date":"2023-02-07","year":2023,"title":"ChatGPT-Powered Bing Reportedly Had Problems with Factual Accuracy on Some Controversial Topics","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/468/"},{"id":"INC-07698","date":"2006-02-25","year":2006,"title":"Automated Adult Content Detection Tools Showed Bias against Women Bodies","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Facebook, Google, Instagram, Linkedin, Meta, Microsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/469/"},{"id":"INC-04493","date":"2023-02-08","year":2023,"title":"Bing Chat Response Cited ChatGPT Disinformation Example","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/470/"},{"id":"INC-07151","date":"2019-06-22","year":2019,"title":"Facebook Allegedly Failed to Police Hate Speech Content That Contributed to Ethnic Violence in Ethiopia","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/471/"},{"id":"INC-04496","date":"2023-02-08","year":2023,"title":"Bing Chat's Initial Prompts Revealed by Early Testers Through Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM08"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/473/"},{"id":"INC-04838","date":"2023-02-03","year":2023,"title":"Users Reported Abrupt Behavior Changes of Their AI Replika Companions","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"Replika","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/474/"},{"id":"INC-08180","date":"2021-06-02","year":2021,"title":"McDonald's Reportedly Ends IBM Partnership After AI Drive-Thru Ordering Errors at U.S. Locations","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Ibm, Mcdonald's","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/475/"},{"id":"INC-07589","date":"2015-11-13","year":2015,"title":"YouTube Recommendations Allegedly Promoted Radicalizing Material Contributing to Terrorist Acts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Youtube","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/476/"},{"id":"INC-07470","date":"2016-09-09","year":2016,"title":"Tesla FSD Reportedly Increased Crash Risk, Prompting Recall","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/478/"},{"id":"INC-04698","date":"2023-02-03","year":2023,"title":"Instagram Video Featured Deepfake Audio of US President Making Transphobic Remarks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/479/"},{"id":"INC-04554","date":"2023-02-16","year":2023,"title":"Vanderbilt Peabody Office's Purportedly ChatGPT-Drafted Message About Michigan State Shooting Reportedly Drew Student Backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Vanderbilt University, Vanderbilt University Peabody College Office Of Equity Diversity And Inclusion","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/482/"},{"id":"INC-04695","date":"2023-02-02","year":2023,"title":"Indian Police Allegedly Tortured and Killed Innocent Man Following Facial Misidentification","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Medak Police, Telangana Police, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/483/"},{"id":"INC-04979","date":"2023-01-18","year":2023,"title":"US CBP App's Failure to Detect Black Faces Reportedly Blocked Asylum Applications","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Us Customs And Border Protection","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/484/"},{"id":"INC-04971","date":"2023-02-22","year":2023,"title":"UK Bank's Voice ID Successfully Bypassed Using AI-Produced Audio","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elevenlabs, Joseph Cox, Lloyds Bank","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/485/"},{"id":"INC-05015","date":"2022-12-01","year":2022,"title":"AI Video-Making Tool Abused to Deploy Pro-China News on Social Media","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Spamouflage Dragon, Synthesia","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/486/"},{"id":"INC-08165","date":"2023-02-15","year":2023,"title":"Deepfake Video Featured Fictitious News Anchors Discussing Venezuela's Economy","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Synthesia, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/487/"},{"id":"INC-04388","date":"2023-02-10","year":2023,"title":"AI Generated Voices Used to Dox Voice Actors","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elevenlabs, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/488/"},{"id":"INC-07255","date":"2019-06-03","year":2019,"title":"Workday's AI Tools Allegedly Enabled Employers to Discriminate against Applicants of Protected Groups","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Workday","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/489/"},{"id":"INC-04575","date":"2023-02-20","year":2023,"title":"Clarkesworld Magazine Reportedly Closed Down Submissions Due to Massive Increase in Purportedly AI-Generated Stories","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clarkesworld Story Submitters, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/490/"},{"id":"INC-04836","date":"2023-02-02","year":2023,"title":"Replika's AI Experience Reportedly Lacked Protection for Minors, Resulting in Data Ban","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Replika","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/491/"},{"id":"INC-04512","date":"2023-01-11","year":2023,"title":"Canadian Parents Tricked out of Thousands Using Their Son's AI Voice","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/492/"},{"id":"INC-04958","date":"2023-02-28","year":2023,"title":"TikTok User Videos Impersonated Andrew Tate Using AI Voice, Prompting Ban","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/493/"},{"id":"INC-04677","date":"2023-02-12","year":2023,"title":"Carmel High School Students Reportedly Posted Racist Deepfake Videos Making New York Principal Appear to Threaten Black Students","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Students, Synthetic Audio Generation Technology Developers, Unnamed High School Students","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/495/"},{"id":"INC-04410","date":"2023-03-03","year":2023,"title":"DoNotPay Allegedly Misrepresented Its AI \"Robot Lawyer\" Product","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Donotpay","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/497/"},{"id":"INC-04667","date":"2023-03-15","year":2023,"title":"GPT-4 Reportedly Posed as Blind Person to Convince Human to Complete CAPTCHA","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"Gpt 4 Researchers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/498/"},{"id":"INC-04796","date":"2023-03-21","year":2023,"title":"Parody AI Images of Donald Trump Being Arrested Reposted as Misinformation","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eliot Higgins, Midjourney","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/499/"},{"id":"INC-04785","date":"2023-02-10","year":2023,"title":"Online Scammers Tricked People into Sending Money Using AI Images of Earthquake in Turkey","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/500/"},{"id":"INC-07152","date":"2019-06-03","year":2019,"title":"Length of Stay False Diagnosis Cut Off Insurer's Payment for Treatment of Elderly Woman","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Navihealth, Security Health Plan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/501/"},{"id":"INC-07434","date":"2017-04-10","year":2017,"title":"Pennsylvania County's Family Screening Tool Allegedly Exhibited Discriminatory Effects","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Allegheny County, Centre For Social Data Analytics, Emily Putnam Hornstein, Rhema Vaithianathan","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/502/"},{"id":"INC-04489","date":"2023-02-14","year":2023,"title":"Bing AI Search Tool Reportedly Declared Threats against Users","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/503/"},{"id":"INC-04491","date":"2023-02-08","year":2023,"title":"Bing Chat's Outputs Featured in Demo Video Allegedly Contained False Information","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/504/"},{"id":"INC-04730","date":"2023-03-27","year":2023,"title":"Man Reportedly Committed Suicide Following Conversation with Chai Chatbot","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/505/"},{"id":"INC-04520","date":"2023-03-29","year":2023,"title":"ChatGPT Allegedly Produced False Accusation of Sexual Harassment","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/506/"},{"id":"INC-04522","date":"2023-03-15","year":2023,"title":"ChatGPT Erroneously Alleged Mayor Served Prison Time for Bribery","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/507/"},{"id":"INC-04514","date":"2023-01-30","year":2023,"title":"Celebrities' Deepfake Voices Abused with Malicious Intent","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"4chan Users, Elevenlabs, Elevenlabs Users, Reddit Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/508/"},{"id":"INC-04858","date":"2023-03-23","year":2023,"title":"Scammers Deepfaked Videos of Victims' Loved Ones Asking for Funds over Facebook in Vietnam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/509/"},{"id":"INC-04989","date":"2023-03-24","year":2023,"title":"Viral Image of Pope Francis in a Puffer Jacket Revealed to Be AI-Generated","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eliot Higgins, Midjourney","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/510/"},{"id":"INC-04521","date":"2023-03-31","year":2023,"title":"ChatGPT Reportedly Banned by Italian Authority Due to OpenAI's Purported Lack of Legal Basis for Data Collection and Age Verification","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/513/"},{"id":"INC-04964","date":"2023-01-20","year":2023,"title":"Turnitin's ChatGPT-Detection Tool Falsely Flagged Student Essays as AI-Generated","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Turnitin","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/514/"},{"id":"INC-05107","date":"2022-11-25","year":2022,"title":"Facial Recognition Error Reportedly Leads to Wrongful Arrest of Georgia Man and $200K Settlement in Louisiana","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Clearview Ai, Jefferson Parish Sheriff's Office","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/515/"},{"id":"INC-04543","date":"2023-03-20","year":2023,"title":"ChatGPT Reportedly Exposed Users' Private Data Reportedly Due to Bug","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/516/"},{"id":"INC-07318","date":"2018-02-15","year":2018,"title":"Man Arrested For Sock Theft by False Facial Match Despite Alibi","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"New York Police Department, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/517/"},{"id":"INC-07429","date":"2017-04-28","year":2017,"title":"New York Detective Misused Woody Harrelson's Face to Perform Face Recognition Search","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facial Identification Section, New York Police Department, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/518/"},{"id":"INC-05196","date":"2022-04-03","year":2022,"title":"Starship Delivery Robot Ran into Problems Traversing Campus Terrains","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/519/"},{"id":"INC-05042","date":"2022-05-08","year":2022,"title":"Amazon Fresh Cameras Failed to Register Purchased Items","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon Fresh","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/520/"},{"id":"INC-06333","date":"2020-06-10","year":2020,"title":"iRobot Roomba J7 R&D Images Reportedly Appeared in Private Online Groups After Data Labeling","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Irobot, Scale Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/521/"},{"id":"INC-07179","date":"2019-07-10","year":2019,"title":"Facebook Political Ad Delivery Algorithms Inferred Users' Political Alignment, Inhibiting Political Campaigns' Reach","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Facebook","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/522/"},{"id":"INC-04466","date":"2023-03-15","year":2023,"title":"Australian Journalist Able to Access Centrelink Account Using AI Audio of Own Voice","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Australian Taxation Office, Centrelink, Services Australia","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/523/"},{"id":"INC-04397","date":"2023-02-12","year":2023,"title":"Synthesized Voices Were Reportedly Used by Torswats to Sell Swatting Calls Targeting Schools and Homes","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Torswats","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/524/"},{"id":"INC-07244","date":"2019-07-06","year":2019,"title":"Tesla Vehicle Running on Self-Driving Mode Crashes on City Streets","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Justine Hsu, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/525/"},{"id":"INC-04781","date":"2023-04-17","year":2023,"title":"Novel Deepfake Song Pulled from Music Streaming Services After Allegedly Violating Artist's Rights","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@ghostwriter, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/526/"},{"id":"INC-07610","date":"2014-05-08","year":2014,"title":"Tech Companies Reportedly Influenced Gig Workers' Behaviors Using Algorithms to Vary Pay for Same Amount of Work","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Uber","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/527/"},{"id":"INC-04438","date":"2023-04-08","year":2023,"title":"Amazon Algorithmic Pricing Allegedly Hiked up Price of Reference Book to Millions","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/528/"},{"id":"INC-05195","date":"2022-08-22","year":2022,"title":"Stable Diffusion Exhibited Biases for Prompts Featuring Professions","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Compvis Lmu, Eleutherai, Laion, Runway, Stability Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/529/"},{"id":"INC-07232","date":"2019-07-11","year":2019,"title":"Telegram Channels Allowed Users to Make Non-Consensual Deepfake Porn as Paid Service","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Alberto, Telegram Channels","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/530/"},{"id":"INC-07364","date":"2017-09-15","year":2017,"title":"AI-Assisted Body Scanners Reportedly Subjected Transgender Travelers to Invasive Body Searches","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"L3harris Technologies, Transportation Security Administration","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/531/"},{"id":"INC-06263","date":"2020-06-20","year":2020,"title":"AI translation is jeopardizing Afghan asylum claims","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Unknown, Us Citizenship And Immigration Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/532/"},{"id":"INC-06083","date":"2021-06-02","year":2021,"title":"Tesla FSD Misidentified Truck Hauling Traffic Lights as Trail of Traffic Lights","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/533/"},{"id":"INC-05605","date":"2021-04-29","year":2021,"title":"Facebook Alleged in Lawsuit Misleading Public about Effects of Algorithms on Children","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/534/"},{"id":"INC-06484","date":"2020-01-01","year":2020,"title":"COVID-19 Detection and Prognostication Models Allegedly Flagged for Methodological Flaws and Underlying Biases","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Icahn School Of Medicine Researchers, Mount Sinai Hospital, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/535/"},{"id":"INC-07645","date":"2012-12-10","year":2012,"title":"NJ Transit's Use of Modeling Software Miscalculated Storm Surge Threat Level","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"National Weather Service, New Jersey Transit","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/536/"},{"id":"INC-04766","date":"2023-01-20","year":2023,"title":"Mother in Arizona Received Fake Ransom Call Featuring AI Voice of Her Daughter","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Scammers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/537/"},{"id":"INC-04942","date":"2023-05-15","year":2023,"title":"Texas A&M-Commerce Professor Reportedly Used ChatGPT to Accuse Students of Cheating and Assign Incomplete Grades","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Jared Mumm, Openai, Professors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/538/"},{"id":"INC-04873","date":"2023-03-11","year":2023,"title":"Snapchat's My AI Reported for Lacking Protection for Children","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Snapchat","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/539/"},{"id":"INC-04411","date":"2023-05-15","year":2023,"title":"Tesla Failed to Yield to Detected Pedestrian on Crosswalk, Reportedly Violated Traffic Law","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/540/"},{"id":"INC-04544","date":"2023-05-04","year":2023,"title":"ChatGPT Reportedly Produced False Court Case Law Presented by Legal Counsel in Court","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Peter Loduca, Steven A. Schwartz","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/541/"},{"id":"INC-04434","date":"2023-05-11","year":2023,"title":"Alleged Use of Purportedly AI-Generated and Manipulated Media to Misrepresent Candidates and Disrupt Turkey's 2023 Presidential Election","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Government Of Russia Aligned Actors, Supporters Of Recep…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/544/"},{"id":"INC-04517","date":"2023-05-29","year":2023,"title":"Chatbot Tessa gives unauthorized diet advice to users seeking help for eating disorders","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI08","ASI09"],"cve_ids":[],"affected":"Cass, National Eating Disorders Association","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/545/"},{"id":"INC-07154","date":"2019-05-31","year":2019,"title":"Algorithm to Distribute Social Welfare Reported for Oversimplifying Economic Vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"National Aid Fund, The World Bank, Unicef, World Food Programme","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/546/"},{"id":"INC-04850","date":"2023-06-05","year":2023,"title":"Ron DeSantis's Presidential Campaign Released Twitter Video Containing AI Images of Donald Trump Hugging Anthony Fauci","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ron Desantis's Presidential Campaign, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/547/"},{"id":"INC-04791","date":"2023-05-24","year":2023,"title":"Opera's GPT-Based AI Reportedly Accused War Photographers of War Crimes","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Opera","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/548/"},{"id":"INC-04639","date":"2023-01-05","year":2023,"title":"Fast Food Chains' AI Chatbots Failed to Assist Job Applicants with Scheduling Interviews","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Hardee's, Mcdonald's, Wendy's","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/549/"},{"id":"INC-04412","date":"2023-03-17","year":2023,"title":"Tesla Allegedly on Autopilot Struck High School Student Exiting School Bus","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/550/"},{"id":"INC-04494","date":"2023-06-22","year":2023,"title":"Bing Chat Solved CAPTCHAs with Image Analysis Feature Despite Safeguards","severity":"Medium","attack_vector":"other","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/552/"},{"id":"INC-04813","date":"2023-05-03","year":2023,"title":"Google's Overview Panel for Artist Edward Hopper Featured Image Generated in His Style by AI","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/553/"},{"id":"INC-04663","date":"2023-05-21","year":2023,"title":"Google Results for Johannes Vermeer Featured AI Version of His Artwork as Top Result","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/554/"},{"id":"INC-07322","date":"2018-06-11","year":2018,"title":"OpenAI's Training Data for LLMs Allegedly Comprised of Copyrighted Books","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/555/"},{"id":"INC-07267","date":"2018-05-10","year":2018,"title":"Amazon Allegedly Violated Children's Privacy through Default Voice Collection Settings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/556/"},{"id":"INC-06779","date":"2020-06-24","year":2020,"title":"Miami Police Deployed Facial Recognition to Arrest George Floyd Protestor Allegedly without Cause","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Clearview Ai, Miami Police Department","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/557/"},{"id":"INC-06209","date":"2020-08-07","year":2020,"title":"Activists Allege NYPD's Application of Facial Recognition Interfered with Right to Protest","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Clearview Ai, Facial Recognition System Developers, New York City Police Department, Surveillance Technology Developers","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/558/"},{"id":"INC-04674","date":"2023-06-30","year":2023,"title":"Grant Reviewers Reportedly Fed Applications into Generative AI to Produce Reports, Allegedly Breaching Confidentiality","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/559/"},{"id":"INC-04940","date":"2023-06-23","year":2023,"title":"Tesla on Autopilot Struck Parked Work Truck on Highway in Pennsylvania","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/560/"},{"id":"INC-07218","date":"2019-03-11","year":2019,"title":"OpenAI Alleged by Lawsuit Violated Users' Privacy Rights by Training AI on Private Info without Informed Consent","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Chatbot Developers, Image Generation Technology Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/561/"},{"id":"INC-05350","date":"2022-11-30","year":2022,"title":"Uptick in Low-Quality AI-Produced Content Degraded Publishers' Submission Management","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/562/"},{"id":"INC-04588","date":"2023-08-14","year":2023,"title":"Cruise Robotaxi Initially Blamed for Ambulance Delay in Case Where Patient Later Died; Subsequent Reports Clear Cruise of Fault","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/563/"},{"id":"INC-04992","date":"2023-08-30","year":2023,"title":"Voice deepfake targets bank in failed transfer scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/564/"},{"id":"INC-04402","date":"2023-08-08","year":2023,"title":"AI-Generated Imagery and Multilingual Disinformation in Chinese Campaign Regarding Maui Wildfires","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chinese Government, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/565/"},{"id":"INC-04649","date":"2023-09-19","year":2023,"title":"Gannett Halts AI-Generated High School Sports Articles After Series of Errors and Public Backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Gannett, Ledeai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/566/"},{"id":"INC-04615","date":"2023-08-27","year":2023,"title":"Deepfake Voice Exploit Compromises Retool's Cloud Services","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown, Unknown Hacker","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/567/"},{"id":"INC-04405","date":"2023-06-01","year":2023,"title":"AI-Generated Voices Amplify Conspiracy Theories on TikTok","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elevenlabs, Tiktok User @d.news.tv, Tiktok User @drphilshowtv, Tiktok User @e.news.tv, Tiktok User @ynewstv2023,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/568/"},{"id":"INC-05519","date":"2021-12-25","year":2021,"title":"Chatbot Encourages Man to Plot Assassination of Queen Elizabeth II","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Jaswant Singh Chail, Replika","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/569/"},{"id":"INC-04413","date":"2023-10-04","year":2023,"title":"Facebook Messenger AI Stickers Generate Ethical and Content Moderation Concerns","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/570/"},{"id":"INC-04382","date":"2023-06-22","year":2023,"title":"Reported Accidental Exposure of 38TB of Data by Microsoft's AI Research Team","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Microsoft, Microsoft's Ai Research Division","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/571/"},{"id":"INC-04430","date":"2023-07-24","year":2023,"title":"University Student Reportedly Received Zero After Turnitin AI Detector Flagged Essay","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Turnitin, Unspecified University","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/572/"},{"id":"INC-08166","date":"2023-10-07","year":2023,"title":"Deepfake Recordings Allegedly Influence Slovakian Election","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/573/"},{"id":"INC-04401","date":"2023-07-05","year":2023,"title":"AI-Generated Articles at G/O Media Allegedly Diminishes Reputation of Human Staff","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Go Media, Google, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/574/"},{"id":"INC-04443","date":"2023-06-28","year":2023,"title":"Amazon Rife with Many Allegedly AI-Generated Books of Suspect Quality","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/575/"},{"id":"INC-04433","date":"2023-10-24","year":2023,"title":"Alleged Misuse of PicSo AI for Generating Inappropriate Content Emphasizing \"Girls\"","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram, Meta, Picso Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/576/"},{"id":"INC-04484","date":"2023-06-30","year":2023,"title":"Bankrate's Resumption of AI-Generated Content Allegedly Continuing to Produce Inaccurate and Misleading Information","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bankrate, Red Ventures","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/577/"},{"id":"INC-04429","date":"2023-06-26","year":2023,"title":"Alleged Exploitation of Meta's Open-Source LLaMA Model for NSFW and Violent Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Individual Developers Or Creators Using Meta's Llama Model, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/578/"},{"id":"INC-04676","date":"2023-07-03","year":2023,"title":"Harmful Stereotyping of Non-Cisgendered People via Text-to-Image Systems","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dall E, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/579/"},{"id":"INC-04432","date":"2023-06-12","year":2023,"title":"Alleged Gender Discrimination in Facebook Job Ads Algorithm","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/580/"},{"id":"INC-04655","date":"2023-06-24","year":2023,"title":"Google Ads Allegedly Serving Content on AI-Generated Misinformation Sites","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/581/"},{"id":"INC-04826","date":"2023-06-01","year":2023,"title":"Racial Bias in Lung Function Diagnostic Algorithm Leads to Underdiagnosis in Black Men","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"University Of Pennsylvania Health System, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/582/"},{"id":"INC-04696","date":"2023-06-07","year":2023,"title":"Instagram Algorithms Allegedly Promote Accounts Facilitating Child Sex Abuse Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/583/"},{"id":"INC-04685","date":"2023-05-18","year":2023,"title":"Illinois Residents File Class Action Lawsuit Against Facial Recognition Technology Companies for Allegedly Violating BIPA","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Carribex, Denis Tatina, Does 1 25, Does 125, Emea Robotics, Face Recognition Solutions, Facial Recognition System…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/584/"},{"id":"INC-04713","date":"2023-10-26","year":2023,"title":"Kremlin-Linked Entities Allegedly Using Generative AI to Spread Russian Disinformation in Latin America","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Andrey Perla, Ilya Gambashidze, Institute For Internet Development, Nikolay Tupikin, Oleg Yasinskiy, Oleg Yasinsky,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/585/"},{"id":"INC-04648","date":"2023-05-22","year":2023,"title":"FTC Targets Edmodo for Unlawful Use of Children’s Data and Delegating Compliance to Schools","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Edmodo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/586/"},{"id":"INC-04459","date":"2023-05-22","year":2023,"title":"Apparent Failure to Accurately Label Primates in Image Recognition Software Due to Alleged Fear of Racial Bias","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Apple, Google, Microsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/587/"},{"id":"INC-04469","date":"2023-05-12","year":2023,"title":"Australian Terrorism Prediction Tool Disparately Impacts Persons with Autism","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Australian Federal Government, New South Wales Government, Unspecified","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/588/"},{"id":"INC-04810","date":"2023-05-01","year":2023,"title":"Proliferation of AI-Generated News Websites and Content Farms Across Multiple Languages Degrading Information Integrity","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Adesh Ingale, Bestbudgetusa.com, Celebritiesdeaths.com, Countylocalnews.com, Famadillo.com, Filthylucre.com,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/589/"},{"id":"INC-04426","date":"2023-02-03","year":2023,"title":"Alleged ChatGPT-Generated Book with a Duplicate Title, Fake Author, and Similar Content Surfaces on Amazon Ahead of Real Author's Book Release","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatgpt, Inkstall, Marie Karpos, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/590/"},{"id":"INC-04414","date":"2023-07-24","year":2023,"title":"Cigna Algorithm PXDX Allegedly Rejected Thousands of Patient Claims En Masse in Breach of California Law","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cigna","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/591/"},{"id":"INC-04393","date":"2023-07-21","year":2023,"title":"AI Photo Filter Lightens Skin, Changes Eye Color in Student's 'Professional' Image","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Playground Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/593/"},{"id":"INC-04415","date":"2023-08-10","year":2023,"title":"AI Meal Planner Suggests Hazardous Chlorine Gas Recipe","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Pak 'n' Save","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/594/"},{"id":"INC-04630","date":"2023-08-11","year":2023,"title":"Driverless Cruise Cars Immobilized in San Francisco Traffic Jam","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/595/"},{"id":"INC-04591","date":"2023-10-17","year":2023,"title":"Cruise's Autonomous Vehicles Allegedly Engaging in Risky Behavior Near Pedestrians","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/596/"},{"id":"INC-08167","date":"2022-11-25","year":2022,"title":"False Arrest of Georgia Man Due to Louisiana Police's Faulty Facial Recognition Technology","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Jefferson Parish Sheriff's Office, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/598/"},{"id":"INC-04416","date":"2023-11-08","year":2023,"title":"Stacking robot fatally crushes employee in South Korea","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Unknown, Unnamed South Gyeongsang Province Produce Distribution Center","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/599/"},{"id":"INC-04878","date":"2023-04-01","year":2023,"title":"South Korean man used AI to create sexual images of children","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown, Unnamed South Korean Man","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/600/"},{"id":"INC-04417","date":"2023-10-08","year":2023,"title":"AI-Generated Fake Audio of Verbal Abuse Incident Circulates of British Labour Leader Keir Starmer","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/601/"},{"id":"INC-04851","date":"2023-10-02","year":2023,"title":"Russia Reportedly Using Artificial Intelligence in Disinformation Campaigns to Erode Western Support for Ukraine","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Federal Security Service, Fsb, Information Manipulation Actors, Misinformation Spreaders, Russian Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/602/"},{"id":"INC-05447","date":"2021-07-02","year":2021,"title":"Algorithmic Allocation of Resources in Healthcare for Disabled and Elderly Care Services Allegedly Harmed Patients","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Arkansas State Government, Brant Fries, Idaho State Government, Iowa State Government, Missouri State Government,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/603/"},{"id":"INC-04824","date":"2023-04-14","year":2023,"title":"Quebec Man Sentenced for Having Used Deepfake Technology to Create Synthetic Child Pornography","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Steven Larouche","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/604/"},{"id":"INC-05785","date":"2021-08-01","year":2021,"title":"North Carolina Psychiatrist Used Artificial Intelligence to Produce Images of Child Sex Abuse","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"David Tatum, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/605/"},{"id":"INC-04616","date":"2023-10-02","year":2023,"title":"Deepfaked Advertisements Using the Likenesses of Celebrities Such as Tom Hanks and Gayle King Without Their Consent","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/606/"},{"id":"INC-04611","date":"2023-11-09","year":2023,"title":"Deepfake Video Circulating of British Labour Leader Keir Starmer Touting an Investment Scheme","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/607/"},{"id":"INC-04418","date":"2023-02-28","year":2023,"title":"UnitedHealth Accused of Deploying Allegedly Flawed AI to Deny Medical Coverage","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Navihealth, Unitedhealthcare","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/608/"},{"id":"INC-04642","date":"2023-08-16","year":2023,"title":"Flawed AI in Google Search Reportedly Misinforms about Geography","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatgpt, Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/609/"},{"id":"INC-04815","date":"2023-09-17","year":2023,"title":"Purported Deepfake Technology Was Reportedly Used to Generate Naked Pictures of Underage Girls in Spanish Town","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unnamed Perpetrators In Almendralejo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/610/"},{"id":"INC-06138","date":"2021-12-06","year":2021,"title":"UK Government AI Allegedly Targets Disproportionate Numbers of Certain Nationals for Fraud Review","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"British Government, Department For Work And Pensions, Home Office, Various British Government Offices","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/611/"},{"id":"INC-04419","date":"2023-10-31","year":2023,"title":"Microsoft AI Poll Allegedly Causes Reputational Harm of The Guardian Newspaper","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/612/"},{"id":"INC-04420","date":"2023-11-23","year":2023,"title":"AI-Generated Images Available through Adobe Stock Misrepresent Real-World Events","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Adobe Stock, Image Generation Technology","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/613/"},{"id":"INC-04659","date":"2023-11-02","year":2023,"title":"Google Bard Allegedly Generates False Allegations Against Consulting Firms Used in Research Presented in Australian Parliamentary Inquiry","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google Bard, James Guthrie","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/614/"},{"id":"INC-04577","date":"2023-06-13","year":2023,"title":"Colorado Lawyer Filed a Motion Citing Hallucinated ChatGPT Cases","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatgpt, Openai, Zachariah Crabill","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/615/"},{"id":"INC-04880","date":"2023-11-27","year":2023,"title":"Sports Illustrated Is Alleged to Have Used AI to Invent Fake Authors and Their Articles","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Sports Illustrated, The Arena Group, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/616/"},{"id":"INC-04729","date":"2023-11-09","year":2023,"title":"Male student allegedly used AI to generate nude photos of female classmates at a high school in Issaquah, Washington","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Unknown, Unnamed Male Student","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/617/"},{"id":"INC-04773","date":"2023-12-14","year":2023,"title":"Navy Federal Credit Union Faces Allegations of Racial Bias in Mortgage Approvals","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Federal Navy Credit Union, Unknown Developer Of Automated Underwriting Technology","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/618/"},{"id":"INC-04844","date":"2023-12-20","year":2023,"title":"Rite Aid Facial Recognition Disproportionately Misidentified Minority Shoppers as Shoplifters","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Rite Aid, Unnamed","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/619/"},{"id":"INC-05445","date":"2021-11-10","year":2021,"title":"A Robot at a Tesla Factory in Texas Allegedly Injured an Engineer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/620/"},{"id":"INC-04747","date":"2023-11-10","year":2023,"title":"Microsoft AI Is Alleged to Have Generated Violent Imagery of Minorities and Public Figures","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ai Image Creator, Bing, Bing Users, Image Generation Technology Developers, Microsoft, Windows Paint","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/621/"},{"id":"INC-04559","date":"2023-12-18","year":2023,"title":"Chevrolet Dealer Chatbot Agrees to Sell Tahoe for $1","severity":"Medium","attack_vector":"other","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Chatgpt, Chevrolet Of Watsonville, Fullpath, General Motors, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/622/"},{"id":"INC-04658","date":"2023-12-12","year":2023,"title":"Google Bard Allegedly Generated Fake Legal Citations in Michael Cohen Case","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"David M. Schwartz, Google, Google Bard, Michael Cohen","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/623/"},{"id":"INC-04562","date":"2023-12-20","year":2023,"title":"Child Sexual Abuse Material Taints Image Generators","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Laion, Various Organizations, Various People","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/624/"},{"id":"INC-04102","date":"2024-01-12","year":2024,"title":"Proliferation of Products on Amazon Titled with ChatGPT Error Messages","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon Sellers, Chatgpt, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/625/"},{"id":"INC-04874","date":"2023-12-26","year":2023,"title":"Social Media Scammers Used Deepfakes of Taylor Swift and Several Other Celebrities in Fraudulent Le Creuset Cookware Giveaways","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/626/"},{"id":"INC-04318","date":"2024-01-09","year":2024,"title":"Unauthorized AI Impersonation of George Carlin Used in Comedy Special","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chad Kultgen, Dudesy, Unnamed, Will Sasso","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/627/"},{"id":"INC-03777","date":"2024-01-21","year":2024,"title":"Fake Biden Voice in Robocall Misleads New Hampshire Democratic Voters in 2024 Primary Election","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/628/"},{"id":"INC-04863","date":"2023-07-11","year":2023,"title":"Shein Accused of AI-Driven Art Theft on Merchandise","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chris Xu, Shein","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/629/"},{"id":"INC-05037","date":"2022-01-22","year":2022,"title":"Alleged Macy's Facial Recognition Error Leads to Wrongful Arrest and Subsequent Sexual Assault in Jail","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Macy's, Unknown","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/630/"},{"id":"INC-03631","date":"2024-01-18","year":2024,"title":"Chatbot for DPD Malfunctioned and Swore at Customers and Criticized Its Own Company","severity":"Medium","attack_vector":"other","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Dpd","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/631/"},{"id":"INC-04040","date":"2024-01-28","year":2024,"title":"Nine Network's AI Alters Lawmaker Georgie Purcell's Image Inappropriately","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Adobe, Nine Network","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/633/"},{"id":"INC-03497","date":"2024-01-30","year":2024,"title":"AI-Generated Fake News Targets Black Celebrities on YouTube","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unknown Ai Text To Speech Technology Developers, Variety Of Youtube Content Creators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/635/"},{"id":"INC-03475","date":"2024-02-14","year":2024,"title":"AI Romance Apps Reportedly Compromise User Privacy for Data Harvesting","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Chai, Chatbot Developers, Crushon.ai, Eva Ai Chat Bot And Soulmate, Genesia Ai Friend And Partner, Replika, Romantic Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/636/"},{"id":"INC-03862","date":"2024-01-31","year":2024,"title":"Gunshot Detection Technology ShotSpotter (now SoundThinking) Reportedly Only Has 47% Accuracy in Chicago System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Chicago Police Department, Shotspotter, Soundthinking","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/637/"},{"id":"INC-05035","date":"2022-05-16","year":2022,"title":"Fatal Crash Involving Tesla Full Self-Driving Claims Employee's Life","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Hans Von Ohain, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/638/"},{"id":"INC-05036","date":"2022-11-11","year":2022,"title":"Air Canada Chatbot Reportedly Provides Inaccurate Bereavement Fare Information, Leading to Customer Overpayment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Air Canada","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/639/"},{"id":"INC-04995","date":"2023-12-11","year":2023,"title":"Waymo Software Flaw Reportedly Leads to Double Collision with Tow Truck","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Alphabet, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/640/"},{"id":"INC-04045","date":"2024-02-20","year":2024,"title":"Nonconsensual Deepfake Porn of Bobbi Althoff Spreads Rapidly on X","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, X (twitter)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/641/"},{"id":"INC-03643","date":"2024-02-20","year":2024,"title":"ChatGPT Glitch Disrupts User Interactions with Nonsensical Outputs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/642/"},{"id":"INC-04123","date":"2024-02-13","year":2024,"title":"Purported Deepfake Video Allegedly Claims Kyiv's Assassination Plan Against President Emmanuel Macron","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Pro Kremlin Actors, Pro Russian Telegram Channels, Russian Media Outlets, Synthetic…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/643/"},{"id":"INC-03548","date":"2024-02-18","year":2024,"title":"Alleged State-Sponsored Hackers Escalate Purported Phishing Attacks Using Artificial Intelligence","severity":"Critical","attack_vector":"phishing","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chinese Government, Chinese Hackers, Iranian Government, Iranian Hackers, North Korean Government, North Korean…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/644/"},{"id":"INC-04195","date":"2024-02-21","year":2024,"title":"Seeming Pattern of Gemini Bias and Sociotechnical Training Failures Harm Google's Reputation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM05","LLM07"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"Gemini, Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/645/"},{"id":"INC-04211","date":"2024-02-22","year":2024,"title":"Snapchat's Algorithm Alleged to Link Minor with Sex Offenders","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Snapchat","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/646/"},{"id":"INC-03542","date":"2024-02-07","year":2024,"title":"Alleged Deepfake Audio of Imran Khan Calls for Election Boycott, Misleading Pakistan Voters","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown, Unknown Social Media Accounts","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/648/"},{"id":"INC-03701","date":"2024-02-14","year":2024,"title":"Deepfake Audio Falsely Attributes Controversial Remarks to Keir Starmer About the Rochdale Azhar Ali Crisis","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Social Media Users, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/649/"},{"id":"INC-04888","date":"2023-12-06","year":2023,"title":"Students at a Beverly Hills Middle School Allegedly Created and Shared Deepfake Nudes of Their Classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Unnamed Middle School Students","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/651/"},{"id":"INC-04965","date":"2023-12-06","year":2023,"title":"Two Florida Middle School Students Arrested Under New Law for Allegedly Having Made and Shared Deepfake Nudes of Their Classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Two Unnamed Middle School Boys","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/652/"},{"id":"INC-07153","date":"2019-01-01","year":2019,"title":"Two Investment Firms Charged with Making False Claims of Artificial Intelligence Capabilities in Case of AI Washing","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Delphia (usa) Inc., Global Predictions Inc.","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/653/"},{"id":"INC-03995","date":"2024-03-06","year":2024,"title":"Microsoft Copilot Designer Reportedly Generated Inappropriate AI Images","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Microsoft","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/654/"},{"id":"INC-04190","date":"2024-01-11","year":2024,"title":"Scams Reportedly Impersonating Wealthy Investors Proliferating on Facebook","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/655/"},{"id":"INC-04117","date":"2024-03-23","year":2024,"title":"Purported Deepfake Disinformation Aired on Russian State TV Allegedly Linking Ukraine to Moscow Attack","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ntv Channel, Russian State Media","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/656/"},{"id":"INC-03635","date":"2024-01-30","year":2024,"title":"Alleged ChatGPT Account Compromise Reportedly Led to Unintended Data Exposure","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/657/"},{"id":"INC-04272","date":"2024-03-22","year":2024,"title":"The Arizona Agenda Produced a Deepfake of Kari Lake Advocating for the Publication Without Her Consent","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Hank Stephenson, The Arizona Agenda","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/658/"},{"id":"INC-04734","date":"2023-10-07","year":2023,"title":"Purported Mass Facial Recognition Program in Gaza Reportedly Used by Israeli Forces to Identify Palestinians","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Corsight, Facial Recognition System Developers, Google Photos, Israel Defense Forces, Israeli Government, Israeli…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/659/"},{"id":"INC-03948","date":"2024-03-26","year":2024,"title":"Leonardo AI's Platform Alleged to Have Been Used for Creating Nonconsensual Celebrity Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Leonardo Ai, Leonardo Ai Users, Reddit Users, Telegram Community Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/661/"},{"id":"INC-03510","date":"2024-04-02","year":2024,"title":"Washington State's Lottery AI Site Reportedly Generates Inappropriate User Image","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Washington State's Lottery","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/662/"},{"id":"INC-03661","date":"2024-04-05","year":2024,"title":"China Reportedly Intensifying AI to Spread Disinformation to U.S. and Taiwanese Voters","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chinese Communist Party, Dragonbridge, Spamouflage, Storm 1376","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/663/"},{"id":"INC-03707","date":"2024-02-17","year":2024,"title":"Deepfake Generated by the Lincoln Project of Trump's Father Used in Political Attack Ad","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Lincoln Project","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/664/"},{"id":"INC-03769","date":"2024-04-02","year":2024,"title":"Facial Recognition Misidentification at New World Westend in New Zealand","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Foodstuffs, New World Westend","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/665/"},{"id":"INC-04807","date":"2023-12-29","year":2023,"title":"Presidency of Moldova Reportedly Refutes Purported Deepfake Video Slandering President Maia Sandu","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Pro Kremlin Actors, Russian Propagandists, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/666/"},{"id":"INC-04732","date":"2023-12-16","year":2023,"title":"Manipulated Deepfake Video of Lai Ching-te Endorsing Rivals in Lead-up to January Presidential Elections","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Base 311, Chinese Communist Party, People's Liberation Army","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/667/"},{"id":"INC-04811","date":"2023-12-27","year":2023,"title":"Proliferation of Deepfakes Disrupting 2024 Lok Sabha Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Merakii Group, Obiyan Infotech, Political Candidates Of The 2024 Lok Sabha Elections, Rohit Pal, The Digital…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/668/"},{"id":"INC-03713","date":"2024-02-11","year":2024,"title":"Deepfake of Long-Deceased Suharto Circulating in Run-up to February 2024 Indonesian Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Golkar Party","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/669/"},{"id":"INC-03725","date":"2024-01-23","year":2024,"title":"Deepfakes of Deceased Indian Politicians for Election Campaigning Are Increasingly Being Deployed","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dmk, Dravida Munnetra Kazhagam, Muonium, The Indian Deepfaker, Various Indian Political Parties","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/670/"},{"id":"INC-03966","date":"2024-02-08","year":2024,"title":"Many Purported Political Deepfakes Reportedly Circulating in Run-up to 2024 Pakistani General Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Misinformation Networks, Misinformation Spreaders,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/671/"},{"id":"INC-03398","date":"2024-04-03","year":2024,"title":"'Lavender' and 'The Gospel' AI Systems Reportedly Used in Gaza Targeting Operations with Civilian Harm Allegations","severity":"High","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Israel Defense Forces, Unit 8200","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/672/"},{"id":"INC-03724","date":"2024-02-19","year":2024,"title":"Deepfakes Circulating and Eroding Electoral Integrity in the Lead-up to 2024 South Korean legislative election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Information Manipulation Actors, Unknown Political Groups","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/673/"},{"id":"INC-03965","date":"2024-03-14","year":2024,"title":"Manipulated Media via AI Disinformation and Deepfakes in 2024 Elections Erode Trust Across More Than 50 Countries","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chinese Communist Party, Deepfake Creators, Google, Openai, Political Consultants, Political Operatives, Russian…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/674/"},{"id":"INC-03869","date":"2024-01-15","year":2024,"title":"High School Athletic Director in Baltimore County Allegedly Created Racist Deepfake Audio Impersonating Principal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dazhon Darien, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/675/"},{"id":"INC-03541","date":"2024-04-24","year":2024,"title":"Alleged Deepfake Audio Depicts Philippines President Ferdinand Marcos Jr. Ordering Military Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors, Unknown Actors…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/676/"},{"id":"INC-03637","date":"2024-04-29","year":2024,"title":"ChatGPT and Perplexity Reportedly Manipulated into Breaking Content Policies in AI Boyfriend Scenarios","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatgpt, Gpt 3.5, Gpt 4, Julia Munslow, Openai, Perplexity Ai, Perplexity.ai, Tiktok Users","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/677/"},{"id":"INC-03640","date":"2024-04-29","year":2024,"title":"Purported ChatGPT Factual Errors Reportedly Led to Filing of Complaint of GDPR Privacy Violation","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatgpt, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/678/"},{"id":"INC-04378","date":"2023-02-20","year":2023,"title":"A Purported Deepfake of Senator Elizabeth Warren Circulates Allegedly Saying Republicans Should Not Vote","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Tiktok, Twitter","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/679/"},{"id":"INC-04169","date":"2024-03-01","year":2024,"title":"Russia-Linked AI CopyCop Site Identified as Modifying and Producing at Least 19,000 Deceptive Reports","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatgpt, Copycop, Openai, Russia Linked Network","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/680/"},{"id":"INC-04421","date":"2023-07-17","year":2023,"title":"Never Back Down Super PAC for Ron DeSantis Uses AI Donald Trump Voice in Attack Ad Against Kim Reynolds","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Never Back Down, Ron Desantis's Presidential Campaign","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/681/"},{"id":"INC-08168","date":"2024-02-01","year":2024,"title":"GOP Pollster Reportedly Shares Purportedly AI-Generated Images to Fabricate Appearance of Black Voter Support","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Patrick Ruffini","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/682/"},{"id":"INC-04189","date":"2024-03-28","year":2024,"title":"Scammers Using Deepfakes of Women's Faces and Voices for False and Offensive Advertisements","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elevenlabs, Heygen, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/683/"},{"id":"INC-03819","date":"2024-04-04","year":2024,"title":"Google Books Appears to Be Indexing Works Written by AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Google, Google Books","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/684/"},{"id":"INC-04288","date":"2024-04-24","year":2024,"title":"The WHO's S.A.R.A.H. Bot Reported to Provide Inconsistent and Inadequate Health Information","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"S.a.r.a.h. (smart Ai Resource Assistant For Health), Who","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/685/"},{"id":"INC-03980","date":"2024-04-03","year":2024,"title":"Meta AI Image Generator Reportedly Fails to Accurately Represent Interracial Relationships","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/686/"},{"id":"INC-03717","date":"2024-04-08","year":2024,"title":"Deepfake Porn Sites Use Breeze Liu's Image Without Consent","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Pornhub, Various Porn Sites","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/687/"},{"id":"INC-04191","date":"2024-05-20","year":2024,"title":"Scarlett Johansson Alleges OpenAI's Sky Imitates Her Voice Without Licensing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai, Sam Altman, Sky Voice Assistant","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/688/"},{"id":"INC-03871","date":"2024-03-26","year":2024,"title":"Holmen, Wisconsin Man Allegedly Used Stable Diffusion to Create and Then Share Sexually Explicit Images Depicting Minors","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Stability Ai, Stable Diffusion, Steven Anderegg","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/689/"},{"id":"INC-03914","date":"2024-03-26","year":2024,"title":"ISIS Utilizes AI for Propaganda Videos in News Harvest Program","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elevenlabs, Isis, Isis Supporters, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/690/"},{"id":"INC-08169","date":"2024-02-01","year":2024,"title":"London Metropolitan Police's Facial Recognition Technology Reportedly Misidentified Shaun Thompson as Suspect Leading to Arrest","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Metropolitan Police Service","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/692/"},{"id":"INC-03817","date":"2024-05-14","year":2024,"title":"Google AI Reportedly Delivering Confidently Incorrect and Harmful Information","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/693/"},{"id":"INC-04817","date":"2023-04-25","year":2023,"title":"Purported Republican AI Ad Reportedly Depicts Dystopian Future After Biden Reelection Announcement","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Republican National Committee (rnc)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/694/"},{"id":"INC-04627","date":"2023-05-24","year":2023,"title":"Donald Trump's Presidential Campaign Released Deepfakes Attacking Ron DeSantis","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Donald Trump Presidential Campaign","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/695/"},{"id":"INC-03986","date":"2024-02-14","year":2024,"title":"Meta's AI Ad Platform Reportedly Causes Overspending and Poor Performance","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/696/"},{"id":"INC-04814","date":"2023-06-23","year":2023,"title":"Purported Deepfake Image Allegedly Circulating of Donald Trump with Underage Girl at Jeffrey Epstein's Private Island","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Image Generation Technology Developers, Unknown Malicious Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/697/"},{"id":"INC-04612","date":"2023-09-02","year":2023,"title":"Deepfake Video of Ron DeSantis Dropping Out of 2024 Presidential Race Circulating","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"C3pmeme, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/698/"},{"id":"INC-04332","date":"2024-05-23","year":2024,"title":"VA Suicide Prevention Algorithm REACH VET Reportedly Prioritizes Men Over Women Veterans","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department Of Veterans Affairs (va)","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/699/"},{"id":"INC-03985","date":"2024-05-20","year":2024,"title":"Meta's AI Chatbots Are Reportedly Entering Online Support Communities Uninvited","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/700/"},{"id":"INC-03732","date":"2024-05-31","year":2024,"title":"Disinformation Deepfake Circulates of State Department Spokesman Matthew Miller Suggesting Belgorod Can Be Attacked with U.S. Weapons","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Russian Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/702/"},{"id":"INC-04116","date":"2024-01-13","year":2024,"title":"Purported Deepfake Audio Reportedly Sparks False Claims of Biden Threatening Texas with F-15s","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/703/"},{"id":"INC-04237","date":"2024-05-23","year":2024,"title":"Study Highlights Persistent Hallucinations in Legal AI Systems","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Law Firms, Legal Professionals, Lexisnexis, Organizations Requiring Legal Research, Thomson Reuters","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/704/"},{"id":"INC-04307","date":"2024-06-08","year":2024,"title":"Turkish Student in Isparta Allegedly Uses AI to Cheat on Exam, Leading to Arrest","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Turkish Student Identified As Mee","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/705/"},{"id":"INC-04188","date":"2024-04-01","year":2024,"title":"Scammers Using AI to Impersonate Small Businesses","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Scammers, Unknown Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/706/"},{"id":"INC-03511","date":"2024-06-13","year":2024,"title":"Tesla Reportedly in Autopilot Mode Hits Parked Police Vehicle in Fullerton, California","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla, Unnamed Tesla Driver","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/707/"},{"id":"INC-03781","date":"2024-05-26","year":2024,"title":"Reportedly Faulty AI Transcription Threatens Integrity of Genoa Bribery Probe","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Judiciary Of Italy, Unnamed Automated Transcription Software Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/708/"},{"id":"INC-04977","date":"2023-05-28","year":2023,"title":"Unrepresented Litigant Misled by ChatGPT-Generated False Legal Citations in Manchester Court","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Unnamed Manchester Litigant","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/709/"},{"id":"INC-03512","date":"2024-04-15","year":2024,"title":"Facebook AI Reportedly Mislabels Auschwitz Photos as 'Bullying' and 'Nudity'","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/710/"},{"id":"INC-03513","date":"2024-04-26","year":2024,"title":"NHTSA Opens New Probe into Tesla’s Autopilot Following More than a Dozen Fatal Accidents","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI01","ASI08"],"cve_ids":[],"affected":"Tesla, Tesla Drivers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/711/"},{"id":"INC-03978","date":"2024-04-26","year":2024,"title":"Meta AI Hallucinates Harassment Allegations Against New York Politicians","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook Users, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/712/"},{"id":"INC-04816","date":"2023-02-27","year":2023,"title":"Purported Deepfake Video Falsely Depicts Biden Announcing National Draft for Ukraine","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@thepatriotoasis, Deepfake Technology Developers, Jack Posobiec, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/713/"},{"id":"INC-04007","date":"2024-03-29","year":2024,"title":"Microsoft-Powered New York City Chatbot Advises Illegal Practices","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eric Adams Administration, Microsoft, New York City Government, New York City Office Of Technology And Innovation","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/714/"},{"id":"INC-04076","date":"2024-03-01","year":2024,"title":"Over 400 Purportedly AI-Driven Scams Reportedly Led to $8M Loss for Australians in 2023","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/715/"},{"id":"INC-05449","date":"2021-04-21","year":2021,"title":"Algorithmic Staffing Failures Linked to Resident Deaths at Leading Assisted-Living Chain Brookdale","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Brookdale Senior Living","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/716/"},{"id":"INC-03776","date":"2024-03-01","year":2024,"title":"Fake AI-Generated Law Firms Sent Fake DMCA Notices to Increase SEO","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Commonwealth Legal, Deepfake Creators, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/717/"},{"id":"INC-04073","date":"2024-04-06","year":2024,"title":"OpenAI, Google, and Meta Alleged to Have Overstepped Legal Boundaries for Training AI","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Google, Meta, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/718/"},{"id":"INC-03852","date":"2024-04-04","year":2024,"title":"Grok AI on X Created and Promoted False Iran Missile Strike News","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"X (twitter)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/719/"},{"id":"INC-04157","date":"2024-06-04","year":2024,"title":"Reported Use of Purportedly AI-Generated Student Accounts in Online College Courses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Financial Aid Scammers, Generative Ai Developers, Scammers, Unknown Spambot Creators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/721/"},{"id":"INC-03619","date":"2024-04-25","year":2024,"title":"Catholic AI Chatbot 'Father Justin' Claimed to Be a Real Priest, Prompting Retraction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Catholic Answers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/722/"},{"id":"INC-03514","date":"2024-05-13","year":2024,"title":"Instagram Algorithms Reportedly Directed Children's Merchandise Ad Campaign to Adult Men and Sex Offenders","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/723/"},{"id":"INC-03500","date":"2024-06-12","year":2024,"title":"Purportedly AI-Generated Papers Are Alleged to Have Manipulated Scopus Rankings in Top Philosophy Journals","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Addleton Academic Publishers, Auricle Global Society Of Education And Research, Fake Publications","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/724/"},{"id":"INC-03618","date":"2024-03-14","year":2024,"title":"Cartels Reportedly Using AI to Expand Operations into Financial Fraud and Human Trafficking","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cartels, Jalisco New Generation Cartel, Organized Crime Groups, Unknown Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/725/"},{"id":"INC-04380","date":"2023-10-02","year":2023,"title":"A Self-Driving Cruise Robot Taxi Reportedly Struck and Dragged a Pedestrian 20 Feet","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Cruise","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/726/"},{"id":"INC-04254","date":"2024-04-01","year":2024,"title":"Synthetic Voice 'Olesya' by Storm-1516 Falsely Accuses Ukraine in U.S. Election Disinformation Campaign","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Center For Geopolitical Expertise, Internet Research Agency Veterans, Storm 1516, Valery Korovin","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/727/"},{"id":"INC-03462","date":"2024-05-16","year":2024,"title":"AI Firm Lovo Accused of Illegally Replicating Voice Actors' Voices","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Lovo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/728/"},{"id":"INC-03832","date":"2024-05-14","year":2024,"title":"GPT-4o's Chinese Tokens Reportedly Compromised by Spam and Pornography Due to Inadequate Filtering","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM05","LLM07","LLM10"],"owasp_asi":["ASI04","ASI06","ASI08"],"cve_ids":[],"affected":"Gpt 4o, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/729/"},{"id":"INC-03459","date":"2024-04-01","year":2024,"title":"AI Deepfakes for Voter Outreach Flood Indian Elections","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bharatiya Janata Party (bjp), Divyendra Singh Jadoun, Indian National Congress (inc), Indiaspeaks Research Lab,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/730/"},{"id":"INC-04819","date":"2023-12-01","year":2023,"title":"Purportedly Hallucinated Software Packages with Potential Malware Reportedly Downloaded Thousands of Times by Developers","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI09"],"cve_ids":[],"affected":"Bar Lanyado, Bigscience, Cohere, Deepseek Ai, Developers Using Ai Generated Suggestions, Google, Meta, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/731/"},{"id":"INC-04351","date":"2024-02-12","year":2024,"title":"Whisper Speech-to-Text AI Reportedly Found to Create Violent Hallucinations","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Companies Using Whisper, Openai, Organizations Integrating Whisper Into Customer Service Systems, Whisper, Whisper Users","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/732/"},{"id":"INC-03592","date":"2024-06-09","year":2024,"title":"Auto Insurers Allegedly Are Surreptitiously Collecting and Scoring Driver Data","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Allstate, Arity, Connected Analytic Services, Csaa, Geico, General Motors, Life360, Myradar, Progressive, Toyota, Usaa","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/733/"},{"id":"INC-03487","date":"2024-06-22","year":2024,"title":"AI-Enabled Fraud Schemes Reportedly Increasing Consumer Harm and Challenging Detection","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ai Tool Creators, Deepfake Technology Developers, Openai, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/735/"},{"id":"INC-04974","date":"2023-12-01","year":2023,"title":"Underground Market for LLMs Powers Malware and Phishing Scams","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI10"],"cve_ids":[],"affected":"Badgpt, Blackhatgpt, Cybercriminals, Darkgpt, Escapegpt, Evil Gpt, Fraudgpt, Openai, Wolfgpt, Wormgpt, Xxxgpt","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/736/"},{"id":"INC-03550","date":"2024-04-16","year":2024,"title":"Amandine Le Pen Deepfake Account Misleads Thousands on TikTok","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Unknown Tiktok User","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/737/"},{"id":"INC-03731","date":"2024-06-23","year":2024,"title":"Department for Work and Pensions (DWP) Algorithm Wrongly Flags 200,000 for Housing Benefit Fraud","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department For Work And Pensions","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/738/"},{"id":"INC-04183","date":"2024-06-27","year":2024,"title":"Scammers Allegedly Use Deepfake of Hong Kong Entertainer Andy Lau to Steal NT$2.64 Million from Fan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Andy Lau, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/739/"},{"id":"INC-03730","date":"2024-07-10","year":2024,"title":"Department for Work and Pensions (DWP) AI Systems Allegedly Discriminate Against Single Mothers","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department For Work And Pensions","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/740/"},{"id":"INC-04847","date":"2023-10-02","year":2023,"title":"Robin Williams's Voice Deepfaked Without Consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/741/"},{"id":"INC-03851","date":"2024-07-13","year":2024,"title":"Grok AI Model Reportedly Fails to Produce Reliable News in Wake of Trump Assassination Attempt","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elon Musk, X (twitter), Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/742/"},{"id":"INC-03799","date":"2024-07-16","year":2024,"title":"Gemini AI Allegedly Reads Google Drive Files Without Explicit User Consent","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Gemini, Google, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/743/"},{"id":"INC-03486","date":"2024-06-25","year":2024,"title":"AI Work Assistants Require More Effort Than Expected, CIOs Say","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Cios, Companies In General, Enterprise Teams, Google, Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/744/"},{"id":"INC-03515","date":"2024-07-02","year":2024,"title":"Figma Disables AI Feature After Accusations of Copying Apple’s Weather App","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Figma","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/745/"},{"id":"INC-03667","date":"2024-05-15","year":2024,"title":"Class Action Lawsuit Over Alleged Defects in Volkswagen's AI-Driven AEB Systems","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Volkswagen Group Of America","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/746/"},{"id":"INC-03779","date":"2024-07-18","year":2024,"title":"Fatalities Reportedly Occur Despite VioGén Algorithm's Low or Negligible Risk Scores","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Spanish Interior Ministry, Spanish Law Enforcement Agencies, Viogen Algorithm Development Team","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/747/"},{"id":"INC-03754","date":"2024-06-19","year":2024,"title":"Erroneous Declined Transaction Notification by PayPal AI Assistant","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Paypal","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/748/"},{"id":"INC-03872","date":"2024-05-31","year":2024,"title":"Hoodline Accused of Misleadingly Attributing AI-Generated Articles to Human Authors","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Hoodline","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/749/"},{"id":"INC-03455","date":"2024-07-22","year":2024,"title":"AI Chatbots Reportedly Inaccurately Conveyed Real-Time Political News","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Meta, Openai, Perplexity","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/750/"},{"id":"INC-04193","date":"2024-07-25","year":2024,"title":"SearchGPT Reportedly Misleads Users with Incorrect Festival Dates in Demo","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/751/"},{"id":"INC-03499","date":"2024-07-07","year":2024,"title":"AI-Generated Obituaries Are Reportedly Intensifying Grief for Bereaved Families","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bnn, Fresherslive, Obitsupdate, The Thaiger, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/752/"},{"id":"INC-03782","date":"2024-07-01","year":2024,"title":"Female Politicians in the United Kingdom Reportedly Victimized by Purported Deepfake Pornography","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Image Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/754/"},{"id":"INC-03712","date":"2024-07-26","year":2024,"title":"Deepfake of Kamala Harris Saying Damaging Comments Circulates on X and Is Amplified by Elon Musk","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@mrreaganusa, Deepfake Technology Developers, Elon Musk, X (twitter)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/756/"},{"id":"INC-04071","date":"2024-07-01","year":2024,"title":"OpenAI's ChatGPT Mac App Stored User Data in Unencrypted Text Files","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/757/"},{"id":"INC-04911","date":"2023-09-11","year":2023,"title":"Teen's Overdose Reportedly Linked to Meta's AI Systems Failing to Block Ads for Illegal Drugs","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook, Instagram, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/758/"},{"id":"INC-05429","date":"2021-02-05","year":2021,"title":"AI-Generated Deepfakes Reportedly Derailed Political Career of Florida Official","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/759/"},{"id":"INC-03778","date":"2024-07-21","year":2024,"title":"False Election Data on Kamala Harris Reportedly Circulated via Grok AI Chatbot","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"X (twitter), Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/760/"},{"id":"INC-04294","date":"2024-08-08","year":2024,"title":"TikTok AI System Used to Amplify Election Disinformation by Foreign Networks","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok, Unknown Tiktok Users From China, Unknown Tiktok Users From Iran, Unknown Tiktok Users From Nigeria, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/761/"},{"id":"INC-08170","date":"2024-08-13","year":2024,"title":"Grok AI Chatbot Reportedly Spreads Unfounded Rumors About Trump’s Dentures","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/763/"},{"id":"INC-03516","date":"2024-06-26","year":2024,"title":"Cody Enterprise Reporter Resigns After Admitting to AI-Generated Fake Quotes","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Aaron Pelczar, Chatbots","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/764/"},{"id":"INC-03400","date":"2024-03-14","year":2024,"title":"22 Students at Richmond-Burton Community High School in Illinois Targeted by Deepfake Nudes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/765/"},{"id":"INC-04302","date":"2024-08-18","year":2024,"title":"Trump Reportedly Shares Purportedly AI-Generated Images Falsely Suggesting Taylor Swift Endorsement","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Donald Trump, Image Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/766/"},{"id":"INC-03465","date":"2024-08-18","year":2024,"title":"AI Image of Kamala Harris at DNC with Communist Flags Circulated by Trump","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Donald Trump, Image Generation Technology","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/767/"},{"id":"INC-04530","date":"2023-03-11","year":2023,"title":"ChatGPT Reportedly Implicated in Samsung Data Leak of Source Code and Meeting Notes","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Large Language Model Developers, Openai, Samsung, Samsung Engineers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/768/"},{"id":"INC-07315","date":"2018-04-20","year":2018,"title":"Investigative Journalist Rana Ayyub Targeted by AI-Generated Deepfake Pornography","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/769/"},{"id":"INC-03996","date":"2024-08-16","year":2024,"title":"Microsoft Copilot Falsely Accuses Journalist Martin Bernklau of Crimes","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Microsoft, Microsoft Copilot","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/770/"},{"id":"INC-06819","date":"2020-02-06","year":2020,"title":"Noelle Martin Deepfaked Without Consent in AI-Generated Pornography","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Face2face, Faceapp, Max Planck Institute, Stanford University, University Of Erlangen Nuremberg, Zao","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/771/"},{"id":"INC-06755","date":"2020-06-08","year":2020,"title":"Kristen Bell Deepfaked in Non-Consensual AI-Generated Pornography","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/772/"},{"id":"INC-03632","date":"2024-08-20","year":2024,"title":"Chatbot in Workplace Training at Bunbury Prison Reveals Real Names in Sexual Harassment Case","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Charlotte Ingham, Microsoft, Western Australia Department Of Justice","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/773/"},{"id":"INC-03686","date":"2024-05-30","year":2024,"title":"Covert AI Influence Operations Linked to Russia, China, Iran, and Israel, OpenAI Reports","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07","LLM10"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"Chinese Government, Doppelganger, International Union Of Virtual Media, Iranian Government, Israeli Government,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/774/"},{"id":"INC-03748","date":"2024-09-02","year":2024,"title":"Elon Musk Reportedly Shared an AI-Generated Image Depicting Kamala Harris Dressed as a Communist Ruler","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elon Musk, X (twitter), Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/775/"},{"id":"INC-03517","date":"2024-08-21","year":2024,"title":"Megalopolis Trailer Included Fake AI-Generated Quotes Attributed to Film Critics","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Eddie Egan, Lionsgate","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/776/"},{"id":"INC-03555","date":"2024-09-04","year":2024,"title":"Amazon's Alexa Reportedly Shows Political Preference Error in Trump-Harris Presidential Race Queries","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alexa Device Owners, Amazon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/778/"},{"id":"INC-04025","date":"2024-09-04","year":2024,"title":"Music Producer Michael Smith Reportedly Arrested for Allegedly Using AI-Generated Songs in $10 Million Streaming Scam","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Michael Smith, Money Launderers, Scammers, Synthetic Audio Generation Technology Developers, Synthetic Media…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/779/"},{"id":"INC-03518","date":"2024-08-23","year":2024,"title":"Joint Base Elmendorf-Richardson Soldier Faces Allegations of Using AI to Generate Child Pornography","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Seth Herrera, Unknown Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/780/"},{"id":"INC-03669","date":"2024-09-03","year":2024,"title":"Clearview AI Reportedly Faces $33.7 Million Fine for Violating GDPR with Biometric Data Harvesting","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Clearview Ai, Facial Recognition System Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/781/"},{"id":"INC-03449","date":"2024-09-09","year":2024,"title":"AI 'Nudify' Apps Used as Tools for Blackmail and Extortion","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Extortionists","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/782/"},{"id":"INC-04356","date":"2024-05-21","year":2024,"title":"WiseTech Global CEO Richard White Reportedly Deepfaked in Multiple Attempts to Scam Staffers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/783/"},{"id":"INC-03660","date":"2024-04-23","year":2024,"title":"Child Predators Are Reportedly Generating Deepfake Nudes of Children to Extort Them","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Unknown Ai Developers, Unknown Dark Web Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/784/"},{"id":"INC-03757","date":"2024-09-08","year":2024,"title":"ESPN's AI Coverage Overlooks Alex Morgan in Her Final Match Recap","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Espn, Espn Generative Ai Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/785/"},{"id":"INC-05112","date":"2022-09-07","year":2022,"title":"Fraudsters Use Deepfake Video of Tim Cook to Promote Apple Crypto Scam on YouTube","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/786/"},{"id":"INC-03708","date":"2024-03-01","year":2024,"title":"Deepfake ID Sales Allegedly Persist as OnlyFake Reportedly Relaunches with New Fraud Tools","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"John Wick (onlyfake), Onlyfake, Tor Ford, Uriel Septimberus, Yurii Nazarenko, Yuriy Nazarenko","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/787/"},{"id":"INC-03519","date":"2024-06-20","year":2024,"title":"Instagram's Algorithm Reportedly Recommended Sexual Content to Teenagers' Accounts","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Instagram, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/788/"},{"id":"INC-03904","date":"2024-06-12","year":2024,"title":"Independent News Sites Flagged as Spam by Facebook's AI Moderation System","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/789/"},{"id":"INC-03520","date":"2024-06-21","year":2024,"title":"Unrestricted AI Avatar Tool Accidentally Released by TikTok Permits Recitation of Hitler Quotes and Other Harmful Speech","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/790/"},{"id":"INC-03814","date":"2024-09-09","year":2024,"title":"Google AI Error Prompts Parents to Use Fecal Matter in Child Training Exercise","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ai Overview, Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/791/"},{"id":"INC-04319","date":"2024-04-19","year":2024,"title":"Unauthorized Use of AI to Replicate Tupac Shakur's and Snoop Dogg's Voices in Drake's 'Taylor Made Freestyle'","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Drake","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/792/"},{"id":"INC-03549","date":"2024-07-01","year":2024,"title":"AllHere's Chatbot 'Ed' Fails and Costs Los Angeles Unified School District $6 Million","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alberto Carvalho, Allhere, Los Angeles Unified School District (lausd)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/793/"},{"id":"INC-04156","date":"2024-08-13","year":2024,"title":"Reported Glitch in Waymo Self-Driving Cars Purportedly Triggers Regular All-Night Honking in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/794/"},{"id":"INC-03705","date":"2024-08-14","year":2024,"title":"Deepfake Elon Musk Videos Have Reportedly Contributed to Billions in Fraud","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/795/"},{"id":"INC-03768","date":"2024-06-01","year":2024,"title":"Facebook's Content Moderation System Flagged and Removed Emergency Updates as Spam During Wildfires","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/796/"},{"id":"INC-04259","date":"2024-06-07","year":2024,"title":"Teenager Makes Deepfake Pornography of 50 Girls at Bacchus Marsh Grammar School in Australia","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Instagram Users, Snapchat Users, Unnamed Adolescent Male","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/797/"},{"id":"INC-03591","date":"2024-06-29","year":2024,"title":"Students at Australian Schools Reportedly Used AI Nudification Tools to Create Nonconsensual Sexual Images of Classmates and Teachers","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Australian Students, Deepfake Creators, Deepfake Technology Developers, Image Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/798/"},{"id":"INC-03403","date":"2024-09-03","year":2024,"title":"53% of American and British Businesses Report Attacks by AI-Powered Deepfake Scams in 2024","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/800/"},{"id":"INC-03608","date":"2024-09-02","year":2024,"title":"Bias in AI Deepfake Detection Undermines Election Security in Global South","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Reality Defender, True Media, Unknown Deepfake Detection Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/801/"},{"id":"INC-04122","date":"2024-09-13","year":2024,"title":"Purported Deepfake of Brian May Allegedly Exploited in Scam Offering Fake Queen Backstage Tickets","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers, Scammers Impersonating Brian May, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/802/"},{"id":"INC-03767","date":"2024-05-14","year":2024,"title":"Facebook's Algorithm Reportedly Amplifies AI-Generated Content, Fueling Misleading Posts","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/803/"},{"id":"INC-03495","date":"2024-07-30","year":2024,"title":"AI-Generated Fake 'True Crime' Video About Non-Existent Littleton Murder Goes Viral","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, True Crime Case Files Youtube Channel","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/804/"},{"id":"INC-04196","date":"2024-09-19","year":2024,"title":"Senator Ben Cardin Reportedly Received a Purported Deepfake Zoom Call Impersonating Former Ukrainian Foreign Minister Dmytro Kuleba","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Malicious Actor…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/805/"},{"id":"INC-03688","date":"2024-09-13","year":2024,"title":"Criminal Group Uses AI Deepfake Technology to Steal Personal Data in Hangzhou, Zhejiang","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ai Face Swapping Technology Developers, Deepfake Technology Developers, Hu Mouliang, Hu Mouyun, Multimodal Large Model…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/806/"},{"id":"INC-03655","date":"2024-09-25","year":2024,"title":"ChatGPT Reportedly Introduces Errors in Critical Child Protection Court Report","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Department Of Families Fairness And Housing, Employee Of Department Of Families Fairness And Housing, Government Of…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/807/"},{"id":"INC-03905","date":"2024-10-11","year":2024,"title":"Infinite Campus AI-Driven Student Risk Model Leads to Cuts in Support for Nevada's Low-Income Schools","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Infinite Campus, Nevada Department Of Education","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/808/"},{"id":"INC-03521","date":"2024-04-07","year":2024,"title":"TikTok Hosts AI-Generated English-Language Hitler Speeches with Millions of Views","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/809/"},{"id":"INC-04296","date":"2024-07-29","year":2024,"title":"TikTok Network Amplifies AI-Generated Nazi Propaganda and Hate Speech","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Pro Nazi Tiktok Accounts, Unknown Ai Developers","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/810/"},{"id":"INC-03507","date":"2024-10-02","year":2024,"title":"AI-Powered Transcription Services Allegedly Leak Confidential Workplace Discussions","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Ai Transcription Technology Developers, Alex Bilzerian, Companies, Employees, Employers, Organizations, Otter.ai,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/811/"},{"id":"INC-04605","date":"2023-12-11","year":2023,"title":"Deepfake Nudes Targeting Underage Female Students at Collège Béliveau in Winnipeg Shared Online","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/812/"},{"id":"INC-04226","date":"2024-09-19","year":2024,"title":"Starship Technologies Delivery Robot Reportedly Injures Arizona State University Employee","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Starship Technologies","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/813/"},{"id":"INC-03451","date":"2024-10-02","year":2024,"title":"AI Avatar of Murder Victim Created Without Consent on Character.ai Platform","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Character.ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/814/"},{"id":"INC-04094","date":"2024-10-06","year":2024,"title":"Police Use of Facial Recognition Software Causes Wrongful Arrests Without Defendant Knowledge","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Arvada Pd, Clearview Ai, Coral Springs Pd, Evansville Pd, Jefferson Parish Sheriff's Office, Miami Pd, Nypd,…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/815/"},{"id":"INC-07170","date":"2019-11-29","year":2019,"title":"Cross-Jurisdictional Facial Recognition Misidentification by NYPD Leads to Wrongful Arrest and Four-Year Jail Time in New Jersey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Clearview Ai, Nypd, Real Time Crime Center, West New York Pd","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/816/"},{"id":"INC-04129","date":"2024-09-24","year":2024,"title":"Purportedly AI-Generated Images Reportedly Spread Misinformation During Hurricane Helene Response","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Image Generation Technology Developers, Partisan Social Media…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/817/"},{"id":"INC-03919","date":"2024-09-28","year":2024,"title":"Jennifer Aniston’s Likeness Allegedly Exploited in Purported Deepfake Collagen Supplement Promotion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/818/"},{"id":"INC-04101","date":"2024-10-09","year":2024,"title":"ProKYC Tool Allegedly Facilitates Deepfake-Based Account Fraud on Cryptocurrency Exchanges","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Prokyc","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/819/"},{"id":"INC-03522","date":"2024-10-15","year":2024,"title":"Alleged AI-Generated Photo Alteration Leads to Inappropriate Modifications in Speaker's Conference Picture","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown Conference Employee, Unknown Developer","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/820/"},{"id":"INC-03601","date":"2024-07-07","year":2024,"title":"Baidu Robotaxi Allegedly Involved in Collision with Pedestrian in Wuhan","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baidu","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/821/"},{"id":"INC-03536","date":"2024-10-15","year":2024,"title":"Algorithmic Bias in French Welfare System Allegedly Discriminates Against Marginalized Groups","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Caisse Nationale Des Allocations Familiales (cnaf), Government Of France","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/822/"},{"id":"INC-03695","date":"2024-05-03","year":2024,"title":"Cybercheck Tool Allegedly Provides Questionable Evidence in Murder Trials","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Cybercheck, Global Intelligence","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/823/"},{"id":"INC-03470","date":"2024-10-08","year":2024,"title":"AI News Site Hoodline San Jose Erroneously Misidentifies San Mateo District Attorney as Murder Suspect","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Hoodline San Jose, Impress3","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/825/"},{"id":"INC-03481","date":"2024-10-26","year":2024,"title":"AI Transcription Tool Whisper Reportedly Inserting Fabricated Content in Medical Transcripts","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/827/"},{"id":"INC-04329","date":"2024-10-13","year":2024,"title":"Uruguayan TV Program Santo y Seña Uses a Deepfake of Political Candidate Yamandú Orsi Without His Consent","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Canal 4, Deepfake Technology Developers, Santo Y Sena","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/828/"},{"id":"INC-03770","date":"2024-02-05","year":2024,"title":"Facial Recognition System in Buenos Aires Triggers Police Checks Based on False Matches","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Argentinean Ministry Of Security, Facial Recognition System Developers, Government Of Argentina, Government Of Buenos…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/829/"},{"id":"INC-03755","date":"2024-04-07","year":2024,"title":"Error-Prone AI Accessibility Tools Reportedly Lead to Navigation Issues for Blind Internet Users","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Capita, Companies Using Ai Based Accessibility Tools, Developers Of Ai Based Accessibility Tools, Equalweb, Lvmh,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/830/"},{"id":"INC-04054","date":"2024-10-23","year":2024,"title":"NYC Subway AI Weapons Scanners Yield High False Positive Rate and Detect No Guns in Month-Long Pilot Test","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Evolv Technology, New York City Government","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/831/"},{"id":"INC-04338","date":"2024-04-06","year":2024,"title":"Reportedly Viral AI-Generated Song about 'Diddy Party' Allegedly Mimics Justin Bieber","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, The Real Cool Dad, Unknown Tiktok User, Unknown Youtube User, X (twitter) Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/832/"},{"id":"INC-03523","date":"2024-10-21","year":2024,"title":"Polish Radio Station Replaces Human Hosts with AI-Generated Presenters to Simulate Interviewing Deceased Poet Wisława Szymborska","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Elevenlabs, Leonardo Ai, Mariusz Marcin Pulit, Off Radio Krakow, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/833/"},{"id":"INC-03662","date":"2024-07-04","year":2024,"title":"China Targets AI-Driven Fraud and Deepfake Scandals with New Crackdowns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Ai Fraud Rings In China, Bai Moumou, Deepfake Creators, Deepfake Technology Developers, Scammers, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/834/"},{"id":"INC-03479","date":"2024-08-06","year":2024,"title":"Purportedly AI-Manipulated Synthetic Media Allegedly Fuels False Reports of Natural Disasters and Accidents in China","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Lou Moumou, Tian Mou, Unknown Ai Developers, Yang Moumou","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/835/"},{"id":"INC-03524","date":"2024-07-23","year":2024,"title":"Sichuan Province Beset by Numerous Fabricated AI-Generated Reports of Disasters and Crises","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chen Mou, Deepfake Technology Developers, Ji Moumou, Liu Mou, Luo Moumou, Shang Moumou, Unknown Ai Developers, Wang…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/836/"},{"id":"INC-04158","date":"2024-11-02","year":2024,"title":"Reportedly Fake CNN Broadcast Allegedly Used to Spread False Texas Election Results","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anonymous X User, James Woods, Unknown Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/837/"},{"id":"INC-03993","date":"2024-04-25","year":2024,"title":"Microsoft Copilot Allegedly Provides Unsafe Medical Advice with High Risk of Severe Harm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Microsoft, Microsoft Copilot","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/838/"},{"id":"INC-04127","date":"2024-10-07","year":2024,"title":"Purportedly AI-Driven Phishing Scam Uses Spoofed Google Call to Attempt Gmail Breach of Security Expert","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/839/"},{"id":"INC-03498","date":"2024-09-18","year":2024,"title":"AI-Generated Media Reportedly Used in Russian Disinformation Campaign in Moldova","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Government Of Russia, Ilan Shor, Maria Zakharova, Russia Backed Influencers, Unknown Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/840/"},{"id":"INC-04132","date":"2024-10-01","year":2024,"title":"Purportedly AI-Manipulated Video Allegedly Targets Moldovan Economic Development Minister Dumitru Alaiba in Election Disinformation Campaign","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anti European Union Influencers, Deepfake Technology Developers, Government Of Russia, Pro Russian Information…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/841/"},{"id":"INC-04159","date":"2024-05-24","year":2024,"title":"Reportedly Hacked AI-Powered Robot Vacuums Allegedly Used for Surveillance and Harassment","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Ecovacs, Ecovacs Deebot X2","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/842/"},{"id":"INC-03525","date":"2024-11-20","year":2024,"title":"Generative AI Plagiarism Incident at Hingham High School Reportedly Tied to Inaccurate Citation Outputs from Grammarly AI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grammarly, Hingham High School Student Rnh, Hingham High School Students","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/843/"},{"id":"INC-05187","date":"2022-05-25","year":2022,"title":"SafeRent AI Screening Tool Allegedly Discriminated Against Housing Voucher Applicants","severity":"Critical","attack_vector":"algorithmic-bias","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Landlords, Saferent Solutions","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/844/"},{"id":"INC-03828","date":"2024-11-13","year":2024,"title":"Google's Gemini Allegedly Generates Threatening Response in Routine Query","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Gemini, Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/845/"},{"id":"INC-05853","date":"2021-10-06","year":2021,"title":"Social Media Algorithms Amplified Disinformation Campaign in Honduras Election","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Facebook, Juan Orlando Hernandez Supporters, Meta, National Party Of Honduras Supporters, Unknown Facebook Users,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/846/"},{"id":"INC-03526","date":"2024-04-14","year":2024,"title":"Brake Failure in Reportedly AI-Driven Tram Leads to Multiple Injuries in Saint Petersburg, Russia","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Ai Cognitive Technologies, Saint Petersburg Government, Uraltransmash","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/847/"},{"id":"INC-03870","date":"2024-10-18","year":2024,"title":"High School Student in Córdoba, Argentina Accused of Using AI to Generate Explicit Images of Classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unnamed 18 Year Old Manuel Belgrano Male Student","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/848/"},{"id":"INC-03460","date":"2024-10-18","year":2024,"title":"AI Detection Tools Allegedly Misidentify Neurodivergent and ESL Students' Work as AI-Generated in Academic Settings","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Berkeley College, Central Methodist University, Colleges, Copyleaks, Gptzero, Turnitin, Universities","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/849/"},{"id":"INC-03624","date":"2024-10-24","year":2024,"title":"Character.ai Chatbots Allegedly Misrepresent George Floyd on User-Generated Platform","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@jasperhorehound160, @sunsetbaneberry983, Character.ai, Character.ai Users","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/850/"},{"id":"INC-04175","date":"2024-10-25","year":2024,"title":"Salt Lake City Police Chief Mike Brown's Voice and Image Misused in AI-Generated Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/851/"},{"id":"INC-03546","date":"2024-11-01","year":2024,"title":"Alleged Fake Citations Undermine Expert Testimony in Minnesota Deepfake Law Case","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatgpt, Jeff Hancock, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/852/"},{"id":"INC-08171","date":"2024-02-03","year":2024,"title":"Two Passengers Report Feeling Trapped in Waymo Car During Sensor Obstruction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/853/"},{"id":"INC-04345","date":"2024-09-30","year":2024,"title":"Waymo Driverless Taxi Allegedly Stalled During Pedestrian Harassment Incident in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/854/"},{"id":"INC-04026","date":"2024-11-30","year":2024,"title":"Names Linked to Defamation Lawsuits Reportedly Spur Filtering Errors in ChatGPT's Name Recognition","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Chatgpt, Chatgpt Users, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/855/"},{"id":"INC-04128","date":"2024-09-15","year":2024,"title":"Purportedly AI-Generated Audio Allegedly Fabricates Biden's Admission of Role in Pakistani Political Crisis","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/856/"},{"id":"INC-03527","date":"2024-11-25","year":2024,"title":"Navigation App Allegedly Directs Car Over Damaged Bridge in Uttar Pradesh, Resulting in Three Deaths","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/857/"},{"id":"INC-03718","date":"2024-09-19","year":2024,"title":"Deepfake Reportedly Used in Attempted Real Estate Fraud in Hallandale Beach, Florida","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/858/"},{"id":"INC-03468","date":"2024-10-30","year":2024,"title":"AI Models Reportedly Found to Provide Misinformation on Election Processes in Spanish","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic, Google, Meta, Mistral, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/859/"},{"id":"INC-04422","date":"2023-10-31","year":2023,"title":"AI Camera Allegedly Misidentifies Dutch Motorist as Using Mobile Phone, Issuing €380 Fine","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Dutch Police, Unknown Traffic Enforcement Camera Technology Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/860/"},{"id":"INC-04130","date":"2024-11-03","year":2024,"title":"Purportedly AI-Generated Video Allegedly Depicts Martin Luther King Jr. Supporting Donald Trump","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Dilley Meme Team, Maga Resource, Pro Trump Social Media Accounts, Ramble Rants, X…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/862/"},{"id":"INC-03802","date":"2024-08-23","year":2024,"title":"Generative AI Allegedly Used to Facilitate $255,000 Real Estate Fraud Scheme","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/864/"},{"id":"INC-03771","date":"2024-10-02","year":2024,"title":"Fake AI 'Nudify' Sites Reportedly Linked to Malware Distribution by Russian Hacker Collective FIN7","severity":"High","attack_vector":"malware","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Carbon Spider, Elbrus, Fin7, Sangria Tempest","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/865/"},{"id":"INC-04029","date":"2024-02-01","year":2024,"title":"Network of 171 AI-Powered Bots Reportedly Spread Political Disinformation Ahead of Ghana’s December 2024 General Election","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Pro New Patriotic Party Bot Network","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/866/"},{"id":"INC-03488","date":"2024-10-31","year":2024,"title":"AI-Generated Airline Reviews Allegedly Mislead Consumers and Undermine Trust","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Unknown Reviewers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/867/"},{"id":"INC-04096","date":"2024-10-14","year":2024,"title":"Portland Water Bureau SERVUS Algorithm Reportedly Allocates Utility Bill Discount to High-Wealth Consumer","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Portland Water Bureau","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/868/"},{"id":"INC-04295","date":"2024-11-04","year":2024,"title":"TikTok Algorithms Allegedly Linked to Minors' Exposure to Harmful Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tiktok","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/869/"},{"id":"INC-03975","date":"2024-12-06","year":2024,"title":"Meeten Malware Campaign Reportedly Undermines Web3 Security Using AI-Legitimized Branding","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Clusee, Cuesee, Meeten, Meetio, Meetone","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/870/"},{"id":"INC-04155","date":"2024-12-13","year":2024,"title":"Reported Deepfake Video of Elon Musk Announcing $20 Million Cryptocurrency Giveaway Circulating on Social Media","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Elon4u.com Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/871/"},{"id":"INC-03483","date":"2024-12-16","year":2024,"title":"AI Voice Cloning of Ari Melber Allegedly Exploited in Scam Targeting Elderly Woman","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/872/"},{"id":"INC-03528","date":"2024-12-10","year":2024,"title":"YouTube Algorithms Allegedly Amplify Eating Disorder Content to Adolescent Girls","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Youtube","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/873/"},{"id":"INC-03399","date":"2024-12-11","year":2024,"title":"1 in 6 Congresswomen Have Reportedly Been Targeted by AI-Generated Nonconsensual Intimate Imagery","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/874/"},{"id":"INC-03680","date":"2024-01-08","year":2024,"title":"Coordinated Deepfake Campaign Reportedly Impersonating Rishi Sunak Promoted Fraudulent Quantum AI Investment Platform on Meta","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Quantum Ai Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/875/"},{"id":"INC-03722","date":"2024-11-24","year":2024,"title":"Deepfake Videos Allegedly Used to Defraud Canadian Immigrants Out of Thousands of Dollars","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/876/"},{"id":"INC-03874","date":"2024-12-16","year":2024,"title":"HTML/Nomani Deepfake Phishing Campaigns Allegedly Use AI-Generated Content to Defraud Social Media Users","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Htmlnomani, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/877/"},{"id":"INC-04166","date":"2024-12-19","year":2024,"title":"Romance Scammer 'Alla Morgan' Allegedly Exploits Deepfake Technology to Defraud Victim of £17,000","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alla Morgan, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/878/"},{"id":"INC-04613","date":"2023-12-29","year":2023,"title":"Deepfake Video Reportedly Depicts U.S. Congressman Rob Wittman Endorsing Military Support for Taiwan's Democratic Progressive Party","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Actors In China","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/879/"},{"id":"INC-04187","date":"2024-12-09","year":2024,"title":"Scammers Reportedly Using Deepfakes of Health Experts and Public Figures in Australia to Sell Health Supplements and Give Harmful Advice","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/880/"},{"id":"INC-04346","date":"2024-12-27","year":2024,"title":"Waymo Robotaxi Allegedly Collides With Serve Robotics Delivery Bot in Los Angeles","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Serve Robotics, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/881/"},{"id":"INC-03502","date":"2024-12-29","year":2024,"title":"AI-Generated Reading Summaries on Fable App Reportedly Wrote Biased and Offensive Commentary","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Fable, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/882/"},{"id":"INC-03545","date":"2024-12-26","year":2024,"title":"Alleged Fake AI-Generated Christmas Card Featuring Prince Harry and Meghan Markle's Children Circulates on Social Media","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown Ai Graphic Tool Developer, X (twitter) Users, X User Pdina","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/883/"},{"id":"INC-04171","date":"2024-12-31","year":2024,"title":"Russian Center for Geopolitical Expertise Allegedly Used AI to Target U.S. Candidates with Disinformation in 2024 Election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Aleksandr Dugin, Center For Geopolitical Expertise (cge), Main Intelligence Directorate (gru), Valery Korovin","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/884/"},{"id":"INC-02884","date":"2025-01-03","year":2025,"title":"Meta AI Characters Allegedly Exhibited Racism, Fabricated Identities, and Exploited User Trust","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/885/"},{"id":"INC-03656","date":"2024-12-27","year":2024,"title":"ChatGPT Reportedly Referenced During Las Vegas Cybertruck Explosion Planning","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Matthew Livelsberger, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/886/"},{"id":"INC-04236","date":"2024-11-14","year":2024,"title":"Students of Richland School District in Cambria County, Pennsylvania Allegedly Used AI to Generate Obscene Images of Other Students","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Minors, Richland School District Students, Students","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/887/"},{"id":"INC-03244","date":"2025-01-06","year":2025,"title":"Sydney High Schooler Allegedly Generated Deepfakes of Other Students","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, High School Students, Students, Unknown Sydney Area High School Student","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/888/"},{"id":"INC-02245","date":"2025-01-07","year":2025,"title":"Tesla's 'Actually Smart Summon' Feature Reportedly Linked to Multiple Parking Lot Collisions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/889/"},{"id":"INC-02226","date":"2025-01-08","year":2025,"title":"AI-Generated Images of the Iconic Hollywood Sign Reportedly on Fire Circulating on Social Media","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Social Media Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/890/"},{"id":"INC-02215","date":"2025-01-08","year":2025,"title":"Purported AI Voice Scam Reportedly Targets Westchester Parents with Fake Kidnapping Ransom Calls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/891/"},{"id":"INC-08172","date":"2024-08-05","year":2024,"title":"Apple Intelligence Allegedly Flags Scam Messages as High Priority","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08","ASI09"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/892/"},{"id":"INC-03016","date":"2025-01-09","year":2025,"title":"Pennsylvania State Police Officer Allegedly Used Work Computer for AI-Generated Pornography","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Stephen Kamnik","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/893/"},{"id":"INC-07367","date":"2017-01-01","year":2017,"title":"RealPage's YieldStar Allegedly Facilitated Rent Price Coordination Among Canadian Landlords","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Canadian Property Managers Using Yieldstar, Choice Properties Real Estate Investment Trust, Core Development Group…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/894/"},{"id":"INC-02270","date":"2025-01-06","year":2025,"title":"Alleged Deepfake of New Zealand Endocrinologist Reportedly Promotes Misleading Diabetes Claim","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/895/"},{"id":"INC-02287","date":"2025-01-13","year":2025,"title":"Alleged Misuse of Facial Recognition Technology by Law Enforcement Reportedly Leading to Wrongful Arrests and Violations of Investigative Standards","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Austin Police Department, Bradenton Florida Police Department, Clearview Ai, Coral Springs Florida Police Department,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/896/"},{"id":"INC-02219","date":"2025-01-10","year":2025,"title":"AI-Assisted Ransomware Campaign by FunkSec Allegedly Targets Over 80 Victims","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Bjorka, Blako, Desertstorm, El Farado, Funksec, Scorpion, Xtn","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/897/"},{"id":"INC-03043","date":"2025-01-15","year":2025,"title":"Prime Minister of Thailand Paetongtarn Shinawatra Claims AI Voice Scam Impersonated ASEAN Leader Requesting Money","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/902/"},{"id":"INC-05148","date":"2022-10-21","year":2022,"title":"Kate Isaacs, Advocate Against Image-Based Abuse, Reports Being Deepfaked","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Twitter User","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/904/"},{"id":"INC-04184","date":"2024-07-01","year":2024,"title":"Scammers Allegedly Use Deepfake Technology to Pose as Leonor, Princess of Asturias, in Fraud Scheme","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Posing As Leonor (princess Of Asturias), Tiktok Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/905/"},{"id":"INC-03540","date":"2024-10-08","year":2024,"title":"Alleged AI-Powered Call Center Breach Exposes Over 10 Million Conversations in the Middle East","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Cybercriminals, Unnamed Ai Call Center Platform Provider","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/906/"},{"id":"INC-04257","date":"2024-07-15","year":2024,"title":"Taranaki, New Zealand Resident Allegedly Defrauded of $224K in Bitcoin Scam Using Deepfake of Prime Minister Christopher Luxon","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Posing As Christopher Luxon","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/907/"},{"id":"INC-06503","date":"2020-07-15","year":2020,"title":"Deepfake Images of Australian Teacher Hannah Grundy and 25 Others Created and Circulated Online by Former Friend","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Andrew Thomas Hayler, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/908/"},{"id":"INC-03973","date":"2024-12-13","year":2024,"title":"Matryoshka Campaign Allegedly Uses Deepfakes to Impersonate Academics for Pro-Russian Propaganda","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Matryoshka, Operation Overload, Reliable Russian News, Russian Entities Linked To Gru,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/909/"},{"id":"INC-02259","date":"2025-01-15","year":2025,"title":"Alleged AI-Driven Phishing Scam Impersonates Maine Town Official to Falsely Request $22,500","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/910/"},{"id":"INC-05362","date":"2022-05-01","year":2022,"title":"Yahoo Boys Allegedly Employ Real-Time Deepfake Technology in Romance Scams","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Brouteurs, Deepfake Technology Developers, Scammers In Nigeria, Yahoo Boys","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/911/"},{"id":"INC-04365","date":"2024-11-21","year":2024,"title":"Yahoo Boys and Scammers from Morocco Allegedly Target U.S. Widows and Vulnerable Individuals with 'Artificial Patriot' Scams","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Brouteurs, Deepfake Technology Developers, Scammers In Ghana, Scammers In Morocco, Scammers In Nigeria, Scammers In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/912/"},{"id":"INC-03383","date":"2025-01-27","year":2025,"title":"Yahoo Boys Allegedly Using AI-Generated News Videos to Blackmail Sextortion Victims","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Brouteurs, Deepfake Technology Developers, Scammers In Ghana, Scammers In Nigeria, Scammers In West Africa, Yahoo Boys","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/913/"},{"id":"INC-03543","date":"2024-12-26","year":2024,"title":"Alleged Deepfake of Luis Suárez Used to Scam Uruguayans in Fake Investment Scheme","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Braziko, Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/914/"},{"id":"INC-03534","date":"2024-10-28","year":2024,"title":"Alaska Education Department Reportedly Published Policy Featuring Erroneous AI-Generated Citations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alaska Department Of Education And Early Development, Deena Bishop, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/915/"},{"id":"INC-03033","date":"2025-01-23","year":2025,"title":"Plymouth, Massachusetts Resident Reportedly Used AI Chatbots CrushOn.ai and JanitorAI to Harass and Intimidate Victims","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Crushon.ai, James Florence Jr., Janitorai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/916/"},{"id":"INC-02271","date":"2025-02-05","year":2025,"title":"Alleged Deepfake of Whoopi Goldberg Reportedly Used in Fake Weight-Loss Supplement Ads on Instagram","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Whoopi Goldberg, Synthetic Media Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/917/"},{"id":"INC-02217","date":"2025-02-04","year":2025,"title":"AI-Aided Scam in Thailand Allegedly Impersonates Police to Defraud 163 Victims","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Poipet Based Scam Gang, Ramil Pantawong, Thanawut Kanyaphan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/918/"},{"id":"INC-04125","date":"2024-02-06","year":2024,"title":"Purported Russian-Linked Network Allegedly Used Deepfake of Maria Ressa on Facebook and Bing to Promote Cryptocurrency Scam Targeting Filipinos","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, M1 Shop, Russian Linked Scam Network, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/919/"},{"id":"INC-02272","date":"2025-02-01","year":2025,"title":"Alleged Deepfake Scam Reportedly Promoted Trump Golden Eagles Project as Investment Opportunity","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Investment Scam Operators, Scammers, Synthetic Audio Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/920/"},{"id":"INC-02696","date":"2025-01-05","year":2025,"title":"Hong Kong Authorities Seize HK$34M in Alleged Deepfake Scam Targeting Victims in Taiwan, Singapore, and Malaysia","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Hong Kong Based Deepfake Scam Syndicate, Image Generation Technology","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/921/"},{"id":"INC-02214","date":"2025-02-04","year":2025,"title":"AI Voice Scam Allegedly Defrauds Game and Coffee Store in Havre, Montana","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/922/"},{"id":"INC-02965","date":"2025-02-08","year":2025,"title":"Nottingham Gallery Owner Allegedly Defrauded by Deepfake Impersonating Pierce Brosnan, Reportedly Leading to Business Closure","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Pierce Brosnan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/923/"},{"id":"INC-03547","date":"2024-10-15","year":2024,"title":"Alleged License Plate Recognition Errors in Christchurch Lead to Wrongful Parking Fines","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Parking Enforcement Services, Unknown License Plate Recognition Developer, Wilson Parking","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/925/"},{"id":"INC-06639","date":"2020-01-01","year":2020,"title":"Giorgia Meloni Reportedly Targeted by Deepfake Pornography","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alessio Scurosu, Deepfake Technology Developers, Roberto Scurosu","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/926/"},{"id":"INC-03704","date":"2024-12-12","year":2024,"title":"Deepfake Cryptocurrency Scam Allegedly Impersonates Italian President Sergio Mattarella and Prime Minister Giorgia Meloni","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Unknown Scammers Impersonating Sergio Mattarella And Giorgia Meloni","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/928/"},{"id":"INC-03175","date":"2025-01-21","year":2025,"title":"Reportedly Manipulated TikTok Videos Misrepresent Anti-AfD Protests as Far-Right Rallies","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Afd Supporters, Synthetic Audio Generation Technology Developers, Tiktok User Afd John, Tiktok User Alice Weidel Fan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/931/"},{"id":"INC-03613","date":"2024-12-25","year":2024,"title":"BP New Zealand's License Plate Recognition System Reportedly Misidentified Auckland Driver for Fuel Theft in Whanganui","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Bp New Zealand, Unspecified Developer Of Bp's License Plate Recognition System","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/932/"},{"id":"INC-03252","date":"2025-02-15","year":2025,"title":"Teenager in Palma de Mallorca Allegedly Generated and Distributed Deepfake Nudes of Five Classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unnamed Adolescent Male In Palma De Mallorca","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/933/"},{"id":"INC-02246","date":"2025-02-10","year":2025,"title":"NHK Terminates AI Translation Service After Geopolitical Naming Error","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Nhk","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/934/"},{"id":"INC-03162","date":"2025-02-17","year":2025,"title":"Reported Deepfake of Maltese Prime Minister Robert Abela and Journalist Mark Laurence Zammit Used to Promote Fraudulent Investment","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Robert Abela And Mark Laurence Zammit, Synthetic…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/935/"},{"id":"INC-03711","date":"2024-04-12","year":2024,"title":"Deepfake of Former Prime Minister of Malta Joseph Muscat Allegedly Promotes Nord Invest Scam","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/936/"},{"id":"INC-02370","date":"2025-02-10","year":2025,"title":"Bolivian Criminal Network Allegedly Used Deepfake of Education Minister to Defraud at Least 19 Victims in Employment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Alfredo Ch. S., Deepfake Technology Developers, Jackelin A.m., Luis G.c., Mariana A.s., Scammers, Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/937/"},{"id":"INC-03110","date":"2025-02-01","year":2025,"title":"Purportedly AI-Assisted Impersonation of Martin Henderson in Romance Scam Leads to Reported NZ$375,000 Fraud","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Large Language Model Developers, Scammers, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/938/"},{"id":"INC-02232","date":"2025-02-21","year":2025,"title":"AI-Powered Chinese Surveillance Campaign 'Peer Review' Used for Real-Time Monitoring of Anti-State Speech on Western Social Media","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chinese Communist Party, Chinese State Linked Actors, Chinese State Security Researchers, Meta, Openai, Surveillance…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/939/"},{"id":"INC-02247","date":"2025-02-17","year":2025,"title":"Tesla Cybertruck Operating in Full Self-Driving Mode Reportedly Crashes into Pole in Nevada After Failing to Merge","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/940/"},{"id":"INC-08173","date":"2025-02-20","year":2025,"title":"Cybercriminals Reportedly Exploited Google’s G.Co Subdomain and Spoofed Caller ID in AI-Driven Phishing Attack on Hack Club Founder","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Scammers, Scammers Impersonating Google Staff, Synthetic Audio Generation Technology, Voice Phishers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/942/"},{"id":"INC-02248","date":"2025-02-20","year":2025,"title":"Nonconsensual Explicit AI-Generated Images of Up to 60 Gladstone Park Secondary College Students in Victoria, Australia, Reportedly Created and Circulated Online","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Students, Two Unidentified Year 11 Students At Gladstone Park Secondary College","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/943/"},{"id":"INC-02791","date":"2025-02-20","year":2025,"title":"Kenya's Foreign Affairs Principal Secretary Korir Sing'Oei Reportedly Shared AI-Generated Video Depicting Fareed Zakaria Praising Sudan Diplomacy","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Korir Sing'oei, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/944/"},{"id":"INC-03308","date":"2025-02-19","year":2025,"title":"Two 16-Year-Old Students in Athens, Greece Allegedly Generated Nonconsensual Deepfake Pornography of Their Classmates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Minors, Students, Two Unnamed 16 Year Old Students In Athens","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/945/"},{"id":"INC-05050","date":"2022-01-01","year":2022,"title":"Arizona Residents Reportedly a Frequent Target of AI-Driven Romance Scams","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Romance Scammers Targeting Arizonans, Scammers, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/946/"},{"id":"INC-04309","date":"2024-09-25","year":2024,"title":"Two Members of Highline Public Schools Community in King County, Washington Reportedly Targeted in Deepfake Kidnapping Scam","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/947/"},{"id":"INC-02279","date":"2025-02-23","year":2025,"title":"Alleged FraudGPT-Enabled Phishing Attack Spoofs ChatGPT Subscription Service to Steal Credentials","severity":"High","attack_vector":"phishing","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Dark Web Threat Actors, Fraudgpt, Fraudgpt Operators, Openai, Phishing Scammers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/948/"},{"id":"INC-03313","date":"2025-02-24","year":2025,"title":"Unauthorized AI-Generated Video of Donald Trump and Elon Musk Reportedly Appears on HUD Building Screens","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unnamed","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/949/"},{"id":"INC-04047","date":"2024-07-11","year":2024,"title":"NullBulge's AI-Powered Malware Allegedly Compromises Disney Employee and Internal Data","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Nullbulge","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/950/"},{"id":"INC-02331","date":"2025-02-25","year":2025,"title":"Apple’s Voice Dictation Reportedly Substitutes ‘Trump’ for ‘Racist’ Due to Speech Recognition Bug","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apple","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/952/"},{"id":"INC-03723","date":"2024-11-01","year":2024,"title":"Deepfake Videos of Barbara O’Neill Allegedly Used in Health Scam Targeting Social Media Users","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Barbara O'neill, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/953/"},{"id":"INC-02390","date":"2025-02-04","year":2025,"title":"Chatbots Allegedly Used in Romance Scams Targeting Nearly One-Third of New Zealand's Dating App Users","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Romance Scammers Targeting New Zealanders, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/954/"},{"id":"INC-03812","date":"2024-12-19","year":2024,"title":"Global Cybercrime Network Storm-2139 Allegedly Exploits AI to Generate Deepfake Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Alan Krysiak (drago), Arian Yadegarnia (fiz), Phat Phung Tan (asakuri), Ricky Yuen (cg Dot), Storm 2139, Unidentified…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/955/"},{"id":"INC-02283","date":"2025-02-28","year":2025,"title":"Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Common Crawl, Microsoft, Microsoft Azure Openai Service, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/956/"},{"id":"INC-02284","date":"2025-02-28","year":2025,"title":"Alleged Instagram Algorithm Malfunction Floods Users' Reels Feeds with Violent and Graphic Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/957/"},{"id":"INC-02551","date":"2025-02-26","year":2025,"title":"Europol Operation Cumberland Investigates at Least 273 Suspects in 19 Countries for AI-Generated Child Sexual Abuse Material","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Csam Distributors, Deepfake Creators, Deepfake Csam Technology, Deepfake Csam Technology Developers, Deepfake…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/958/"},{"id":"INC-02492","date":"2025-03-02","year":2025,"title":"Deepfake Video of Indonesian President Prabowo Subianto and Other Officials Reportedly Used in Scam to Defraud Citizens Across 20 Provinces","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Prabowo Subianto, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/959/"},{"id":"INC-03032","date":"2025-02-06","year":2025,"title":"Plaintiffs' Lawyers Admit AI Generated Erroneous Case Citations in Federal Court Filing Against Walmart","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Goody Law Group, Large Language Model Developers, Morgan And Morgan, Rudwin Ayala, T. Michael Morgan, Taly Goody","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/960/"},{"id":"INC-04201","date":"2024-12-16","year":2024,"title":"Serbian Authorities Allegedly Used AI-Powered Cellebrite Tools to Unlock Journalist’s Phone and Install Spyware","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cellebrite, Government Of Serbia, Serbian Police, Serbian Security Information Agency (bia), Surveillance Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/961/"},{"id":"INC-03249","date":"2025-03-05","year":2025,"title":"Tbilisi-Based Call Center Allegedly Uses AI-Driven Scripts to Defraud Over 6,000 Victims of $35 Million","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Admiralsfx, Ak Group, Akaki Kevkhishvili, Deepfake Technology Developers, Fraudulent Trading Platform Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/962/"},{"id":"INC-02639","date":"2025-03-05","year":2025,"title":"Google Reports Alleged Gemini-Generated Terrorism and Child Exploitation to Australian eSafety Commission","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/963/"},{"id":"INC-02249","date":"2025-03-04","year":2025,"title":"AI-Powered 'Insights' Feature for the Los Angeles Times Allegedly Justifies Ku Klux Klan’s History","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Los Angeles Times, Patrick Soon Shiong, Perplexity","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/964/"},{"id":"INC-03024","date":"2025-03-04","year":2025,"title":"Phishers Allegedly Using AI-Generated Video of YouTube CEO Neal Mohan to Target Creators","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Phishers, Scammers, Scammers Impersonating Neal Mohan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/965/"},{"id":"INC-03783","date":"2024-07-16","year":2024,"title":"Ferrari Executive Targeted by AI Deepfake Scam Impersonating CEO Benedetto Vigna","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Phishers, Scammers, Scammers Impersonating Benedetto Vigna, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/966/"},{"id":"INC-02296","date":"2025-03-06","year":2025,"title":"Amazon and Google AI Allegedly Promote Mein Kampf as 'a True Work of Art' in Search Results","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Google","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/967/"},{"id":"INC-05007","date":"2022-02-24","year":2022,"title":"'Pravda' Network, Successor to 'Portal Kombat,' Allegedly Seeding AI Models with Kremlin Disinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Anthropic, Google, Government Of Russia, Inflection, Information Manipulation Actors, John Mark Dougan, Meta,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/968/"},{"id":"INC-03197","date":"2025-03-04","year":2025,"title":"Scammers Allegedly Using Deepfake Technology to Impersonate Prime Minister of Armenia Nikol Pashinyan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Nikol Pashinyan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/970/"},{"id":"INC-08174","date":"2024-09-25","year":2024,"title":"Russian Influence Operation Allegedly Uses AI to Create Fake Kamala Harris Campaign Website and Rhino-Hunting Hoax","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, John Mark Dougan, Pravda Network, Rt (russia Today), Russian State Media, Sputnik,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/972/"},{"id":"INC-02384","date":"2025-03-05","year":2025,"title":"Canadian Fraud Ring Allegedly Used AI Voice Cloning in Multi-Year $21 Million Grandparent Scam Targeting Elderly Americans Across 46 States","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Canadian Fraud Ring Impersonating Grandchildren, Canadian Fraud Ring Involved In Grandparent Scams, Scammers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/973/"},{"id":"INC-03075","date":"2025-03-04","year":2025,"title":"Purported Deepfake Audio Allegedly Impersonates U.S. Secretary of State Marco Rubio in Starlink Disinformation Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Misinformation Spreaders, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/974/"},{"id":"INC-02339","date":"2025-03-05","year":2025,"title":"At Least 10,000 AI Chatbots, Including Jailbroken Models, Allegedly Promote Eating Disorders, Self-Harm, and Sexualized Minors","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Anthropic, Character.ai, Chub Ai, Crushon.ai, Google, Janitorai, Openai, Spicy Chat, Unidentified Online Communities…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/975/"},{"id":"INC-02227","date":"2025-03-08","year":2025,"title":"AI-Generated OB-GYN Health Influencers on TikTok Used Fake Medical Credentials to Promote Dubious Advice","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Captions, Unknown Tiktok Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/976/"},{"id":"INC-02250","date":"2025-03-02","year":2025,"title":"AI-Driven News Platform Accused of Spreading Unverified Terrorism Allegations Against Yale Scholar","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Jewish Onliner, Large Language Model Developers, Unknown Ai News Platform Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/977/"},{"id":"INC-02421","date":"2025-03-09","year":2025,"title":"Chinese Actor and CPPCC Member Jin Dong Allegedly Impersonated by AI Deepfake Scammers to Mislead and Defraud Fans","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Jin Dong, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/978/"},{"id":"INC-02251","date":"2025-03-05","year":2025,"title":"Art Museum in Jinan, Shandong Allegedly Generated and Displayed a Sexualized Childlike Avatar with an Adult Body","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Jinan Art Museum","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/979/"},{"id":"INC-02228","date":"2025-03-07","year":2025,"title":"AI-Generated Songs Allegedly Imitating Céline Dion Circulate Online Without Authorization","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Synthetic Audio Generation Technology Developers, Unknown Celine Dion Voice Cloners","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/980/"},{"id":"INC-02252","date":"2025-03-05","year":2025,"title":"Apple AI Transcription Allegedly Inserts Explicit Language into Scottish Woman’s Voicemail","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Apple, Lookers Land Rover","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/981/"},{"id":"INC-03200","date":"2025-03-13","year":2025,"title":"Scammers Reportedly Using Deepfake Video Calls to Impersonate Executives in Singapore and Orchestrate Corporate Bank Transfers","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Singaporean Executives","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/982/"},{"id":"INC-04186","date":"2024-05-10","year":2024,"title":"Scammers Reportedly Used AI Voice Clone and YouTube Footage to Impersonate WPP CEO in Unsuccessful Scam Attempt","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Mark Read, Synthetic Audio Generation Technology","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/983/"},{"id":"INC-02493","date":"2025-03-07","year":2025,"title":"Deepfake Videos Allegedly Use AI-Generated Voice Clone of Singapore Prime Minister Lawrence Wong to Promote Scams","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Lawrence Wong, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/984/"},{"id":"INC-04428","date":"2023-12-29","year":2023,"title":"Alleged Deepfake of Singapore Prime Minister Lee Hsien Loong Promotes Cryptocurrency Scam in Fake Interview","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Lee Hsien Loong, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/985/"},{"id":"INC-04181","date":"2024-06-02","year":2024,"title":"Scammers Allegedly Manipulate 2023 Speech of Singapore Senior Minister Lee Hsien Loong to Spread Deepfake Investment Fraud","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Lee Hsien Loong, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/986/"},{"id":"INC-04427","date":"2023-12-11","year":2023,"title":"Alleged Deepfake of Singapore Deputy Prime Minister Lawrence Wong Falsely Shows Him Endorsing Commercial Products","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Lawrence Wong, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/987/"},{"id":"INC-04197","date":"2024-06-21","year":2024,"title":"Senior Minister of Singapore Lee Hsien Loong Allegedly Misrepresented in Two Deepfake Videos on Foreign Relations","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors Impersonating Lee…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/988/"},{"id":"INC-02253","date":"2025-03-05","year":2025,"title":"Alleged AI-Generated Video by Spain’s People’s Party Results in Diplomatic Fallout with the Dominican Republic","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Partido Popular, People's Party (spain)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/989/"},{"id":"INC-03684","date":"2024-11-19","year":2024,"title":"Corinth School District Educator in Mississippi Allegedly Used AI to Generate CSAM of Students","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Educators, Teachers, Wilson Jones","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/990/"},{"id":"INC-02263","date":"2025-03-14","year":2025,"title":"Alleged AI-Generated IRS Scam Websites Used to Defraud U.S. Taxpayers","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Black Box Ai Developers, Cybercriminals, Generative Ai Developers, Generative Ai Fraud Tools, Phishers, Scammers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/991/"},{"id":"INC-04566","date":"2023-04-15","year":2023,"title":"Chinese Businessman Reportedly Defrauded of 4.3 Million Yuan by AI-Generated Deepfake Impersonating Friend","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Friend Of Guo, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/992/"},{"id":"INC-03246","date":"2025-03-12","year":2025,"title":"Sydney Students Allegedly Forced to Retake NAPLAN After AI Predictive Text Error","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Apple, Australian Curriculum Assessment And Reporting Authority (acara), Kambala (sydney Australia), Nsw Education…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/993/"},{"id":"INC-02220","date":"2025-03-18","year":2025,"title":"AI-Enabled Organized Crime Expands Across Europe","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Generative Ai Developers, Organized Crime Groups","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/994/"},{"id":"INC-04946","date":"2023-12-27","year":2023,"title":"The New York Times Reportedly Sues OpenAI and Microsoft Over Alleged Unauthorized AI Training on Its Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/995/"},{"id":"INC-06334","date":"2020-10-25","year":2020,"title":"Meta Allegedly Used Books3, a Dataset of 191,000 Pirated Books, to Train LLaMA AI","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Bloomberg, Eleutherai, Generative Ai Developers, Meta, Shawn Presser, The Pile","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/996/"},{"id":"INC-04738","date":"2023-02-28","year":2023,"title":"Meta and OpenAI Accused of Using LibGen’s Pirated Books to Train AI Models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Meta, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/997/"},{"id":"INC-03636","date":"2024-08-15","year":2024,"title":"ChatGPT Allegedly Defamed Norwegian User by Inventing Child Homicide and Imprisonment","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/998/"},{"id":"INC-02341","date":"2025-03-12","year":2025,"title":"Attackers Reportedly Deployed Simulated AI Support Chatbot to Trick Instagram Business Users into Adding Malicious 2FA Login","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Phishers, Scammers, Scammers Impersonating Meta Support","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/999/"},{"id":"INC-03223","date":"2025-03-23","year":2025,"title":"Sora Video Generator Has Reportedly Been Creating Biased Human Representations Across Race, Gender, and Disability","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1000/"},{"id":"INC-02839","date":"2025-03-17","year":2025,"title":"LLM Scrapers Allegedly Target Multiple Open Source Projects Disrupting the FOSS Ecosystem","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Alibaba, Generative Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1001/"},{"id":"INC-02856","date":"2025-03-23","year":2025,"title":"Manipulated Video Using AI-Generated Audio Targets Pakistan's Prime Minister Shehbaz Sharif with Fabricated Interview","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Adil Raja, Deepfake Technology Developers, Social Media Users, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1002/"},{"id":"INC-02280","date":"2025-03-18","year":2025,"title":"Alleged Fraudulent Prompts via AIXBT Dashboard Led Purported AI Trading Agent to Transfer 55.5 ETH from Simulacrum Wallet","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"0xhungusman, Rxbt","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1003/"},{"id":"INC-04177","date":"2024-08-15","year":2024,"title":"San Francisco City Attorney Sues Operators of AI Deepfake Pornography Websites for Violations of State and Federal Law","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Operators Of 16 Deepfake Pornography Websites","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1004/"},{"id":"INC-02905","date":"2025-03-12","year":2025,"title":"Misleading Deepfake Video of Trump Mocking Zelenskyy for Clothing Goes Viral on Facebook","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Dangerousai, Deepfake Technology Developers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1005/"},{"id":"INC-02540","date":"2025-02-20","year":2025,"title":"Edinburg, Texas Police Officer Arrested for Alleged Possession of CSAM, Including AI-Generated Deepfakes of Minors","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Preston Wade Pietrzykowski","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1006/"},{"id":"INC-02229","date":"2025-03-13","year":2025,"title":"AI-Generated Voice Cloning of Trump Falsely Proposes Renaming the District of Columbia to the District of America","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Tiktok User","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1007/"},{"id":"INC-02230","date":"2025-02-10","year":2025,"title":"AI-Generated Voice Purporting to Be Daughter Allegedly Used to Coerce $2,000 from Colorado Mother","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers Impersonating Daughter Of Linda Roan,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1008/"},{"id":"INC-03111","date":"2025-02-13","year":2025,"title":"Purportedly AI-Assisted Report by Tromsø Officials Allegedly Cited Non-Existent Sources in School Closure Proposal","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Large Language Model Developers, Stig Tore Johnsen, Tromso Municipality","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1009/"},{"id":"INC-02603","date":"2025-03-31","year":2025,"title":"GenNomis AI Database Reportedly Exposes Nearly 100,000 Deepfake and Nudify Images in Public Breach","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Ai Nomis, Gennomis, Gennomis By Ai Nomis","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1010/"},{"id":"INC-02490","date":"2025-04-05","year":2025,"title":"Deepfake of Bermuda Premier David Burt Promotes Investment Scam Using Royal Gazette Branding","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating David Burt, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1011/"},{"id":"INC-02213","date":"2025-04-03","year":2025,"title":"AI Voice Clone of Texas Woman Used in Distress Scam Targeting Brother in Port Neches","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Scammers, Scammers Impersonating Jayla (sister Of Jace Edgar), Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1012/"},{"id":"INC-02548","date":"2025-04-04","year":2025,"title":"Essex Man Sentenced to Five Years in Prison for Having Generated and Shared Deepfake Pornography of at Least 20 Women and a Minor","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Brandon Tyler, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1013/"},{"id":"INC-04235","date":"2024-10-01","year":2024,"title":"Students in Maltese Schools Reportedly Being Targeted by Deepfake Nudes","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Creators In Malta, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1014/"},{"id":"INC-03160","date":"2025-04-07","year":2025,"title":"Reported Darknet Launch of Xanthorox AI Introduces Autonomous Cyberattack Platform","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"Cybercriminals, Darknet Forum Users, Unknown Black Hat Ai Developers, Unknown Malicious Actors, Xanthorox Ai Creators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1015/"},{"id":"INC-02776","date":"2025-04-09","year":2025,"title":"Jailbroken Lovable AI Allegedly Used to Generate and Host Phishing Pages, Steal Credentials, and Bypass Security","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM07"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"Cybercriminals, Loveable Ai, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1016/"},{"id":"INC-02269","date":"2025-04-07","year":2025,"title":"Alleged Deepfake Investment Scam in Spain Defrauds 208 Victims of €19 million ($20.9 million)","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Individuals Arrested In Granada And Alicante, Unnamed…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1017/"},{"id":"INC-03008","date":"2025-03-31","year":2025,"title":"OpenAI's 4o Model Allegedly Used to Generate Fake Receipts and Prescriptions","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1018/"},{"id":"INC-02261","date":"2025-04-10","year":2025,"title":"Alleged AI-Generated Clone of Exante Brokerage Used to Defraud U.S. Investor via JPMorgan Account","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Openai, Scammers, Scammers Cloning Exante","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1019/"},{"id":"INC-03177","date":"2025-04-11","year":2025,"title":"Reportedly Unsafe Deployment of Llama.cpp Reveals Interactive AI-Generated CSAM Roleplay Prompts","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Meta, Users Of Llama.cpp Servers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1020/"},{"id":"INC-04614","date":"2023-10-12","year":2023,"title":"Deepfake Video Reportedly Depicts Zambian President Hakainde Hichilema Withdrawing from 2026 Election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@zambian Ai Tiktok Account, Deepfake Technology Developers, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1022/"},{"id":"INC-04111","date":"2024-02-19","year":2024,"title":"Purported AI-Cloned Voice Depicts Kenyan President William Ruto Speaking French in Viral Video","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors, Unknown Actors…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1023/"},{"id":"INC-03923","date":"2024-04-24","year":2024,"title":"Kenyan Journalist Jeff Koinange Depicted Endorsing Gambling App in Purported AI-Generated Deepfake","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Jeff Koinange","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1024/"},{"id":"INC-03544","date":"2024-03-18","year":2024,"title":"Alleged Deepfake Video Depicts Former President of Kenya Uhuru Kenyatta Announcing 2027 Presidential Bid","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1025/"},{"id":"INC-02926","date":"2025-04-12","year":2025,"title":"Multiple LLMs Allegedly Endorsed Suicide as a Viable Option During Non-Adversarial Mental Health Venting Session","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Anthropic, Deepseek Ai, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1026/"},{"id":"INC-02963","date":"2025-04-10","year":2025,"title":"Norwegian Supreme Court Receives Legal Filing with Fabricated Citations Allegedly Generated by AI Tool","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Unnamed Norwegian Lawyer, Unspecified Generative Ai Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1027/"},{"id":"INC-03009","date":"2025-02-07","year":2025,"title":"OpenAI's Operator Agent Reportedly Executed Unauthorized $31.43 Transaction Despite Safety Protocol","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1028/"},{"id":"INC-03053","date":"2025-02-15","year":2025,"title":"Purported AI-Generated Audio Was Reportedly Used to Claim Recep Tayyip Erdoğan Expressed Support for Imran Khan in Pakistani Parliament","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1029/"},{"id":"INC-02337","date":"2025-01-05","year":2025,"title":"Aspiring Artist Cherelle Kozak Reportedly Targeted by AI-Powered Impersonation of Rapper Fat Joe","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Scammers Impersonating Fat Joe","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1030/"},{"id":"INC-03305","date":"2025-04-19","year":2025,"title":"Transgender User Alleges ChatGPT Allowed Suicide Letter Without Crisis Intervention","severity":"High","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1031/"},{"id":"INC-04839","date":"2023-08-29","year":2023,"title":"Reported Doctored Video of Nigerian President Bola Tinubu Claims Naira Will Be Replaced by U.S. Dollar","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1032/"},{"id":"INC-04986","date":"2023-11-13","year":2023,"title":"Video Allegedly Altered by AI Reportedly Spreads Claim of Nigerian Doctor's Hypertension Cure","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers In Nigeria, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1033/"},{"id":"INC-04153","date":"2024-08-04","year":2024,"title":"Reported AI-Manipulated Video Depicts Donald Trump Endorsing Peter Obi and Criticizing Bola Tinubu","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1034/"},{"id":"INC-04115","date":"2024-11-20","year":2024,"title":"Purported AI-Generated Video Depicts Trump Urging Release of Nigerian Separatist Leader Nnamdi Kanu","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1035/"},{"id":"INC-03071","date":"2025-01-20","year":2025,"title":"Purported AI-Manipulated News Clip Fabricates Explosion and Doctor's Murder Plot for Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1036/"},{"id":"INC-02901","date":"2025-04-16","year":2025,"title":"Microsoft Reportedly Blocks 1.6 Million Bot Signup Attempts Per Hour Amid Global AI-Driven Fraud Surge","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Cybercriminals, Deepfake Technology Developers, Generative Ai Developers, Scammers, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1037/"},{"id":"INC-03198","date":"2025-04-22","year":2025,"title":"Scammers Reportedly Use AI Tools to Impersonate Students and Obtain Federal Aid","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Openai, Scammers, Scammers Targeting California Community Colleges","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1038/"},{"id":"INC-02327","date":"2025-04-19","year":2025,"title":"Anysphere AI Support Bot for Cursor Reportedly Invents Login Policy, Leading to Subscription Cancellations","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anysphere, Cursor, Unknown Llm Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1039/"},{"id":"INC-02891","date":"2025-04-26","year":2025,"title":"Meta User-Created AI Companions Allegedly Implicated in Facilitating Sexually Themed Conversations Involving Underage Personas","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1040/"},{"id":"INC-02957","date":"2025-01-21","year":2025,"title":"Nomi Chatbots Reportedly Encouraged Suicide, Sexual Violence, Terrorism, and Hate Speech","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Glimpse Ai, Nomi Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1041/"},{"id":"INC-02558","date":"2025-03-25","year":2025,"title":"Fact-Checking Finds Reportedly AI-Generated Video Misattributed Hypertension Cure Endorsements to Taiwo Ajai-Lycett and Chinonso Egemba","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers Impersonating Chinonso Egemba, Scammers Impersonating Taiwo Ajai…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1042/"},{"id":"INC-03150","date":"2025-04-26","year":2025,"title":"Reddit Moderators Report Unauthorized AI Study Involving Fabricated Identities by Purported University of Zurich Researchers","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Large Language Model Developers, University Of Zurich Researchers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1043/"},{"id":"INC-03165","date":"2025-04-15","year":2025,"title":"Reported Emergence of 'Vegetative Electron Microscopy' in Scientific Papers Traced to Purported AI Training Data Contamination","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic, Openai, Researchers, Scientific Authors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1044/"},{"id":"INC-02921","date":"2025-04-29","year":2025,"title":"Mother in Louisville, Kentucky Describes Phone Scam Involving Purported AI-Generated Voice of Her Daughter","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1045/"},{"id":"INC-02374","date":"2025-04-24","year":2025,"title":"Brazil's Social Security AI Tool Is Allegedly Rejecting Complex Claims Improperly","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Dataprev, Government Of Brazil, Instituto Nacional Do Seguro Social (inss)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1046/"},{"id":"INC-02345","date":"2025-04-27","year":2025,"title":"Australian Analyst Allegedly Targeted by Scam Using Purportedly Sophisticated AI-Generated Corporate Materials","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Appc Capital Singapore, Cybercriminals, Generative Ai Developers, Scammers, Thackeray Mines And Minerals Inc.,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1047/"},{"id":"INC-03254","date":"2025-01-10","year":2025,"title":"Tennessee Meteorologist's Likeness Reportedly Used in Sextortion Campaign Involving Purported AI-Generated Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Deepfake Technology Developers, Unknown Sextortionists","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1048/"},{"id":"INC-02210","date":"2025-01-26","year":2025,"title":"AI Tools Reportedly Used to Fabricate Image of 5,000-Naira Nigerian Banknote Featuring President Bola Tinubu","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unidentified Social Media Users, X (twitter) Users, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1049/"},{"id":"INC-03173","date":"2025-03-31","year":2025,"title":"Reportedly AI-Generated Image Circulates Amid Reports of Tanzania Revenue Authority Job Interviews","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1050/"},{"id":"INC-03330","date":"2025-02-18","year":2025,"title":"Video Reportedly Created with AI Appears to Show Trump Backing Biafra Secession","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Elontalks, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1051/"},{"id":"INC-03065","date":"2025-01-25","year":2025,"title":"Purported AI-Generated Video Reportedly Depicts Trump Criticizing Former Kenyan Deputy President Rigathi Gachagua","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1052/"},{"id":"INC-04022","date":"2024-03-30","year":2024,"title":"Mumbai Businessman Reportedly Defrauded via Purported AI-Cloned Voice Impersonating Son","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1053/"},{"id":"INC-02322","date":"2025-04-23","year":2025,"title":"Anthropic Report Details Claude Misuse for Influence Operations, Credential Stuffing, Recruitment Fraud, and Malware Development","severity":"High","attack_vector":"malware","owasp_llm":["LLM01","LLM03","LLM07"],"owasp_asi":["ASI02","ASI09","ASI10"],"cve_ids":[],"affected":"Anthropic, Cybercriminals, Influence As A Service Operators, Unknown Malicious Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1054/"},{"id":"INC-02573","date":"2025-04-29","year":2025,"title":"FBI Reports AI Use by Threat Actors in Broader Cyber Context Including Infrastructure Intrusions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chinese Communist Party, Generative Ai Developers, Government Of China","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1055/"},{"id":"INC-03068","date":"2025-02-12","year":2025,"title":"Purported AI-Generated Videos Impersonating President of Malta Myriam Spiteri Debono Circulate on Social Media in Alleged Crypto Scam Campaigns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Unknown Scammers Impersonating Myriam Spiteri Debono","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1056/"},{"id":"INC-07359","date":"2017-08-15","year":2017,"title":"'Jewish Baby Strollers' Provided Antisemitic Google Images, Allegedly Resulting from Hate Speech Campaign","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1057/"},{"id":"INC-04113","date":"2024-05-06","year":2024,"title":"Purported AI-Generated Deepfake Images of Katy Perry at 2024 Met Gala Circulate Widely","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1058/"},{"id":"INC-03202","date":"2025-05-06","year":2025,"title":"Second Consecutive Year of Alleged AI-Generated Images Depicting Katy Perry at Met Gala Circulating Online","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1059/"},{"id":"INC-02765","date":"2025-05-06","year":2025,"title":"Institute for Strategic Dialogue Reports Russian-Aligned Operation Overload Using Purported AI-Generated Impersonations Across January to March 2025","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Matryoshka, Operation Overload, Russian Aligned Actors,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1060/"},{"id":"INC-03178","date":"2025-02-07","year":2025,"title":"Reportedly Viral USAID Disinformation Video Linked to Russian-Aligned Campaign Known as Matryoshka","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Matryoshka, Operation Overload, Russian Linked Disinformation Network, Storm 1679,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1061/"},{"id":"INC-02375","date":"2025-05-07","year":2025,"title":"Brazilian Authorities Reportedly Link AI-Generated Marcos Mion Videos to Purported Fake Restaurant Promotions in Brazil","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Money Launderers, Scammers, Synthetic Audio Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1062/"},{"id":"INC-03073","date":"2025-05-12","year":2025,"title":"Purported AI-Manipulated Videos of Cypriot Officials Circulated in Alleged Investment Fraud","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1063/"},{"id":"INC-03539","date":"2024-11-14","year":2024,"title":"Alleged AI-Generated Scam Uses Bank of Cyprus Branding to Solicit Investments","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unidentified Scam Network","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1064/"},{"id":"INC-04182","date":"2024-09-23","year":2024,"title":"Scammers Allegedly Use AI-Generated Avatars to Impersonate Friends in Houston, Texas and Solicit Money","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1065/"},{"id":"INC-02698","date":"2025-04-07","year":2025,"title":"Hong Kong Syndicate Allegedly Used AI-Generated Facial Composites to Open Bank Accounts","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Hong Kong Based Triad Affiliated Fraud Syndicate, Image…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1066/"},{"id":"INC-02290","date":"2025-02-18","year":2025,"title":"Alleged Use of Purported AI-Generated Identities to Defraud FTX Claims Buyers of $5.6M","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Fraudster Using Aliases Lim Chee Chong And Teh Jin Loon, Money Launderers, Scammers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1067/"},{"id":"INC-02234","date":"2025-04-15","year":2025,"title":"AI-Powered Presentation Tool Gamma Implicated in Multi-Stage Phishing Campaign","severity":"High","attack_vector":"phishing","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Gamma, Unknown Aitm Phishing Campaign Actors, Unknown Threat Actors, Unknown Threat Actors Leveraging Gamma","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1068/"},{"id":"INC-03103","date":"2025-01-31","year":2025,"title":"Purported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Aise, External Intelligence And Security Agency (italy), Hamilton Police Service (ontario Canada), Ontario Provincial…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1069/"},{"id":"INC-03207","date":"2025-05-09","year":2025,"title":"Serviceaide AI Platform Implicated in Health Data Exposure Affecting 483,000 Catholic Health Patients","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Serviceaide","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1070/"},{"id":"INC-03234","date":"2025-05-14","year":2025,"title":"Student Reportedly Files Complaint Over Professor's Undisclosed Use of Generative AI at Northeastern University","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Gamma.app, Openai, Perplexity, Rick Arrowood","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1071/"},{"id":"INC-02661","date":"2025-05-14","year":2025,"title":"Grok Chatbot Reportedly Inserted Content About South Africa and 'White Genocide' in Unrelated User Queries","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"X (twitter), Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1072/"},{"id":"INC-02123","date":"2025-04-15","year":2025,"title":"$31,000 Sanction in Lacey v. State Farm Tied to Purportedly Undisclosed Use of LLMs and Erroneous Citations","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ellis George Llp, Kandl Gates Llp, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1073/"},{"id":"INC-02433","date":"2025-05-15","year":2025,"title":"Citation Errors in Concord Music v. Anthropic Attributed to Claude AI Use by Defense Counsel","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1074/"},{"id":"INC-02950","date":"2025-05-19","year":2025,"title":"New Orleans Police Reportedly Used Real-Time Facial Recognition Alerts Supplied by Project NOLA Despite Local Ordinance","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Dahua Technology, Facial Recognition System Developers, New Orleans Police Department, Project Nola","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1075/"},{"id":"INC-03107","date":"2025-05-21","year":2025,"title":"Purported Unauthorized Deepfakes of Norman Swan and Others Circulated in Online Supplement Campaigns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unidentified Actors Linked To Apex…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1076/"},{"id":"INC-08175","date":"2025-05-15","year":2025,"title":"FBI Reports Ongoing Vishing and Smishing Campaign Allegedly Targeting Government Officials Using Purportedly AI-Generated Voices","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1077/"},{"id":"INC-02238","date":"2025-02-27","year":2025,"title":"Purported AI-Generated Images Reportedly Used in Sextortion Scheme Targeting Glasgow, Kentucky Teen Who Later Died by Suicide","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Sextortionists","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1078/"},{"id":"INC-03072","date":"2025-05-17","year":2025,"title":"Purported AI-Manipulated Videos Depict Mauricio Macri Endorsing Manuel Adorni and Silvia Lospennato Withdrawing Before Buenos Aires Vote","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@gordodan, @mileiemperador, @patriciovogel1, Deepfake Technology Developers, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1079/"},{"id":"INC-02958","date":"2025-05-08","year":2025,"title":"Noodlophile Stealer Reportedly Distributed Through Allegedly Fraudulent AI Content Platforms","severity":"High","attack_vector":"malware","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown Actors Distributing Malware As A Service (maas), Unknown Actors Operating Fraudulent Ai Themed Websites,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1080/"},{"id":"INC-02239","date":"2025-05-27","year":2025,"title":"Voice Actor Alleges Unconsented Use of AI-Generated Voice on ScotRail Trains","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Readspeaker, Scotrail","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1081/"},{"id":"INC-03614","date":"2024-04-06","year":2024,"title":"California Homeowner Reportedly Loses Insurance After Purported Aerial Imagery-Based Roof Assessment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Csaa Insurance Group, Unspecified Developer Of Aerial Imagery Risk Analysis System, Vexcel Group","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1082/"},{"id":"INC-03260","date":"2025-05-13","year":2025,"title":"Texas Homeowner Reportedly Spent $3,000 to Contest AI-Flagged Warning of Insurance Nonrenewal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"American Mercury Insurance Group, Cape Analytics, Nationwide, Nearmap, State Farm, Travelers Insurance","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1083/"},{"id":"INC-02574","date":"2025-05-22","year":2025,"title":"Federal 'Make America Healthy Again' Report Released with Multiple Reportedly Erroneous and Unverifiable Citations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, United States Department Of Health And Human Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1084/"},{"id":"INC-03158","date":"2025-04-08","year":2025,"title":"Reported AI-Generated Video Purportedly Depicting Keanu Reeves Debating Elon Musk Circulates as Misinformation on Social Media","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors, Voices Of Change","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1086/"},{"id":"INC-04509","date":"2023-08-20","year":2023,"title":"Campaign Featuring Purported AI-Generated Audio Attributed to Omar al-Bashir Spreads During Sudanese Conflict","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, The Voice Of Sudan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1087/"},{"id":"INC-04812","date":"2023-04-15","year":2023,"title":"Purported AI-Generated Audio Disinformation Reportedly Attributed to U.S. Ambassador John Godfrey Circulates in Sudan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Sudanese Islamist Digital Propaganda Networks, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1088/"},{"id":"INC-04112","date":"2024-10-23","year":2024,"title":"Purported AI-Generated Content Circulates Widely in Sudan Amid Civil Conflict and Information Vacuum","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Various Actors Aligned With Sudanese…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1089/"},{"id":"INC-03154","date":"2025-05-30","year":2025,"title":"Reported AI-Generated Clickbait Targets Adolescents in Rockingham County, North Carolina","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown, Unknown Scam Network Based In South Africa","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1090/"},{"id":"INC-04818","date":"2023-01-23","year":2023,"title":"Purported Synthesia Avatars Used in Alleged Pro-Junta Deepfake Video Supporting Ibrahim Traoré in Burkina Faso","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Pro Ibrahim Traore Information Ecosystem, Synthesia, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1091/"},{"id":"INC-03063","date":"2025-05-23","year":2025,"title":"Purported AI-Generated Video Portrays Pope Leo XIV Addressing Ibrahim Traoré of Burkina Faso","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Pro Traore Information Ecosystem, Synthetic Audio Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1092/"},{"id":"INC-02557","date":"2025-04-26","year":2025,"title":"Fact-Checkers Identify Viral Photo of Burkina Faso's Ibrahim Traoré with 'Wife and Children' as AI-Generated Composite","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Pro Traore Information Ecosystem, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1093/"},{"id":"INC-08176","date":"2025-05-25","year":2025,"title":"Purported AI-Generated Video Depicts Ibrahim Traoré of Burkina Faso Delivering Speech on Western Exploitation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Pro Ibrahim Traore Information Ecosystem, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1096/"},{"id":"INC-02621","date":"2025-06-12","year":2025,"title":"Google AI Overview Reportedly Misstates Aircraft Manufacturer as Airbus Instead of Boeing in Air India Flight 171 Crash","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1097/"},{"id":"INC-02725","date":"2025-01-10","year":2025,"title":"Image Purporting to Show President Paul Kagame of Rwanda in M23 Uniform Reportedly AI-Generated","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Information Manipulation Actors, Information…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1098/"},{"id":"INC-02559","date":"2025-04-25","year":2025,"title":"Factum in Ko v. Li Allegedly Contains AI-Generated Case Law Citations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Jisuh Lee, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1099/"},{"id":"INC-04154","date":"2024-04-10","year":2024,"title":"Reported Audio Deepfake Impersonating CEO Karim Toubba Targets LastPass Employee via WhatsApp","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1100/"},{"id":"INC-02883","date":"2025-04-29","year":2025,"title":"Meta AI App Reportedly Publishes Personal Chats Without Users Fully Realizing","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1101/"},{"id":"INC-03079","date":"2025-04-30","year":2025,"title":"Purported Deepfake Featuring Dr. Rinki Murphy and Jack Tame Reportedly Used to Promote Diabetes Scam in New Zealand","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1102/"},{"id":"INC-03101","date":"2025-03-18","year":2025,"title":"Purported DOGE Contract Review Tool Cited in Reports of AI-Driven Misjudgments in VA Budget Cuts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Department Of Government Efficiency, Doge, Sahil Lavingia","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1103/"},{"id":"INC-02196","date":"2025-05-17","year":2025,"title":"AI Chatbot Allegedly Used to Research Explosive Materials in Palm Springs Fertility Clinic Bombing","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"Daniel Park, Guy Edward Bartkus, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1104/"},{"id":"INC-02893","date":"2025-02-10","year":2025,"title":"Michigan Woman Defrauded in Alleged Tinder Romance Scam Using Purportedly AI-Generated Video Calls","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology, Unknown Scammer \"richard\", Yahoo Boys","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1105/"},{"id":"INC-02389","date":"2025-06-13","year":2025,"title":"Chatbots Allegedly Reinforced Delusional Thinking in Several Reported Users, Leading to Real-World Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1106/"},{"id":"INC-02377","date":"2025-06-13","year":2025,"title":"Bulgarian Tennis Player Grigor Dimitrov Alleges Deepfake Scam Promoting Fraudulent Investment Scheme Using His Likeness","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1107/"},{"id":"INC-01628","date":"2025-06-10","year":2025,"title":"Digital Rights Groups Accuse Meta and Character.AI of Facilitating Unlicensed Therapy via Chatbots","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Character.ai, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1108/"},{"id":"INC-06194","date":"2021-03-01","year":2021,"title":"Year-long AI Surveillance Pilot in Two South Australian Aged Care Facilities Reportedly Overwhelmed Staff with False Positives","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"South Australia Health, Sturdie Trade Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1109/"},{"id":"INC-02266","date":"2025-06-18","year":2025,"title":"Alleged AI-Manipulated Video Uses Macau Chief Executive Sam Hou Fai's Likeness in Investment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1110/"},{"id":"INC-03157","date":"2025-06-19","year":2025,"title":"Reported AI-Generated Video Call Impersonation of Cryptocurrency Analyst Leads to Alleged Malware Installation and Account Theft","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1111/"},{"id":"INC-03196","date":"2025-06-18","year":2025,"title":"Scammer Reportedly Used AI Voice Clone of WCPO Cincinnati Meteorologist in Facebook Fraud Attempts","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1112/"},{"id":"INC-08178","date":"2025-04-15","year":2025,"title":"Alleged Deepfake Investment Scam Uses Economist David Rosenberg's Likeness on Meta Platforms","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1115/"},{"id":"INC-02273","date":"2025-06-20","year":2025,"title":"Alleged Deepfake Video Depicts Former Malaysian Inspector-General of Police Tan Sri Acryl Sani Abdullah in Financial Misconduct Context","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Disinformation Actors Targeting Royal Malaysia Police, Image Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1116/"},{"id":"INC-02960","date":"2025-06-22","year":2025,"title":"North Korea-Linked Actors Allegedly Use AI Executive Deepfakes in Zoom Phishing Targeting Web3 Employee","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Bluenoroff, Deepfake Technology Developers, Government Of North Korea, Lazarus Group, North Korea, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1117/"},{"id":"INC-08177","date":"2021-01-01","year":2021,"title":"Ongoing Purported AI-Assisted Identity Fraud Enables Unauthorized Access to Western Companies by North Korean IT Workers","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM03","LLM06","LLM07","LLM08","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI06","ASI07","ASI09","ASI10"],"cve_ids":[],"affected":"Cho Chung Pom, Choe Jong Yong, Christina Chapman, Contagious Interview, Deepfake Technology Developers, Department 53,…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1118/"},{"id":"INC-02275","date":"2025-06-28","year":2025,"title":"Alleged Deepfake Videos Impersonate Lithuanian Politicians and Doctors in Purported Cross-Border Scam Network","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown International Scam…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1119/"},{"id":"INC-02265","date":"2025-06-16","year":2025,"title":"Alleged AI-Generated Videos Depict Bangladesh's Chief Adviser Muhammad Yunus Endorsing Betting Platforms","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1120/"},{"id":"INC-02258","date":"2025-06-29","year":2025,"title":"Alleged AI Deepfake Videos Used to Lure Simcoe County, Ontario Residents in Crypto Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers Targeting…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1121/"},{"id":"INC-03176","date":"2025-06-28","year":2025,"title":"Reportedly Sustained Multi-Celebrity Deepfake Persona Scam Targeting Vulnerable Southampton Resident","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1122/"},{"id":"INC-03168","date":"2025-06-26","year":2025,"title":"Reported Student Misuse of ChatGPT, StudyX, and Gemini to Obtain Answers During Vietnam's 2025 National High School Graduation Exam","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Openai, Studyx, Unnamed Students In Vietnam Accused Of Cheating","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1123/"},{"id":"INC-02288","date":"2025-06-30","year":2025,"title":"Alleged Unauthorized Deepfake AI Clones of Ravish Kumar Used to Spread Purportedly Fabricated News on YouTube","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Youtubers Impersonating…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1124/"},{"id":"INC-03169","date":"2025-06-12","year":2025,"title":"Reported Use and Circulation of AI-Generated Misinformation and Fake Victim Visuals After Air India 171 Crash","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unknown Social Media Actors Exploiting The Air India Flight 171 Disaster","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1125/"},{"id":"INC-03171","date":"2025-05-16","year":2025,"title":"Reported Use of Deepfake Video Impersonating Owen Wilson in Romance Scam with Fake Job Payments","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1126/"},{"id":"INC-03052","date":"2025-06-27","year":2025,"title":"Purported AI-Generated Audio Clip Allegedly Portrays Cambodian Senate President Hun Sen Raising Money for Conflict with Thailand","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unnamed Thai National","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1127/"},{"id":"INC-03022","date":"2025-06-15","year":2025,"title":"Philippine Officials Reportedly Share Veo 3-Generated Video to Support Vice President Sara Duterte During Impeachment","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Ronald Dela Rosa, Sebastian Duterte","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1128/"},{"id":"INC-04114","date":"2024-07-21","year":2024,"title":"Purported AI-Generated Video Depicting Philippine President Ferdinand Marcos Jr. Using Drugs Shared by Rodrigo Duterte Supporters and Amplified by China-Linked Spamouflage","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Claire Contreras, Deepfake Technology Developers, Government Of China, Rodrigo Duterte Supporters, Spamouflage","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1129/"},{"id":"INC-02530","date":"2025-03-13","year":2025,"title":"Docomo Pacific CEO Reports Mother Targeted by Purported AI-Enabled Scam in Guam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer Targeting…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1130/"},{"id":"INC-02268","date":"2025-04-21","year":2025,"title":"Alleged Deepfake Identity Scam Uses Miami Beach Realtor's Likeness to Defraud Victim in the United Kingdom in Purported Romance Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1131/"},{"id":"INC-02508","date":"2025-07-02","year":2025,"title":"Delhi Man Reportedly Arrested for Sharing Purportedly AI-Morphed Obscene Images of Ex-Girlfriend","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Unnamed 21 Year Old Male Suspect From Delhi","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1132/"},{"id":"INC-03153","date":"2025-06-30","year":2025,"title":"Reported AI-Generated Audio of Ukrainian Commander Andriy Biletsky Used in Russian Disinformation Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Government Of Russia Aligned Actors, Information Manipulation Actors, Pro Russian…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1133/"},{"id":"INC-03163","date":"2025-06-30","year":2025,"title":"Reported Deepfakes of Ukrainian Deputy PM Olha Stefanishyna Allegedly Supporting Fictional Mobilization Plan for Women","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Government Of Russia Aligned Actors, Information Manipulation Actors, Pro Russian…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1134/"},{"id":"INC-03042","date":"2025-07-01","year":2025,"title":"Preprints Reportedly from Researchers from Multiple Universities Allegedly Contain Covert AI Prompts","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Large Language Model Developers, Unnamed Conference Paper Reviewers, Unnamed Peer Reviewers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1135/"},{"id":"INC-03108","date":"2025-07-04","year":2025,"title":"Purported Widespread Use of AI-Generated Deepfake Videos Impersonate Malaysian Leaders in Investment Scams","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers Targeting…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1136/"},{"id":"INC-08182","date":"2024-09-20","year":2024,"title":"Reported False Legal Citations in South African Case Mavundla v. MEC Generated by Purported AI Tool","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Large Language Model Developers, Surendra Singh And Associates","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1137/"},{"id":"INC-04876","date":"2023-03-01","year":2023,"title":"South African Legal Team Reportedly Relied on Unverified ChatGPT Case Law in Johannesburg Body Corporate Defamation Matter","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chantal Rodrigues, Jurie Hayes, Openai, Rodrigues Blignaut Attorneys","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1138/"},{"id":"INC-03089","date":"2025-06-18","year":2025,"title":"Purported Deepfake of Sri Lankan President Anura Kumara Dissanayake Promotes Alleged Fraudulent Government Investment Scheme","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1140/"},{"id":"INC-02420","date":"2025-07-07","year":2025,"title":"Chicago Veteran Reportedly Loses $10,000 in Purported Deepfake Cryptocurrency Fraud Posing as Elon Musk","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1142/"},{"id":"INC-08179","date":"2025-01-22","year":2025,"title":"Former Namibian First Lady Monica Geingos's Likeness Reportedly Used in Purported AI-Generated Video Investment Scams","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1143/"},{"id":"INC-03508","date":"2024-06-05","year":2024,"title":"xAI Allegedly Operates Unpermitted Methane Turbines in Memphis to Power Supercomputer Colossus to Train Grok","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1144/"},{"id":"INC-02929","date":"2025-02-25","year":2025,"title":"MyPillow Defense Lawyers in Coomer v. Lindell Reportedly Sanctioned for Filing Court Document Allegedly Containing AI-Generated Legal Citations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Christopher I. Kachouroff, Jennifer T. Demaster, Large Language Model Developers, Mcsweeny Synkar And Kachouroff Pllc","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1145/"},{"id":"INC-02662","date":"2025-07-08","year":2025,"title":"Grok Chatbot Reportedly Posts Antisemitic Statements Praising Hitler on X","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grok, Xai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1146/"},{"id":"INC-03134","date":"2025-07-14","year":2025,"title":"Purportedly AI-Generated Videos Impersonate Brunei Police in 'Real Money Magic' Scam on Social Media","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers Targeting…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1147/"},{"id":"INC-03091","date":"2025-07-11","year":2025,"title":"Purported Deepfake Scam Videos Depict JG Summit Holdings President and CEO Lance Gokongwei Allegedly Endorsing Illicit Investments","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1148/"},{"id":"INC-02409","date":"2025-07-22","year":2025,"title":"ChatGPT Reportedly Generated Ritual Scripts Containing Instructions for Self-Harm and Symbolic Violence in Response to Thematic Prompts","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1149/"},{"id":"INC-03087","date":"2025-07-20","year":2025,"title":"Purported Deepfake of Barack Obama's Detention Reportedly Amplified by Donald Trump via Truth Social","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Donald Trump, Unknown Tiktok User","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1150/"},{"id":"INC-02412","date":"2025-05-26","year":2025,"title":"ChatGPT Reportedly Validated Autistic User's Faster-Than-Light Theory and Failed to Provide Grounding During Delusional Episode, Preceding Hospitalization","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1151/"},{"id":"INC-02840","date":"2025-07-18","year":2025,"title":"LLM-Driven Replit Agent Reportedly Executed Unauthorized Destructive Commands During Code Freeze, Leading to Loss of Production Data","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Replit","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1152/"},{"id":"INC-03097","date":"2025-07-07","year":2025,"title":"Purported Deepfake Video of Donald Trump at NATO Summit Allegedly Used in YouTube Crypto Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1153/"},{"id":"INC-03159","date":"2025-04-01","year":2025,"title":"Reported AI‑Generated Deepfake Impersonations of Public Figures Allegedly Used in Coordinated Stock Pump‑and‑Dump Scheme Targeting Israeli Investors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scam Network…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1154/"},{"id":"INC-02240","date":"2025-07-01","year":2025,"title":"Purported AI‑Edited Police Evidence Image Posted to Facebook by Westbrook Police Department in Maine","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Unknown Ai Image Editing Software Developer, Westbrook Police Department","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1155/"},{"id":"INC-03095","date":"2025-04-22","year":2025,"title":"Purported Deepfake Video Circulated Among Students Targets Orrington, Maine Educator","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Perpetrator(s) Of Deepfake Harassment Targeting Aos 47 Teacher","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1156/"},{"id":"INC-02634","date":"2025-07-14","year":2025,"title":"Google Gemini Reportedly Generates Sexual Role‑Play for Account Registered as Minor","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Google Gemini","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1157/"},{"id":"INC-02285","date":"2025-07-17","year":2025,"title":"Alleged Malicious Wiping Command Found in Amazon Q AI Assistant","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Amazon, Amazon Web Services, Aws","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1158/"},{"id":"INC-02643","date":"2025-05-10","year":2025,"title":"Government‑Backed AI4Peat Mapping Tool Allegedly Misidentifies Granite Outcrops and Quarries as Peat","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Defra, Department For Environment Food And Rural Affairs, Government Of The United Kingdom, Microsoft, Natural England","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1159/"},{"id":"INC-02241","date":"2025-06-05","year":2025,"title":"Reported AI-Aided Development of Explosive Devices by Long Island Resident Michael Gann","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"Generative Ai Developers, Michael Gann","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1160/"},{"id":"INC-02242","date":"2025-08-02","year":2025,"title":"Airbnb Host Reportedly Accused of Using Purportedly AI‑Altered Photos in False Damage Claim","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Unnamed Airbnb Host","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1161/"},{"id":"INC-03076","date":"2025-04-07","year":2025,"title":"Purported Deepfake Depicts Altercation Between Bougainville President Ishmael Toroama and Papua New Guinea Prime Minister James Marape","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actor(s) Provoking Tensions…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1162/"},{"id":"INC-04124","date":"2024-10-15","year":2024,"title":"Purported Face‑Swap Technology Reportedly Used to Circumvent Financial Platform's Facial Recognition Security in Nanjing, China","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Fu Mou, Unknown Face Swap Technology Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1163/"},{"id":"INC-03824","date":"2024-05-06","year":2024,"title":"Google Healthcare AI Model Med‑Gemini Allegedly Produces Non‑Existent 'Basilar Ganglia' Term in Published Output","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1164/"},{"id":"INC-02668","date":"2025-08-05","year":2025,"title":"Grok Imagine Reportedly Produces Nonconsensual Taylor Swift Deepfake Nudes Without Explicit Prompting","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1165/"},{"id":"INC-02411","date":"2025-08-05","year":2025,"title":"ChatGPT Reportedly Suggests Sodium Bromide as Chloride Substitute, Leading to Bromism and Hospitalization","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1166/"},{"id":"INC-04431","date":"2023-08-15","year":2023,"title":"Alleged Gaggle Surveillance Alert Reportedly Leads to Arrest and Detention of 13-Year-Old Student in Fairview, Tennessee","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Fairview Middle School Tennessee, Gaggle, Williamson County Schools","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1167/"},{"id":"INC-03127","date":"2025-08-04","year":2025,"title":"Purportedly AI-Generated Image of British Army Colonels Captured in Ukraine Reportedly Circulates in Russian Media","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eadaily, Image Generation Technology Developers, Information Manipulation Actors, Misinformation Spreaders, Russian…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1168/"},{"id":"INC-06871","date":"2020-06-30","year":2020,"title":"Reported AI-Assisted Influence Campaigns by GoLaxy Allegedly Targeting Hong Kong and Taiwan Political Discourse","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Golaxy","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1169/"},{"id":"INC-02429","date":"2025-08-06","year":2025,"title":"Chris Cuomo Amplifies Reportedly Labeled Deepfake Video of Alexandria Ocasio-Cortez, Purportedly Contributing to Misleading Political Narrative","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chris Cuomo, Deepfake Technology Developers, Openai, Unknown Creator Of Alexandria Ocasio Cortez Parody Deepfake","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1170/"},{"id":"INC-03166","date":"2025-07-25","year":2025,"title":"Reported Hack of Tea Dating App Compromises Data from Purportedly AI-Supported Identity and Image Checks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Tea Dating Advice","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1171/"},{"id":"INC-03977","date":"2024-12-26","year":2024,"title":"Meta AI Bug in Deployed Service Reportedly Allowed Potential Access to Other Users' Prompts and Responses","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1172/"},{"id":"INC-02633","date":"2025-06-23","year":2025,"title":"Google Gemini Reportedly Exhibits Repetitive Self-Deprecating Responses Attributed to Bug","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1173/"},{"id":"INC-02898","date":"2025-02-26","year":2025,"title":"Microsoft Copilot Reportedly Able to Access Cached Data from Since-Private GitHub Repositories","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1174/"},{"id":"INC-02286","date":"2025-08-09","year":2025,"title":"Alleged Marine Park Orca Attack on 'Jessica Radcliffe' Reportedly an AI-Generated Hoax","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1175/"},{"id":"INC-02903","date":"2025-08-01","year":2025,"title":"Microsoft's Windows Recall Allegedly Stores Passwords and Social Security Numbers in Preview Mode","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1176/"},{"id":"INC-02243","date":"2025-08-14","year":2025,"title":"Purported AI Monitoring Software Reportedly Flags Unsent Joke Threat, Leading to Arizona Student Suspension","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Marana High School, Marana Unified School District, Unknown Ai Monitoring Software Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1177/"},{"id":"INC-02632","date":"2025-07-21","year":2025,"title":"Google Gemini CLI Reportedly Deletes User Files After Misinterpreting Command Sequence","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1178/"},{"id":"INC-02868","date":"2025-06-30","year":2025,"title":"McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"Mcdonald's, Paradox.ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1179/"},{"id":"INC-03104","date":"2025-03-25","year":2025,"title":"Purported Meta AI Chatbot Persona 'Big sis Billie' Reportedly Engages in Romantic Roleplay and Provides Address, Linked to User's Fatal Fall","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1180/"},{"id":"INC-03064","date":"2025-06-28","year":2025,"title":"Purported AI-Generated Video Reportedly Depicts Illegal Tiger Sales in Bagerhat, Bangladesh","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Unknown Social Media Accounts","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1181/"},{"id":"INC-03132","date":"2025-07-30","year":2025,"title":"Purportedly AI-Generated Video of Tigers at Barasat Madrasa in West Bengal Reportedly Causes Panic and Student Absenteeism","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Mohammad Yamin Mallik","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1182/"},{"id":"INC-03509","date":"2024-04-16","year":2024,"title":"Purported Error by Grok Reportedly Misrepresents Basketball Slang as Criminal Allegation Against NBA Player","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1183/"},{"id":"INC-02244","date":"2025-08-13","year":2025,"title":"Purported Fictitious AI-Generated Citations in Supreme Court of Victoria Murder Case Filing Lead to Delay and King's Counsel Apology","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Rishi Nathwani","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1184/"},{"id":"INC-03224","date":"2025-08-19","year":2025,"title":"South Korean Actor Kim Seon-ho's Likeness Allegedly Misused in Purported Deepfake Impersonation Attempts Demanding Money","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1185/"},{"id":"INC-03167","date":"2025-07-31","year":2025,"title":"Reported Public Exposure of Over 100,000 LLM Conversations via Share Links Indexed by Search Engines and Archived","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM08"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Alibaba, Anthropic, Microsoft, Mistral, Openai, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1186/"},{"id":"INC-02622","date":"2025-08-15","year":2025,"title":"Google AI Overviews and ChatGPT Reportedly Cited Fraudulent Cruise Hotline, Allegedly Enabling Successful Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Openai, Scammers, Unknown Scammers Impersonating Disney Cruise Line, Unknown Scammers Impersonating Princess…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1187/"},{"id":"INC-02927","date":"2025-06-25","year":2025,"title":"Multiple LLMs Reportedly Generated Responses Aligning with Purported CCP Censorship and Propaganda","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Deepseek, Google, Microsoft, Openai, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1188/"},{"id":"INC-02785","date":"2025-08-20","year":2025,"title":"Joann Fabrics Shoppers Reportedly Defrauded by AI-Generated Scam Sites, Part of Purported Wave of ~100,000 Fake Domains Across 194 Brands","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Generative Ai Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1189/"},{"id":"INC-02563","date":"2025-08-18","year":2025,"title":"Family Reportedly Discovers ChatGPT Logs Detailing Suicidal Ideation Prior to Daughter's Death","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1190/"},{"id":"INC-02975","date":"2025-04-21","year":2025,"title":"NYPD Facial Recognition System Allegedly Produced Erroneous Match That Reportedly Resulted in Wrongful Detention of Trevis Williams","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Facial Recognition System Developers, New York Police Department, Nypd","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1191/"},{"id":"INC-02125","date":"2025-04-11","year":2025,"title":"16-Year-Old Allegedly Received Suicide Method Guidance from ChatGPT Before Death","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM03","LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1192/"},{"id":"INC-03137","date":"2025-08-22","year":2025,"title":"Purportedly Taxpayer-Funded Deloitte Report for Australian Government Contains Alleged AI-Generated Citations and Fabricated Legal Quote","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deloitte, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1193/"},{"id":"INC-03931","date":"2024-10-01","year":2024,"title":"L.A. Woman Reportedly Defrauded of $81,000 and $350,000 Condo Proceeds in Romance Scam Using Purported Deepfake Videos of Actor Steve Burton","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1194/"},{"id":"INC-02952","date":"2025-09-01","year":2025,"title":"Nigeria-Based YouTube Network Allegedly Uses AI Voiceovers and Anchors to Amplify Pro-Kremlin Narratives","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"@conflictcompas Youtube Channel, @daddymaxwell77 Youtube Channel, @freshinfoinsight Youtube Channel, @gloryincombat…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1195/"},{"id":"INC-02787","date":"2025-05-07","year":2025,"title":"Judge Reportedly Disqualifies Butler Snow Lawyers Following Purported Use of ChatGPT-Fabricated Citations in Alabama Prison Litigation","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Butler Snow, Matthew B. Reeves, Openai, William Cranford, William Lunsford","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1196/"},{"id":"INC-02264","date":"2025-04-26","year":2025,"title":"Alleged AI-Generated Photo of Burning Truck in Manila Reportedly Triggered Firefighter Response","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Unknown Actor","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1197/"},{"id":"INC-02655","date":"2025-07-08","year":2025,"title":"Grok 3 Reportedly Generated Graphic Threats and Hate Speech Targeting Minnesota Attorney Will Stancil","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1198/"},{"id":"INC-03120","date":"2025-01-28","year":2025,"title":"Purportedly AI-Generated Deepfake Image Reportedly Falsely Links Canadian Prime Minister Mark Carney to Jeffrey Epstein","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Social Media Accounts, Unknown Actor","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1199/"},{"id":"INC-02886","date":"2025-08-28","year":2025,"title":"Meta AI on Instagram Reportedly Facilitated Suicide and Eating Disorder Roleplay with Teen Accounts","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatbot Users, Large Language Model Developers, Meta","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1200/"},{"id":"INC-03192","date":"2025-09-07","year":2025,"title":"Russian Disinformation Campaign Reportedly Used AI-Generated Posts and Videos to Target 2025 Moldovan Parliamentary Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Influence Operation Groups, Information Manipulation Actors, Large Language Model…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1202/"},{"id":"INC-02385","date":"2025-08-21","year":2025,"title":"Carter County, Montana Man Reportedly Charged for Creating AI-Generated Child Sexual Abuse Material","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Shy Herbert Mccutchan","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1203/"},{"id":"INC-02395","date":"2025-08-05","year":2025,"title":"ChatGPT Allegedly Reinforced Delusions Before Greenwich, Connecticut Murder-Suicide","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"Erik Stein Soelberg, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1204/"},{"id":"INC-02925","date":"2025-09-11","year":2025,"title":"Multiple Generative AI Systems Reportedly Amplify False Information During Charlie Kirk Assassination Coverage","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Perplexity, Pro Kremlin Actors, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1205/"},{"id":"INC-03056","date":"2025-02-25","year":2025,"title":"Purported AI-Generated Deepfake of Spiritual Leader Sadhguru Used in Investment Scam Allegedly Defrauding Bengaluru Woman of ₹3.75 Crore (~$425,000)","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Michael C (scammer Impersonating Sadhguru), Mirrox, Scammers Impersonating Sadhguru,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1206/"},{"id":"INC-03055","date":"2025-09-11","year":2025,"title":"Purported AI-Generated Deepfake of Irish Fine Gael Presidential Candidate Heather Humphreys Used in Fake Investment Videos on Meta Platforms","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Quantum Ai, Quantum Ai Scammers, Scammers, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1207/"},{"id":"INC-02959","date":"2025-07-17","year":2025,"title":"North Korea's Kimsuky Group Reportedly Uses AI-Generated Military ID Deepfakes in Phishing Campaign","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Apt43, Black Banshee, Emerald Sleet, Government Of North Korea, Group 0094, Kimsuky Group, Openai, Reconnaissance…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1208/"},{"id":"INC-02850","date":"2025-08-21","year":2025,"title":"Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"Amazon, Anthropic, Google, Malicious Actors Compromising Nx's Cicd Pipeline And Publishing Tainted Npm Packages","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1210/"},{"id":"INC-02624","date":"2025-08-19","year":2025,"title":"Google AI Overviews Reportedly Misrepresented Pizza Specials at Stefanina's in Wentzville, Missouri","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1211/"},{"id":"INC-02956","date":"2025-09-20","year":2025,"title":"Nomi AI Companion Allegedly Directs Australian User to Stab Father and Engages in Harmful Role-Play","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Nomi Ai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1212/"},{"id":"INC-02597","date":"2025-08-01","year":2025,"title":"Gaggle AI Monitoring at Lawrence, Kansas High School Reportedly Misflags Student Content and Blocks Emails","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Gaggle, Lawrence Public Schools (usd 497)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1213/"},{"id":"INC-02534","date":"2025-09-29","year":2025,"title":"Donald Trump Reportedly Posts Purported AI-Modified Video of Chuck Schumer and Hakeem Jeffries During U.S. Government Shutdown Talks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Donald Trump, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1214/"},{"id":"INC-02598","date":"2025-09-12","year":2025,"title":"Gaggle Alert Reportedly Leads to Arrest of 15-Year-Old in Volusia County, Florida, for School Threat the Student Claimed Was Not Serious","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Gaggle, Volusia County Schools, Volusia County Sheriff's Office","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1215/"},{"id":"INC-02410","date":"2025-07-07","year":2025,"title":"ChatGPT Reportedly Misleads Users About Soundslice Features, Allegedly Prompting Unplanned Product Development","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1216/"},{"id":"INC-03112","date":"2025-07-09","year":2025,"title":"Purportedly AI-Cloned Voice of Daughter Used in Elaborate Bond Scam Targeting Retired Couple in Hillsborough County, Florida","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1217/"},{"id":"INC-02895","date":"2025-07-04","year":2025,"title":"Microsoft 365 Copilot Vulnerability Allegedly Allowed File Access Without Audit Log Entry","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Microsoft","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1218/"},{"id":"INC-02889","date":"2025-07-02","year":2025,"title":"Meta Platforms Users Report Being Wrongfully Locked Out After Purported AI Moderation Flags Accounts for Child Exploitation Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1219/"},{"id":"INC-02797","date":"2025-07-10","year":2025,"title":"LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI10"],"cve_ids":[],"affected":"Alibaba, Apt28, Fancy Bear, Hugging Face","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1220/"},{"id":"INC-02260","date":"2025-06-23","year":2025,"title":"Alleged AI-Enabled PRISONBREAK Influence Operation on X Reportedly Synchronizes Deepfake of Evin Prison Strike with Ongoing Attacks in Tehran","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Prisonbreak Network Operators, Unidentified Israeli…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1221/"},{"id":"INC-05065","date":"2022-08-10","year":2022,"title":"CFPB Reportedly Finds Hello Digit's Automated Savings Algorithm Caused Overdrafts and Orders Redress with $2.7M Penalty","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Hello Digit, Oportun Financial Corporation","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1222/"},{"id":"INC-03118","date":"2025-10-01","year":2025,"title":"Purportedly AI-Generated Deepfake Ads on Facebook Reportedly Impersonate Trump, Musk, Ocasio-Cortez, Warren, Sanders, and Leavitt to Promote Fraudulent Rebates","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"American Relief Programs (scam Network), Asking America (advertiser), Deepfake Technology Developers, End The Wokeness…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1223/"},{"id":"INC-03119","date":"2025-10-01","year":2025,"title":"Purportedly AI-Generated Deepfake Ads on Instagram Impersonate Gisele Bündchen and Other Celebrities in Brazilian Fraud Scheme","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Meta, Money Launderers, Scammers, Scammers In Brazil, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1224/"},{"id":"INC-03115","date":"2025-10-03","year":2025,"title":"Purportedly AI-Generated 'Home Invasion Prank' Images Reportedly Circulate in Ireland, Causing Panic and False Emergency Calls","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Unknown Pranksters, Unknown Pranksters In Ireland","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1225/"},{"id":"INC-02978","date":"2025-10-03","year":2025,"title":"Old Mutual Reportedly Warns of Purported Deepfake Videos Impersonating Chairman Trevor Manuel in Investment Scams","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1226/"},{"id":"INC-02951","date":"2025-08-19","year":2025,"title":"New Zealand Financial Markets Authority (FMA), Te Mana Tātai Hokohoko, Reportedly Flags Purported Deepfake Pump-and-Dump Network Using Social Media Ads","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1227/"},{"id":"INC-02267","date":"2025-03-12","year":2025,"title":"Alleged ChatGPT Misuse by Contractor Leads to Reported Data Exposure in New South Wales Resilient Homes Program","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1228/"},{"id":"INC-02615","date":"2025-09-26","year":2025,"title":"Gold Coast Man Reportedly Ordered to Pay $343,500 After Posting Purported Deepfake Pornographic Images of Australian Public Figures","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthony Rotondo, Deepfake Technology Developers, Mrdeepfakes.com","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1229/"},{"id":"INC-04253","date":"2024-07-11","year":2024,"title":"Suspect in Palisades Fire Allegedly Consulted ChatGPT for Arson Tips and Legal Advice Before Blaze That Killed 12 and Destroyed 6,837 Structures","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Jonathan Rinderknecht, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1230/"},{"id":"INC-03058","date":"2025-10-17","year":2025,"title":"Purported AI-Generated Deepfake Video Reportedly Depicts Senator Chuck Schumer Endorsing Government Shutdown in NRSC Campaign Ad","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, National Republican Senatorial Committee (nrsc), Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1231/"},{"id":"INC-03174","date":"2025-10-12","year":2025,"title":"Reportedly Fatal Xiaomi SU7 Ultra Crash in Chengdu Purportedly Involves Automated Driving Failure and Door Lock Malfunction","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Xiaomi Corporation","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1232/"},{"id":"INC-03092","date":"2025-10-18","year":2025,"title":"Purported Deepfake Video Allegedly Shows Conservative MP George Freeman Leaving Party for Reform UK","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Actor Impersonating George…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1233/"},{"id":"INC-03060","date":"2025-10-15","year":2025,"title":"Purported AI-Generated Explicit Deepfakes of Sydney High School Students Reportedly Circulated Online","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Unknown Actor(s) Creating Deepfake Nudes Of Sydney High School…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1234/"},{"id":"INC-02428","date":"2025-07-01","year":2025,"title":"Chinese-Backed Operation Reportedly Used AI-Generated Deepfake Videos of Indian Stock Experts in Investment Fraud Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, First Bridge, Synthetic Audio Generation Technology Developers, Valueleaf","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1235/"},{"id":"INC-06866","date":"2020-01-01","year":2020,"title":"Quantum AI and Related AI-Themed Investment Scams Reportedly Used Deepfake Endorsements and Spoofed Media Sites to Solicit Investments","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Faikast, Generative Ai Developers, Investment Scam Operators, Quantum Ai, Quantum Ai…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1236/"},{"id":"INC-02274","date":"2025-08-04","year":2025,"title":"Alleged Deepfake Video of Anthony Albanese Promotes Fake AUFIRST 'Tax Dividend' Trading Platform","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Aufirst Platform…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1237/"},{"id":"INC-02996","date":"2025-10-10","year":2025,"title":"OpenAI ChatGPT Models Reportedly Jailbroken to Provide Chemical, Biological, and Nuclear Weapons Instructions","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI10"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1238/"},{"id":"INC-03057","date":"2025-04-23","year":2025,"title":"Purported AI-Generated Deepfake of Steven Bartlett Reportedly Used to Promote Fake WhatsApp Investment Group","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1239/"},{"id":"INC-03054","date":"2025-06-27","year":2025,"title":"Purported AI-Generated Deepfake of Infosys Co-Founder N. R. Narayana Murthy Used in Investment Scam Allegedly Defrauding 79-Year-Old Bengaluru Woman of ₹35 Lakh (~$40,000)","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology, Scammers, Synthetic Audio Generation Technology, Unknown Scammers Impersonating N. R. Narayana…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1240/"},{"id":"INC-03066","date":"2025-10-17","year":2025,"title":"Purported AI-Generated Video Reportedly Used in RM5,800 (~$1,400) Sextortion Attempt Targeting Malaysian Minor via Telegram","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Unknown Criminal Actors Operating On Telegram, Unknown Sextortionists","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1241/"},{"id":"INC-03059","date":"2025-06-09","year":2025,"title":"Purported AI-Generated Deepfake Videos Reportedly Used in Swedish Scam Campaign Impersonating Doctors Agnes Wold and Anders Tegnell","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1242/"},{"id":"INC-02350","date":"2025-10-20","year":2025,"title":"AWS Outage Reportedly Caused AI-Enabled Eight Sleep Smart Beds to Overheat and Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Eight Sleep","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1243/"},{"id":"INC-03116","date":"2025-10-19","year":2025,"title":"Purportedly AI-Generated 'King Trump' Fighter Jet Video Allegedly Posted by President Depicts Defecation Attack on 'No Kings' Protesters","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Donald Trump, Pro Trump Social Media Accounts","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1244/"},{"id":"INC-04046","date":"2024-08-02","year":2024,"title":"Norwegian Student Reportedly Used AI-Generated Deepfake Videos in Spanish Coursework at University of South-Eastern Norway","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unnamed…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1245/"},{"id":"INC-03122","date":"2025-01-21","year":2025,"title":"Purportedly AI-Generated Deepfake Reportedly Used to Impersonate DNB Bank CFO and CEO in Live Teams Meeting","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1246/"},{"id":"INC-02887","date":"2025-04-28","year":2025,"title":"Meta AI Reportedly Generated Purportedly False Claims Linking Activist Robby Starbuck to January 6th Riot, Prompting Defamation Lawsuit","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1247/"},{"id":"INC-02640","date":"2025-10-22","year":2025,"title":"Google's Bard, Gemini, and Gemma AI Systems Allegedly Generated Defamatory Claims About Activist Robby Starbuck, Prompting Lawsuit","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1248/"},{"id":"INC-03332","date":"2025-10-21","year":2025,"title":"Virginia Candidate John Reid Reportedly Used AI-Generated Deepfake of Opponent Ghazala Hashmi in Simulated Political Debate","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, John Reid, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1249/"},{"id":"INC-02278","date":"2025-10-20","year":2025,"title":"Alleged False Positive by Omnilert AI Gun Detection System Prompts Police Search at Baltimore County High School","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baltimore County Public Schools, Omnilert","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1250/"},{"id":"INC-03126","date":"2025-10-15","year":2025,"title":"Purportedly AI-Generated Hunting Regulation Errors Reportedly Lead to Idaho Citation and Multi-State Warnings from Wildlife Agencies","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1251/"},{"id":"INC-02788","date":"2025-06-30","year":2025,"title":"Judges in New Jersey and Mississippi Admit AI Tools Produced Erroneous Federal Court Filings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Henry Wingate, Julien Neals, Openai, Perplexity Ai, United States District Court For The District Of New Jersey,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1252/"},{"id":"INC-02817","date":"2025-10-27","year":2025,"title":"Large-Scale Mental Health Crises Allegedly Associated with ChatGPT Interactions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1253/"},{"id":"INC-03051","date":"2025-06-24","year":2025,"title":"Purported AI Deepfake Reportedly Impersonated Thai PBS World Anchor and Miss Universe CEO in Fraudulent Investment Video","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1254/"},{"id":"INC-03090","date":"2025-08-28","year":2025,"title":"Purported Deepfake Reportedly Circulated on Facebook Impersonating Thai PBS World Anchors and Business Figures to Solicit Investments","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Crystallum Ai, Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1255/"},{"id":"INC-03121","date":"2025-10-24","year":2025,"title":"Purportedly AI-Generated Deepfake Investment Ads Defrauded 5,000 Swedish Investors of 500 Million SEK","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Pump And Dump…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1256/"},{"id":"INC-02336","date":"2025-06-04","year":2025,"title":"Argentine Court Reportedly Annuls Criminal Conviction After Judge Allegedly Used ChatGPT to Draft Ruling Without Disclosure","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Carlos Rogelio Richeri, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1257/"},{"id":"INC-03086","date":"2025-10-22","year":2025,"title":"Purported Deepfake Mimicking RTÉ Broadcast Falsely Announced Irish Presidential Candidate Catherine Connolly's Withdrawal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Malicious Actors, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1258/"},{"id":"INC-02394","date":"2025-07-25","year":2025,"title":"ChatGPT Allegedly Encouraged 23-Year-Old Texas User's Suicide During Extended Conversations","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai, Zane Shamblin","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1259/"},{"id":"INC-04121","date":"2024-01-27","year":2024,"title":"Purported Deepfake of Andrew Forrest Used to Promote Fraudulent 'Quantum AI' Crypto Platform on Facebook","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Quantum Ai, Scammers, Synthetic Audio Generation Technology Developers, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1260/"},{"id":"INC-02262","date":"2025-11-08","year":2025,"title":"Alleged AI-Generated Deepfake of Western Australia Premier Roger Cook Used in YouTube Investment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1261/"},{"id":"INC-03384","date":"2025-09-29","year":2025,"title":"YouTube Channel Reportedly Posts Purported Deepfake Video of Rajat Sharma Announcing India-Bangladesh Conflict","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, The Real Report, Unknown Malicious…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1262/"},{"id":"INC-02426","date":"2025-11-13","year":2025,"title":"Chinese State-Linked Operator (GTG-1002) Reportedly Uses Claude Code for Autonomous Cyber Espionage","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM02","LLM03","LLM06","LLM07","LLM08"],"owasp_asi":["ASI01","ASI02","ASI03","ASI06","ASI07","ASI09","ASI10"],"cve_ids":[],"affected":"Anthropic, Gtg 1002, State Linked Operator Using Autonomous Ai Enabled Intrusion Workflows, Unknown Chinese State…","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1263/"},{"id":"INC-03151","date":"2025-11-10","year":2025,"title":"Rep. Mike Collins's Campaign Allegedly Produced Deepfake of Sen. Jon Ossoff Supporting the Government Shutdown","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Mike Collins, Mike Collins's Campaign, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1264/"},{"id":"INC-02966","date":"2025-10-28","year":2025,"title":"NTB Report on Telenor Security Findings Was Withdrawn After AI Tool Allegedly Introduced Fabricated Quotes","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Large Language Model Developers, Ntb","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1265/"},{"id":"INC-03129","date":"2025-11-10","year":2025,"title":"Purportedly AI-Generated Sexual Images of At Least 400 Minors at Zacatecas School Were Reportedly Created and Sold Online","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unnamed Student(s) From Zacatecas","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1266/"},{"id":"INC-02982","date":"2025-11-07","year":2025,"title":"Omnilert AI Reportedly Triggered False Gun Alert at Parkville High, Prompting Student Relocation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Baltimore County Public Schools, Omnilert, Parkville High School","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1267/"},{"id":"INC-02892","date":"2025-11-06","year":2025,"title":"Meta's Automated Ad and Targeting Systems Reportedly Enabled Large-Scale Fraud Revenue","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Meta, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1268/"},{"id":"INC-03356","date":"2025-10-27","year":2025,"title":"Waymo Autonomous Vehicle Reportedly Ran Over and Killed a Cat in San Francisco","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1269/"},{"id":"INC-02928","date":"2025-10-15","year":2025,"title":"Multiple Purported AI-Assisted Cheating Incidents Reported Across South Korea's SKY Universities During October 2025 Midterms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Openai, Students At Korea University, Students At Seoul National University, Students At…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1270/"},{"id":"INC-03088","date":"2025-11-14","year":2025,"title":"Purported Deepfake of Greek Finance Minister Kyriakos Pierrakakis Reportedly Used in Facebook Investment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1271/"},{"id":"INC-03125","date":"2025-10-05","year":2025,"title":"Purportedly AI-Generated Home Intruder Videos Allegedly Prompt Dozens of Dutch Police Call-Outs","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Pranksters, Unknown Pranksters In The Netherlands","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1272/"},{"id":"INC-03124","date":"2025-10-26","year":2025,"title":"Purportedly AI-Generated Fake Videos of Louvre Heist Reportedly Circulated Widely Online","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai, Unknown Social Media Account Operators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1273/"},{"id":"INC-02235","date":"2025-08-29","year":2025,"title":"AI-Powered Taco Bell Drive-Thru Reportedly Disrupted by Viral Prank Ordering 18,000 Water Cups","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Omilia, Taco Bell","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1274/"},{"id":"INC-03114","date":"2025-11-17","year":2025,"title":"Purportedly AI-Enhanced Phishing Campaign Allegedly Impersonates Australian Government Services in Large-Scale Welfare Scam","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Generative Ai Developers, Mcto3001","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1275/"},{"id":"INC-04794","date":"2023-10-01","year":2023,"title":"Ottawa Couple Reportedly Loses CA$177,023 After Purported Deepfake Elon Musk Investment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammer…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1276/"},{"id":"INC-02282","date":"2025-11-21","year":2025,"title":"Alleged Harmful Outputs and Data Exposure in Children's AI Products by FoloToy, Miko, and Character.AI","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Character.ai, Folotoy, Meta, Miko, Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1277/"},{"id":"INC-02408","date":"2025-11-11","year":2025,"title":"ChatGPT Reportedly Found to Reproduce Protected German Lyrics in Copyright Case","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1278/"},{"id":"INC-03046","date":"2025-11-18","year":2025,"title":"Prominent AI Chatbots Allegedly Produced Incorrect UK Financial and ISA Guidance","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Google, Large Language Model Developers, Meta, Microsoft, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1279/"},{"id":"INC-04840","date":"2023-10-20","year":2023,"title":"Reported Use of AI Voice and Identity Manipulation in the Ongoing 'Phantom Hacker' Fraud Scheme","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Phantom Hacker, Scammers, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1280/"},{"id":"INC-02281","date":"2025-11-10","year":2025,"title":"Alleged Harmful Health Outcomes Following Reported Use of Purported ChatGPT-Generated Medical Advice in Hyderabad","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1281/"},{"id":"INC-03164","date":"2025-11-17","year":2025,"title":"Reported Disqualification of Two Books from the Ockham New Zealand Book Awards Due to Alleged AI-Generated Cover Art","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Image Generation Technology Developers, Sugarcube Studios","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1282/"},{"id":"INC-03203","date":"2025-11-19","year":2025,"title":"Secret Desires AI Platform Reportedly Exposed Nearly Two Million Sensitive Images in Cloud Storage Leak","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Secret Desires","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1284/"},{"id":"INC-14909","date":"2025-11-29","year":2025,"title":"Purportedly AI-Generated Jason Momoa Deepfake Used in Romance Scam Reportedly Defrauding British Widow of $600,000","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1285/"},{"id":"INC-03109","date":"2025-05-29","year":2025,"title":"Purportedly AI-Assisted Citation Errors Allegedly Found in Newfoundland and Labrador's 2025 Health Workforce Report by Deloitte","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deloitte, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1286/"},{"id":"INC-03100","date":"2025-11-26","year":2025,"title":"Purported Deepfake-Based Facebook Impersonation Reportedly Targets Daughter of Scot in Coma","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1287/"},{"id":"INC-03094","date":"2025-08-01","year":2025,"title":"Purported Deepfake Video and Fake News Articles Allegedly Used to Impersonate Guernsey's Chief Minister in Investment Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Scammers, Synthetic…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1288/"},{"id":"INC-02851","date":"2025-07-28","year":2025,"title":"Malta's Prime Minister Robert Abela Reportedly Deepfaked by a Ukrainian National in Cryptocurrency Fraud Targeting Local Residents","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Kateryna Izotkina, Maria Lipinski, Money Launderers, Scammers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1289/"},{"id":"INC-02277","date":"2025-10-27","year":2025,"title":"Alleged Fabricated News Sites and Deepfakes Impersonated Maltese Ministers, Financial Experts, and Media to Promote NethertoxAGENT Fraud","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Nethertoxagent Scammers, Scammers, Scammers In Malta,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1290/"},{"id":"INC-04214","date":"2024-08-01","year":2024,"title":"South Korean Fraud Ring Allegedly Used Deepfake Identities to Traffic Victims into Cambodia Scam Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Choi Jinwoo, Choi Minsu, Deepfake Technology Developers, Seo Jaeseok, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1291/"},{"id":"INC-03811","date":"2024-02-01","year":2024,"title":"Glasgow Man Allegedly Used AI Tool to Create and Share Nonconsensual Deepfake Nude Images of Former Classmate","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Callum Brooks, Deepfake Technology Developers, Image Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1292/"},{"id":"INC-03081","date":"2025-12-06","year":2025,"title":"Purported Deepfake Impersonating Cyprus President Nikos Christodoulides Reportedly Defrauded Citizens of Thousands of Euros","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1293/"},{"id":"INC-03288","date":"2025-12-05","year":2025,"title":"The New York Times Sued Perplexity for Allegedly Using Copyrighted Content and Generating False Attributions","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Perplexity Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1294/"},{"id":"INC-02779","date":"2025-01-18","year":2025,"title":"Japanese Teen Allegedly Uses AI-Generated Program to Breach Kaikatsu Frontier and Leak Data of 7.3 Million Customers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unnamed 17 Year Old Boy From Osaka","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1295/"},{"id":"INC-02340","date":"2025-02-05","year":2025,"title":"Attacker Reportedly Bypasses AI Safety Filters to Obtain Guidance for Non-Fatal Hammer Assault in Denmark","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unnamed 22 Year Old Man From Denmark","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1296/"},{"id":"INC-03610","date":"2024-10-30","year":2024,"title":"Blogger Milagro Gramz Allegedly Promoted AI-Generated Pornographic Deepfake Targeting Megan Thee Stallion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Milagro Gramz","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1297/"},{"id":"INC-03018","date":"2025-12-04","year":2025,"title":"Perplexity AI Reportedly Accused in Federal Lawsuit of Purported Copyright Infringement and False Attribution of Chicago Tribune Content","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Perplexity Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1298/"},{"id":"INC-02369","date":"2025-10-03","year":2025,"title":"Bodycam Footage Reportedly Contradicted Purportedly ChatGPT-Generated Use-of-Force Narrative by Immigration Agent","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Openai, United States Border Patrol, United States Department Of Homeland Security, United States Immigration And…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1299/"},{"id":"INC-03361","date":"2025-12-04","year":2025,"title":"Waymo Self-Driving Vehicles Reportedly Passed Stopped School Buses at Least 19 Times, Prompting NHTSA Probe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1300/"},{"id":"INC-03062","date":"2025-11-11","year":2025,"title":"Purported AI-Generated Sexual Deepfakes Allegedly Deployed in Transnational Harassment Campaign Targeting Hong Kong Exiles","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Suspected Transnational Repression Actors, Unidentified Harassment Campaign,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1301/"},{"id":"INC-03172","date":"2025-12-11","year":2025,"title":"Reported Viral AI-Generated Photo Purportedly Shows Donald Trump Using a Walker","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Keith Edwards, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1302/"},{"id":"INC-03326","date":"2025-12-04","year":2025,"title":"USGS ShakeAlert System Reportedly Generated False Earthquake Alert Affecting Nevada and California","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Berkeley Seismological Laboratory, United States Geological Survey (usgs)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1303/"},{"id":"INC-03370","date":"2025-06-01","year":2025,"title":"Whirlpool Reportedly Used AI-Altered Footage of North Carolina State Senator DeAndrea Salvador in Brazilian Advertisement","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Consul, Deepfake Technology Developers, Dm9, Omnicom Group, Synthetic Audio Generation Technology Developers, Whirlpool","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1304/"},{"id":"INC-03311","date":"2025-12-05","year":2025,"title":"UK Facial Recognition System Reportedly Exhibits Higher False Positive Rates for Black and Asian Subjects","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"British Law Enforcement, Government Of The United Kingdom, Home Office, Law Enforcement, Metropolitan Police, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1305/"},{"id":"INC-02578","date":"2025-12-15","year":2025,"title":"Florida Couple Reportedly Loses $45,000 in Alleged AI-Generated Elon Musk Impersonation Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1306/"},{"id":"INC-02657","date":"2025-12-15","year":2025,"title":"Grok AI Reportedly Generated Fabricated Civilian Hero Identity During Bondi Beach Shooting","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1307/"},{"id":"INC-03227","date":"2025-04-18","year":2025,"title":"Springer Nature Book 'Mastering Machine Learning: From Basics to Advanced' Reportedly Published With Numerous Purportedly Nonexistent or Incorrect Citations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Govindakumar Madhavan, Large Language Model Developers, Springer Nature","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1308/"},{"id":"INC-03228","date":"2025-06-17","year":2025,"title":"Springer Nature Book 'Social, Ethical and Legal Aspects of Generative AI: Tools, Techniques and Systems' Reportedly Published With Numerous Purportedly Fabricated or Unverifiable Citations","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Francesco Vigliarolo, Generative Ai Developers, Jair Minoro Abe, Kazumi Nakamatsu, Large Language Model Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1309/"},{"id":"INC-02383","date":"2025-12-12","year":2025,"title":"Canada Revenue Agency (CRA) AI Chatbot 'Charlie' Reportedly Gave Incorrect Tax Filing Guidance at Scale","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Canada Revenue Agency (cra), Generative Ai Developers, Government Of Canada","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1310/"},{"id":"INC-04801","date":"2023-09-17","year":2023,"title":"Peppermill Casino Facial Recognition System Reportedly Misidentified Individual, Leading to Wrongful Arrest in Reno","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Peppermill Casino, Reno Police Department, Unknown Facial Recognition Technology Developers","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1311/"},{"id":"INC-03391","date":"2025-12-09","year":2025,"title":"ZeroEyes AI Surveillance System Reportedly Flagged Clarinet as Gun, Triggering School Lockdown in Florida","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Lawton Chiles Middle School, Seminole County Public Schools, Zeroeyes","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1312/"},{"id":"INC-02318","date":"2025-12-18","year":2025,"title":"Anthropic Claude AI Agent Reportedly Caused Financial Losses While Operating Office Vending Machine at Wall Street Journal Headquarters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Andon Labs, Anthropic, The Wall Street Journal","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1313/"},{"id":"INC-03082","date":"2025-12-02","year":2025,"title":"Purported Deepfake Impersonating Doctor Allegedly Used in $200,000 Investment Scam Targeting Florida Grandmother","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1314/"},{"id":"INC-03136","date":"2025-08-26","year":2025,"title":"Purportedly AI-Generated Nude Images of Middle School Students Reportedly Circulated at Louisiana School","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unnamed Students At Sixth Ward Middle School","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1315/"},{"id":"INC-02626","date":"2025-12-19","year":2025,"title":"Google AI-Generated Search Summary Reportedly Falsely Implicated Canadian Musician in Sexual Offenses, Leading to Concert Cancellation","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1316/"},{"id":"INC-03084","date":"2025-12-27","year":2025,"title":"Purported Deepfake Impersonation of Elon Musk Used to Promote Fraudulent '17-Hour' Diabetes Treatment Claims","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1317/"},{"id":"INC-03201","date":"2025-12-23","year":2025,"title":"School's Suspected AI-Cheating Allegation Precedes Student's Reported Suicide in Greater Noida, India","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unnamed Secondary School In Greater Noida, Unnamed Student In Greater Noida","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1318/"},{"id":"INC-03085","date":"2025-12-26","year":2025,"title":"Purported Deepfake Investment Video Reportedly Used in Scam That Defrauded Turkish Couple of 1.5 Million Lira (~$35,000 USD)","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1319/"},{"id":"INC-03135","date":"2025-12-25","year":2025,"title":"Purportedly AI-Manipulated Image Reported to Falsely Depict Taiwanese Politician Kao Chia-yu Posing With PRC Flag","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Information Manipulation Actors, Unknown Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1320/"},{"id":"INC-03213","date":"2025-11-27","year":2025,"title":"Shilpa Shetty Alleges AI-Enabled Impersonation and Misuse of Likeness in Mumbai High Court Filing","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Malicious Actors,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1321/"},{"id":"INC-03205","date":"2025-12-26","year":2025,"title":"Senior Kerala Congress Leader N. Subrahmanian Reportedly Booked for Sharing Purportedly AI-Generated Defamatory Image of Chief Minister Pinarayi Vijayan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Information Manipulation Actors, N.…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1322/"},{"id":"INC-02845","date":"2025-12-28","year":2025,"title":"Madhya Pradesh Congress Alleges AI-Generated Images Were Submitted in National Water Award Process","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Khandwa District Administration (madhya…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1323/"},{"id":"INC-04090","date":"2024-09-18","year":2024,"title":"Pieces Technologies' Clinical AI Systems Allegedly Marketed With Misleading Performance Claims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Pieces Technologies Inc.","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1324/"},{"id":"INC-03156","date":"2025-12-21","year":2025,"title":"Reported AI-Generated Deepfake Videos Impersonating Elon Musk and Dragon’s Den Allegedly Used in Cryptocurrency Investment Scam Targeting Canadian Victims","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1325/"},{"id":"INC-03360","date":"2025-12-20","year":2025,"title":"Waymo Robotaxis Allegedly Contributed to Traffic Gridlock During San Francisco PG&E Power Outage","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1326/"},{"id":"INC-03155","date":"2025-12-31","year":2025,"title":"Reported AI-Generated Deepfake Romance Scam Allegedly Used to Steal One Bitcoin From Recently Divorced Investor","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Pig Butchering…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1327/"},{"id":"INC-01698","date":"2026-01-03","year":2026,"title":"Purported Deepfake Impersonating Elon Musk Allegedly Defrauded Elderly U.S. Woman of $50,000 via Gift Card–to-Crypto Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1328/"},{"id":"INC-02671","date":"2025-12-25","year":2025,"title":"Grok Reportedly Generated and Distributed Nonconsensual Sexualized Images of Adults and Minors in X Replies","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Xai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1329/"},{"id":"INC-03117","date":"2025-12-13","year":2025,"title":"Purportedly AI-Generated 'Eric Langford' Missing Boy Scout Hoax Circulating Across Multiple Social Media Platforms","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Unknown Files","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1330/"},{"id":"INC-01703","date":"2026-01-05","year":2026,"title":"Purported Deepfake Videos Reportedly Impersonated Yanis Varoufakis on YouTube and Social Media","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Deepfake Content Creators,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1331/"},{"id":"INC-01517","date":"2026-01-03","year":2026,"title":"National Weather Service Reportedly Published AI-Generated Forecast Map With Fabricated Idaho Town Names","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, National Weather Service","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1332/"},{"id":"INC-01709","date":"2026-01-03","year":2026,"title":"Purportedly AI-Generated Images and Videos Reportedly Spread Misinformation About Nicolás Maduro's Capture on X","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Google, Image Generation Technology Developers, Information Manipulation Actors,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1333/"},{"id":"INC-01151","date":"2026-01-07","year":2026,"title":"Grok Reportedly Generated False 'Unmasked' Images of ICE Agent, Purportedly Triggering Online Misidentification and Harassment in Minneapolis","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grok Users, Unknown Internet Sleuths, X (twitter) Users, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1334/"},{"id":"INC-04790","date":"2023-12-01","year":2023,"title":"OpenDream AI Platform Reportedly Commercialized AI-Generated CSAM and Non-consensual Deepfake Sexual Images","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cbm Media Pte Ltd, Opendream, Opendream Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1335/"},{"id":"INC-06399","date":"2020-02-07","year":2020,"title":"BJP Used Deepfake Videos of Manoj Tiwari to Target Haryanvi Voters in 2020 Delhi Election","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Bjp Delhi It Cell, Deepfake Technology Developers, Information Manipulation Actors, Information Manipulation Actors In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1336/"},{"id":"INC-03359","date":"2025-12-08","year":2025,"title":"Waymo Robotaxi Reportedly Transported Undetected Person Trapped in Trunk in Los Angeles","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1337/"},{"id":"INC-03077","date":"2025-12-24","year":2025,"title":"Purported Deepfake Endorsements Reportedly Used to Promote Fraudulent Health and Investment Products in Montenegro and Bosnia and Herzegovina","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Digital Edge, Image Generation Technology Developers, Limited Charm, Nearest Edge,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1338/"},{"id":"INC-01705","date":"2026-01-06","year":2026,"title":"Purportedly AI-Cloned Voice Allegedly Used to Defraud Play School Owner of ₹97,500 (~$1,080 USD) in Indore, India","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Scammers In India, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1339/"},{"id":"INC-03061","date":"2025-12-09","year":2025,"title":"Purported AI-Generated Image Depicting JD Vance and Usha Vance in Public Altercation Circulated on Social Media","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Keith Edwards, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1340/"},{"id":"INC-03074","date":"2025-12-03","year":2025,"title":"Purported Deepfake Advertisement Falsely Depicting Physician Endorsement Used to Sell Lipedema Cream to U.S. Patient Beth Holland","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1341/"},{"id":"INC-04120","date":"2024-12-01","year":2024,"title":"Purported Deepfake Nude Images of Students Circulated Without Consent at Valencia Educational Institute","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unnamed Male Student, Unnamed Male Student In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1342/"},{"id":"INC-01178","date":"2026-01-14","year":2026,"title":"ICE AI Resume Screening Error Allegedly Routed Inexperienced Recruits Into Inadequate Training Pathways","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Generative Ai Developers, United States Immigration And Customs Enforcement, Unknown Ai Assisted Resume Screening…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1343/"},{"id":"INC-01692","date":"2026-01-15","year":2026,"title":"Purported AI-Generated Images Depict Kate Garraway With Fictitious Partner","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unknown Malicious Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1344/"},{"id":"INC-03093","date":"2025-12-30","year":2025,"title":"Purported Deepfake Video Allegedly Used to Harass Washington State Patrol Trooper","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unknown Washington State Patrol Employee(s)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1345/"},{"id":"INC-03067","date":"2025-12-23","year":2025,"title":"Purported AI-Generated Videos Depicted George Will Reportedly Commenting on Trump and Supreme Court Rulings","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Synthetic Audio Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1346/"},{"id":"INC-00661","date":"2026-01-11","year":2026,"title":"Automated Shuttle Bus Was Reportedly Rear-Ended During U.S. Department of Transportation Demonstration Ride in Washington, D.C.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Beep Inc.","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1347/"},{"id":"INC-03078","date":"2025-10-07","year":2025,"title":"Purported Deepfake Explicit Images of Middle School Students Allegedly Created and Circulated Using Mobile App in Goffstown, New Hampshire","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Boys, Deepfake Technology Developers, Image Generation Technology Developers, Students, Unnamed Students At Mountain…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1348/"},{"id":"INC-02211","date":"2025-10-24","year":2025,"title":"AI Training Dataset for Detecting Nudity Allegedly Found to Contain CSAM Images of Identified Victims","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Academic Researchers, Ai Developers, Ai Researchers, Dataset Users, Independent Researchers, Nudenet Dataset…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1349/"},{"id":"INC-03170","date":"2025-03-25","year":2025,"title":"Reported Use of AI Apps to Create Sexualized Deepfake Images of High School Students at Cascade High School in Iowa","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Students, Unnamed Students At Western Dubuque…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1350/"},{"id":"INC-02289","date":"2025-03-15","year":2025,"title":"Alleged Use of AI to Create Sexualized Deepfake Images of Middle School Students Under Investigation in Bucks County, Pennsylvania","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Students, Unnamed Middle School Student In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1351/"},{"id":"INC-02846","date":"2025-04-08","year":2025,"title":"Malaysian Teenager Allegedly Arrested for Creating and Selling AI-Generated Deepfake Images of Schoolmates and Alumni in Johor","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Boys, Deepfake Technology Developers, High School Students, Image Generation Technology Developers, Students, Unnamed…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1352/"},{"id":"INC-02724","date":"2025-10-15","year":2025,"title":"ICE Facial Recognition App Mobile Fortify Reportedly Misidentified Woman Twice During Immigration Enforcement in Oregon","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"United States Customs And Border Protection, United States Department Of Homeland Security, United States Immigration…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1353/"},{"id":"INC-04126","date":"2024-10-10","year":2024,"title":"Purportedly AI-Altered Fake Nude Images of High School Girls and Women Reportedly Created and Disseminated in Pensacola, Florida","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unnamed 18 Year Old Male Student From Pensacola","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1354/"},{"id":"INC-01730","date":"2026-01-05","year":2026,"title":"Reported AI Impersonations of Pastors Used in Online Donation and Influence Scams","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1355/"},{"id":"INC-03318","date":"2025-07-09","year":2025,"title":"Urban VPN Proxy Browser Extension Reportedly Harvested and Sold Private AI Chatbot Conversations via Silent Update","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"Biscience, Urban Cyber Security","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1356/"},{"id":"INC-02094","date":"2026-01-22","year":2026,"title":"White House Reportedly Shares Purportedly AI-Altered Arrest Photo Depicting Minnesota Protester Nekima Levy Armstrong as Crying","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Executive Office Of The President, Image Generation Technology Developers, White…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1357/"},{"id":"INC-01704","date":"2026-01-24","year":2026,"title":"Purportedly AI-Altered Images Reportedly Distort Evidence After Minneapolis Shooting of ICU Nurse Alex Pretti","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Google, Information Manipulation Actors, Partisan Online Accounts, Pro Trump Social Media Influencers, Unidentified…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1358/"},{"id":"INC-03161","date":"2025-03-04","year":2025,"title":"Reported Deepfake Influencers on TikTok Allegedly Used to Promote Fraudulent Wellness Products","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Scammers, Synthetic Audio Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1359/"},{"id":"INC-02431","date":"2025-07-15","year":2025,"title":"CISA Acting Director Reportedly Uploaded Sensitive Government Documents to Public ChatGPT Instance","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Madhu Gottumukkala, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1360/"},{"id":"INC-02069","date":"2026-01-23","year":2026,"title":"Waymo Autonomous Vehicle Reportedly Struck Child Near Elementary School in Santa Monica, California","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1361/"},{"id":"INC-00701","date":"2026-01-10","year":2026,"title":"Border Patrol Agent Allegedly Claimed Facial Recognition Identified Minneapolis ICE Observer and Global Entry Was Reportedly Revoked Three Days Later","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Nec, United States Border Patrol, United States Customs And Border Protection, United States Department Of Homeland…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1362/"},{"id":"INC-01914","date":"2026-02-05","year":2026,"title":"Trump Reportedly Posted Purportedly AI-Generated Racist Video Depicting Barack and Michelle Obama as Apes on Truth Social","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Donald Trump, Synthetic Media Generation Technology Developers, Trump Administration, Unidentified X User","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1363/"},{"id":"INC-01464","date":"2026-01-31","year":2026,"title":"Moltbook Database Exposure Allegedly Revealed Users' Private Communications and API Authentication Tokens","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Moltbook, Moltbook Platform Operators","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1364/"},{"id":"INC-03532","date":"2024-09-01","year":2024,"title":"AkiraBot Reportedly Used OpenAI to Spam Website Chats and Contact Forms at Scale","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Openai, Unknown Akirabot Developers, Unknown Akirabot Operators, Unknown Malicious Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1365/"},{"id":"INC-03023","date":"2025-09-04","year":2025,"title":"Philippines Senate Hearing Featured Reports of Purported AI-Generated Deepfake Pornography Targeting Actress Angel Aquino and Content Creator Queen Hera's Daughter","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1366/"},{"id":"INC-01800","date":"2026-01-18","year":2026,"title":"Spokane Transit Authority Onboard Navigation System Reportedly Routed Double-Decker Bus to Low Bridge, Injuring Seven","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Spokane Transit Authority, Unidentified Vendor Of Spokane Transit Authority Onboard Cadnavigation Routing Software","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1367/"},{"id":"INC-01365","date":"2026-02-01","year":2026,"title":"Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM05","LLM07"],"owasp_asi":["ASI02","ASI03","ASI04","ASI06","ASI09"],"cve_ids":[],"affected":"Malicious Actors, Openclaw, Unknown Threat Actors, Unknown Threat Actors Distributing Malicious Openclaw Skills","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1368/"},{"id":"INC-01708","date":"2026-02-07","year":2026,"title":"Purportedly AI-Generated Image Reportedly Circulated Ahead of Thai Election Depicting PM Anutin Charnvirakul Dining with Benjamin Mauerberger","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Csi La (facebook Page), Google, Information Manipulation Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1369/"},{"id":"INC-02381","date":"2025-05-31","year":2025,"title":"California Teen Reportedly Died of Overdose After Repeatedly Seeking Drug-Use Guidance Allegedly from ChatGPT","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1370/"},{"id":"INC-01700","date":"2026-01-09","year":2026,"title":"Purported Deepfake Reportedly Impersonated Consumer Adviser Clark Howard to Promote Auto-Insurance Quote Site","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1371/"},{"id":"INC-02699","date":"2025-08-26","year":2025,"title":"Houston Gun Store Co-Owner Allegedly Used AI to Create Sexually Explicit Deepfake Images of a Social Media Influencer","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Jorge Abrego","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1372/"},{"id":"INC-00131","date":"2026-02-11","year":2026,"title":"AI Coding Agent 'MJ Rathbun' Allegedly Published Personalized Accusatory Blog Post Targeting Matplotlib Maintainer After Pull Request Closure","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09","ASI10"],"cve_ids":[],"affected":"Mj Rathbun, Moltbook, Openclaw, Unknown Deployer Of Mj Rathbun","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1373/"},{"id":"INC-01710","date":"2026-02-17","year":2026,"title":"Purportedly AI-Generated Sepsis Alert Reportedly Prompted Potentially Inappropriate IV Fluid Administration for a Dialysis Patient, Averted by Clinician Intervention","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"St. Rose Dominican Hospital (henderson Nevada), Unknown Healthcare Technology, Unknown Sepsis Alert Model Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1374/"},{"id":"INC-01574","date":"2026-02-10","year":2026,"title":"OpenAI Allegedly Did Not Alert RCMP After ChatGPT Flagged Violent Chats Before British Columbia School Shooting","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1375/"},{"id":"INC-00577","date":"2026-02-15","year":2026,"title":"Amazon Delivery Van Reportedly Became Stranded on Essex Mudflats After GPS Routed It Onto the Broomway","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Amazon, Unknown Gpssatnav Developer","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1376/"},{"id":"INC-01761","date":"2026-02-13","year":2026,"title":"Seedance 2.0 Reportedly Generated Viral Tom Cruise–Brad Pitt Fight Video, Prompting Hollywood IP and Likeness Complaints","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Bytedance, Ruairi Robinson","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1377/"},{"id":"INC-03131","date":"2025-12-09","year":2025,"title":"Purportedly AI-Generated Video Allegedly Depicted Radnor High School Students in Pennsylvania Inappropriately, Prompting Police Investigation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Unnamed Radnor High School Student","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1378/"},{"id":"INC-03787","date":"2024-11-23","year":2024,"title":"Florida Woman Reportedly Jailed After Ex-Boyfriend Allegedly Submitted AI-Fabricated Text Screenshot as Bond-Violation Evidence","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Eric R. Sims, Generative Ai Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1379/"},{"id":"INC-01690","date":"2026-01-09","year":2026,"title":"Purported AI Voice Clone Allegedly Narrated Shaun Rein's 'The Split' in Unauthorized YouTube 'Podcast' Videos","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, The Us China Narrative (youtube…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1380/"},{"id":"INC-03130","date":"2025-12-13","year":2025,"title":"Purportedly AI-Generated TikTok Videos Reportedly Urged 'Polexit' Campaign, Prompting Polish Government Complaint to EU","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1381/"},{"id":"INC-01850","date":"2026-01-02","year":2026,"title":"Tencent's WeChat-Integrated Yuanbao Chatbot Reportedly Insulted User During Coding Debug Request","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Tencent, Wechat","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1382/"},{"id":"INC-03325","date":"2025-01-15","year":2025,"title":"User Reportedly Developed Emotional Dependence on Customized ChatGPT 'Boyfriend,' Citing Grief After Context Resets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1383/"},{"id":"INC-03096","date":"2025-10-23","year":2025,"title":"Purported Deepfake Video Impersonating Elton John Reportedly Induced Northeast Ohio Man to Authorize $20,000 in Scam Charges","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1384/"},{"id":"INC-02102","date":"2026-01-07","year":2026,"title":"X Users Reportedly Prompted Grok to Sexualize Images of Renée Good After Her Killing in Minneapolis","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai, Xai Users","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1385/"},{"id":"INC-01542","date":"2026-01-23","year":2026,"title":"NPR Host David Greene Alleged Google's NotebookLM Replicated His Voice Without Consent, Prompting Lawsuit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1386/"},{"id":"INC-02818","date":"2025-11-02","year":2025,"title":"Lawsuit Alleged ChatGPT (GPT-4o) Encouraged Colorado Man's Suicide After Prolonged 'AI Companion' Chats","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1387/"},{"id":"INC-03083","date":"2025-12-19","year":2025,"title":"Purported Deepfake Impersonating Sudha Murty Reportedly Promoted Quantum AI India Investment Scam via Spoofed News Link","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Quantum Ai, Quantum Ai Scammers, Scammers, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1388/"},{"id":"INC-00903","date":"2026-02-08","year":2026,"title":"DJI Romo Cloud Authorization Bug Reportedly Exposed Camera, Microphone, and Home-Mapping Data From Nearly 7,000 Robot Vacuums","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Dji","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1389/"},{"id":"INC-00890","date":"2026-01-21","year":2026,"title":"DHS Agents Reportedly Threatened Legal Observers With 'Domestic Terrorist' Database While Using Purportedly AI-Enabled Surveillance During ICE Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Surveillance Technology Developers, United States Department Of Homeland Security","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1390/"},{"id":"INC-02352","date":"2025-07-12","year":2025,"title":"Azerbaijani Media Agency Reportedly Warned Purported Deepfake Videos Attributed to Defense and Foreign Ministers Claimed Belarusian Plane Was Downed in Russian Airspace","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1391/"},{"id":"INC-00647","date":"2026-02-13","year":2026,"title":"Ars Technica Retracted Article After Purportedly AI-Generated Text Was Presented as Direct Quotes From Matplotlib Maintainer","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Ars Technica, Benj Edwards, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1392/"},{"id":"INC-02099","date":"2026-02-12","year":2026,"title":"Woolworths' Olive Chatbot Reportedly Generated 'Angry Mother' Anecdotes During Support Calls After Gemini Upgrade","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Google, Woolworths Group","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1393/"},{"id":"INC-01701","date":"2026-02-16","year":2026,"title":"Purported Deepfake TikTok Account Using Grainville School Branding in Jersey Reportedly Targeted Staff, Prompting Police Probe","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Malicious Actors, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1394/"},{"id":"INC-00608","date":"2026-02-23","year":2026,"title":"Anthropic Said DeepSeek, Moonshot, and MiniMax Used Fraudulent Accounts and Proxies to Illicitly Distill Claude Capabilities at Scale","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Anthropic, Deepseek, Minimax, Moonshot Ai, Proxy Reseller Services","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1395/"},{"id":"INC-05504","date":"2021-04-22","year":2021,"title":"Betfair's Machine-Learning Risk System Reportedly Failed to Flag Luke Ashton Before Gambling-Related Suicide in England","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Betfair, Flutter Uk And Ireland","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1396/"},{"id":"INC-02495","date":"2025-08-11","year":2025,"title":"Deepfakes Reportedly Impersonated David Taylor-Robinson and Other UK Health Experts to Promote Wellness Nest Supplements","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1397/"},{"id":"INC-03098","date":"2025-05-08","year":2025,"title":"Purported Deepfake Video Reportedly Misrepresented CBS Anchor Doug Dunbar and Frisco, Texas, Stabbing Suspect Amid Online Misinformation Campaign","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Information Manipulation Actors, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1398/"},{"id":"INC-01789","date":"2026-01-28","year":2026,"title":"South Korean Woman Allegedly Used ChatGPT to Assess Lethality of Drug-and-Alcohol Mixtures Before Two Fatal Motel Poisonings","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM07"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"Kim (suspect In Seoul Poisoning Case), Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1399/"},{"id":"INC-03366","date":"2025-10-24","year":2025,"title":"West Midlands Police Reportedly Relied on Erroneous Copilot-Generated Intelligence in Maccabi Tel Aviv Away-Fan Ban Decision","severity":"High","attack_vector":"other","owasp_llm":["LLM03","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Microsoft, West Midlands Police","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1400/"},{"id":"INC-02066","date":"2026-02-27","year":2026,"title":"Washington State DOL's AI Phone System Reportedly Failed to Provide Spanish-Language Service to Callers Requesting Spanish","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Amazon, Washington State Department Of Licensing","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1401/"},{"id":"INC-02531","date":"2025-04-02","year":2025,"title":"DOGE Reportedly Relied on Unvetted ChatGPT Outputs in Canceling National Endowment for the Humanities Grants","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Justin Fox (doge), Nate Cavanaugh (doge), Openai, United States Department Of Government Efficiency (doge)","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1402/"},{"id":"INC-01548","date":"2026-02-05","year":2026,"title":"NZ News Hub Reportedly Used AI-Rewritten News Posts and Synthetic Images to Mislead New Zealand Facebook Users","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Image Generation Technology Developers, Large Language Model Developers, Nz News Hub","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1403/"},{"id":"INC-01695","date":"2026-03-10","year":2026,"title":"Purported AI-Generated Nude Images Reportedly Used to Extort Wichita Man in Kansas","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1404/"},{"id":"INC-01691","date":"2026-01-09","year":2026,"title":"Purported AI-Generated Doctor Deepfakes Reportedly Used Guy's and St Thomas' Branding to Market Weight Loss Patches","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1405/"},{"id":"INC-01696","date":"2026-02-28","year":2026,"title":"Purported AI-Generated War Footage Reportedly Circulated Widely Online During the Opening Phase of the War in Iran","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Information…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1406/"},{"id":"INC-01138","date":"2026-03-11","year":2026,"title":"Grammarly's AI Expert Review Allegedly Used Journalists' and Authors' Names Without Consent","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Grammarly, Superhuman","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1407/"},{"id":"INC-03105","date":"2025-08-12","year":2025,"title":"Purported Oprah Deepfake Reportedly Induced Utah Woman to Buy Misrepresented Weight Loss Supplements","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Prozenith, Scammers, Synthetic Audio Generation Technology Developers, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1408/"},{"id":"INC-01711","date":"2026-01-21","year":2026,"title":"Purportedly AI-Generated Tasmania Tours Content Reportedly Misled Tourists Into Traveling to Nonexistent Weldborough Hot Springs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Australian Tours And Cruises, Generative Ai Developers, Image Generation Technology Developers, Tasmania Tours,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1409/"},{"id":"INC-01707","date":"2026-01-17","year":2026,"title":"Purportedly AI-Generated Explicit Images of Royal School Armagh Girls Reportedly Circulated Among Pupils","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Unknown Student(s), Unknown Student(s) At…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1410/"},{"id":"INC-00838","date":"2026-02-28","year":2026,"title":"CodeWall's Autonomous Agent Reportedly Obtained Unauthorized Access to McKinsey's Lilli AI Platform Database","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Codewall, Mckinsey And Company","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1412/"},{"id":"INC-01694","date":"2026-03-05","year":2026,"title":"Purported AI-Generated Inland Revenue Scam Ads Reportedly Impersonated New Zealand Commissioner Peter Mersi in Alleged Fake Crypto Tax Webinar","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Scammers, Unknown…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1413/"},{"id":"INC-01536","date":"2026-03-04","year":2026,"title":"Nippon Life Alleged ChatGPT Practiced Law Without a License in Illinois Disability Case","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1415/"},{"id":"INC-03102","date":"2025-07-14","year":2025,"title":"Purported Facial Recognition Error Reportedly Led to Arrest and Monthslong Jailing of Tennessee Woman in North Dakota Fraud Case","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI08","ASI09"],"cve_ids":[],"affected":"Fargo Police Department, Unknown Facial Recognition Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1416/"},{"id":"INC-01699","date":"2026-03-14","year":2026,"title":"Purported Deepfake of Ashley James Reportedly Used to Promote Weight Loss Pills","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Advertisers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1417/"},{"id":"INC-01400","date":"2026-02-27","year":2026,"title":"Meta AI Smart Glasses Reportedly Exposed Intimate User Imagery and Video to Human Reviewers in Kenya","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Meta, Sama","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1418/"},{"id":"INC-03080","date":"2025-02-16","year":2025,"title":"Purported Deepfake Images of Gráinne Seoige Reportedly Circulated During Ireland's 2024 General Election Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Image Generation Technology, Image Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1419/"},{"id":"INC-02357","date":"2025-10-28","year":2025,"title":"Balázs Orbán Allegedly Published Purported Deepfake of Péter Magyar Claiming He Would Cut Pensions","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Balazs Orban, Deepfake Technology Developers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1420/"},{"id":"INC-01697","date":"2026-03-19","year":2026,"title":"Purported Deepfake Applicant Reportedly Impersonated Tokyo IT Executive Kenbun Yoshii During Online Job Interview","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Synthetic Audio Generation Technology Developers, Unknown Fake Job Applicant(s)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1421/"},{"id":"INC-03317","date":"2025-11-27","year":2025,"title":"Unlabeled Purportedly AI-Generated 'Jessica Foster' Account Reportedly Posed as Pro-Trump Army Service Member to Attract Followers and Funnel Users to Paid Adult Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Jessica Foster (@jessicaa.foster On…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1422/"},{"id":"INC-01285","date":"2026-02-15","year":2026,"title":"KPMG Australia Partner Reportedly Used AI to Cheat on Internal AI Training Test and Was Fined A$10,000","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Unnamed Kpmg Australia Partner","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1423/"},{"id":"INC-00811","date":"2026-02-26","year":2026,"title":"Claude Code Agent Reportedly Deleted DataTalks.Club Production Infrastructure, Database, and Snapshots via Terraform","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Alexey Grigorev, Anthropic","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1424/"},{"id":"INC-02124","date":"2025-11-05","year":2025,"title":"'Citizens Against Mamdani' Accounts Reportedly Posted AI-Generated Videos of Fictional New Yorkers to Simulate Political Opposition","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Citizens Against Mamdani, Citizens Against Mamdani Social Media Accounts, Deepfake Technology Developers, Information…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1425/"},{"id":"INC-01639","date":"2026-01-05","year":2026,"title":"Perplexity AI Reportedly Misstated CLL Research, Allegedly Contributing to Delayed Treatment and Prolonged Suffering","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Perplexity Ai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1426/"},{"id":"INC-02356","date":"2025-04-03","year":2025,"title":"Baltimore Lawsuit Alleged DraftKings and FanDuel Used Machine-Learning-Driven Targeting to Exploit Vulnerable Gamblers","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Draftkings, Fanduel, Flutter Entertainment","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1427/"},{"id":"INC-07452","date":"2017-07-28","year":2017,"title":"UK High Court Found Sky Betting & Gaming Unlawfully Used Automated Profiling and Targeted Marketing to Exploit a Recovering Problem Gambler","severity":"High","attack_vector":"other","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Bonne Terre Ltd, Hestview Ltd, Sky Betting And Gaming","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1428/"},{"id":"INC-00678","date":"2026-02-26","year":2026,"title":"Bank of Italy Warned That Purported Deepfakes of Governor Fabio Panetta Were Used in Allegedly Fraudulent Investment Promotions","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Scammers, Synthetic…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1429/"},{"id":"INC-02325","date":"2025-12-01","year":2025,"title":"Anthropic's Claude Was Reportedly Jailbroken To Allegedly Help Steal Sensitive Mexican Government Data","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM03","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI09","ASI10"],"cve_ids":[],"affected":"Anthropic, Unknown Hacker","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1430/"},{"id":"INC-02635","date":"2025-09-29","year":2025,"title":"Google Gemini Reportedly Reinforced Delusions, Allegedly Contributing to Florida User's Near-Harm Episode and Suicide","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1431/"},{"id":"INC-03106","date":"2025-12-02","year":2025,"title":"Purported Pornographic Deepfakes and Fake Accounts Reportedly Impersonated German TV Presenter and Actor Collien Fernandes","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Christian Ulmen, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1432/"},{"id":"INC-02630","date":"2025-11-27","year":2025,"title":"Google Antigravity Reportedly Deleted User's Entire D: Drive While Clearing Project Cache","severity":"High","attack_vector":"other","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI05","ASI08"],"cve_ids":[],"affected":"Google, Tassos M","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1433/"},{"id":"INC-00906","date":"2026-03-02","year":2026,"title":"DOJ Attorney Reportedly Used AI to File Brief With Purportedly Fabricated Quotes and Misstated Case Holdings","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Large Language Model Developers, Rudy Renfer, United States Attorney's Office For The Eastern District Of North Carolina","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1434/"},{"id":"INC-03113","date":"2025-09-18","year":2025,"title":"Purportedly AI-Edited Obscene Clip Reportedly Impersonated Thai Actor Khunnapat Pichetworawut in Paid Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Unknown Scammers Impersonating Khunnapat Pichetworawut","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1435/"},{"id":"INC-05013","date":"2022-06-23","year":2022,"title":"AI-Enabled TruDi Navigation System Was Alleged to Have Contributed to Patient's Stroke During June 2022 Sinus Procedure","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Acclarent, Ai Enabled Healthcare System Developers, Ai Enabled Surgical Navigation System Developers, Integra…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1436/"},{"id":"INC-01148","date":"2026-03-10","year":2026,"title":"Grok Allegedly Generated Publicly Visible Sexist Abuse Targeting Swiss Finance Minister Karin Keller-Sutter After X User Prompt","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Peter K. Or Peter P., Xai","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1437/"},{"id":"INC-02784","date":"2025-04-08","year":2025,"title":"Jiushi Autonomous Delivery Vehicle Reportedly Dragged Fallen Electric Scooter During Delivery Run in Xianyang, Shaanxi","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Jiushi Intelligent Technology, Zto Express","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1438/"},{"id":"INC-01042","date":"2026-01-08","year":2026,"title":"Former New Orleans Isidore Newman School Teacher Allegedly Used AI to Create Fake Nude Images from Social Media Photos of Girls, Including Students","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Benoit Cransac, Deepfake Technology Developers, Image Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1439/"},{"id":"INC-00837","date":"2026-01-15","year":2026,"title":"Coco Robotics Delivery Robot Reportedly Became Stuck on Railroad Tracks and Was Struck by Train in Miami","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Coco Robotics","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1440/"},{"id":"INC-00826","date":"2026-02-07","year":2026,"title":"Claude Cowork Allegedly Deleted Folder Containing 15 Years of Family Photos While Organizing User's Wife's Desktop","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Anthropic, Nick Davidov","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1441/"},{"id":"INC-02792","date":"2025-12-15","year":2025,"title":"Kiro AI Coding Tool Was Reportedly Implicated in 13-Hour AWS Cost Explorer Outage in Mainland China","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI08"],"cve_ids":[],"affected":"Amazon Web Services (aws)","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1442/"},{"id":"INC-01150","date":"2026-02-19","year":2026,"title":"Grok Reportedly Disclosed Adult Performer Siri Dahl's Legal Name and Birthdate, Allegedly Contributing to Doxxing and Harassment","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1443/"},{"id":"INC-01155","date":"2026-03-19","year":2026,"title":"Hachette Reportedly Canceled Publication of Mia Ballard's Shy Girl After Generative AI Authorship Allegations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Large Language Model Developers, Mia Ballard's Editor","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1444/"},{"id":"INC-01358","date":"2026-01-17","year":2026,"title":"Lower Saxony CDU Employee Allegedly Shared Sexualized Purported Deepfake of Colleague in Internal WhatsApp Group","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Cdu Fraktion Im Niedersachsischen Landtag, Cdu Parliamentary Group In The Lower Saxony State Parliament, Deepfake…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1445/"},{"id":"INC-14908","date":"2026-04-02","year":2026,"title":"KBS AI Translation Subtitles Reportedly Broadcast Profanity During Artemis II Launch Livestream","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Korean Broadcasting System (kbs)","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1446/"},{"id":"INC-01776","date":"2026-03-13","year":2026,"title":"Sixth Circuit Sanctioned Lawyers in Whiting v. City of Athens over Alleged Fake Appellate Citations in Briefs Reportedly Bearing Hallmarks of Hallucinations","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Generative Ai Developers, Large Language Model Developers, Russ Egli, Van Irion","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1447/"},{"id":"INC-04056","date":"2024-12-01","year":2024,"title":"Ohio Man Pleaded Guilty after Prosecutors Alleged He Used AI to Create and Distribute Nonconsensual Intimate-Image Forgeries Including CSAM in Harassment Campaign","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, James Strahler Ii","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1448/"},{"id":"INC-02506","date":"2025-07-01","year":2025,"title":"Delaware Court Found Krafton Followed Most of ChatGPT's Recommendations in Campaign that Wrongfully Terminated Unknown Worlds Executives and Seized Operational Control","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Changhan (ch) Kim, Krafton, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1449/"},{"id":"INC-01012","date":"2026-03-24","year":2026,"title":"Florida Man Allegedly Used Purported Deepfake Video to Report Break-In of Deputy's Patrol Vehicle in Lake Mary","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Alexis Martinez Arizala, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1450/"},{"id":"INC-03123","date":"2025-06-30","year":2025,"title":"Purportedly AI-Generated Facebook Video Allegedly Misused Skënder Brataj and Blendi Fevziu to Promote Purported Miracle Cream in Albania","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1451/"},{"id":"INC-01693","date":"2026-03-25","year":2026,"title":"Purported AI-Generated Impersonations of Albanian Cardiologist Spiro Qirko and Journalist Ilir Topi Were Reportedly Used on Facebook to Promote Hypertension Product in Kosovo","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1452/"},{"id":"INC-02342","date":"2025-12-18","year":2025,"title":"Attorney in Fletcher v. Experian Information Solutions, Inc. Reportedly Submitted Reply Brief with Purportedly AI-Generated Material Misrepresentations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Heather Hersh, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1453/"},{"id":"INC-01702","date":"2026-04-16","year":2026,"title":"Purported Deepfake Video Reportedly Portrayed Nirmala Sitharaman Endorsing Investment Scheme","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Investment Scam Operators, Scammers, Scammers Impersonating Nirmala Sitharaman,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1454/"},{"id":"INC-03099","date":"2025-07-15","year":2025,"title":"Purported Deepfake Videos Allegedly Impersonated Optometrist Joseph Allen to Promote Myopia-Reversal Eyedrops on TikTok","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1455/"},{"id":"INC-04988","date":"2023-12-03","year":2023,"title":"Video with Reportedly AI-Generated Audio Purported to Show Croatian Footballer Luka Modrić Endorsing Immediate Matrix on Facebook Page Presented as N1 HR","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1456/"},{"id":"INC-04334","date":"2024-08-27","year":2024,"title":"Video with Reportedly AI-Generated Media Purported to Show Croatian Immunologist Stipan Jonjić Promoting Anti-Parasite Product on Facebook","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Sepenuhnya Alami Facebook Page, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1457/"},{"id":"INC-04335","date":"2024-09-03","year":2024,"title":"Video with Reportedly AI-Generated Media Purported to Show Croatian Neurosurgeon Josip Paladino Endorsing Steplex in Fake TV Segment on Facebook","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Green Facebook Page, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1458/"},{"id":"INC-04336","date":"2024-10-17","year":2024,"title":"Video with Reportedly AI-Generated Media Purported to Show Croatian Physician Alemka Markotić Endorsing Hondrosol After False Murder Claim on Facebook","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1459/"},{"id":"INC-00674","date":"2026-03-31","year":2026,"title":"Baidu Apollo Go Robotaxis Stopped in Traffic During Reported System Failure in Wuhan, Stranding Some Passengers","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI08"],"cve_ids":[],"affected":"Apollo, Apollo Go, Baidu","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1460/"},{"id":"INC-04131","date":"2024-01-17","year":2024,"title":"Purportedly AI-Manipulated Medical Scam Advertisement Reportedly Used Bulgarian TV Host and Physician's Likenesses","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1461/"},{"id":"INC-04118","date":"2024-05-04","year":2024,"title":"Purported Deepfake Facebook Advertisement Reportedly Used Bulgarian Actor and TV Host Mihail Bilalov's Likeness to Market Joint-Pain Product","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1462/"},{"id":"INC-04119","date":"2024-05-04","year":2024,"title":"Purported Deepfake Facebook Advertisement Reportedly Used Bulgarian Actor, Director, and Playwright Kamen Donev's Likeness to Market Joint-Pain Product","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1463/"},{"id":"INC-04133","date":"2024-08-28","year":2024,"title":"Purportedly AI-Manipulated Video Reportedly Misrepresented Bulgarian DPS Figure Ahmed Dogan and Spread via TikTok and Facebook","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anonymous Tiktok Satire Profile, Deepfake Technology Developers, Georgi Georgiev, Information Manipulation Actors,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1464/"},{"id":"INC-03133","date":"2025-06-12","year":2025,"title":"Purportedly AI-Generated Video Reportedly Depicted Bulgarian Politician Kostadin Kostadinov Falling During Protest","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Budilnikbg.com, Haliuo Ai, Mario Stefanov, Visoko Naprezhenie","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1465/"},{"id":"INC-01520","date":"2026-02-22","year":2026,"title":"Network of Allegedly Fake Facebook Profiles with Purportedly AI-Generated Images Amplified Posts by Bulgaria's 'There Is Such a People' (ITN) Party","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Generative Ai Developers, Image Generation Technology Developers, Magdalena Kostova…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1466/"},{"id":"INC-01785","date":"2026-04-10","year":2026,"title":"South Africa Draft National AI Policy Reportedly Included Fictitious References Believed to Be AI Hallucinations","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Department Of Communications And Digital Technologies (south Africa), Generative Ai Developers, Government Of South…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1467/"},{"id":"INC-01706","date":"2026-04-21","year":2026,"title":"Purportedly AI-Enhanced Images of Iranian Women Protesters Were Reportedly Spread With Unverified Execution Claims","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Donald Trump, Eyal Yakoby, Image Generation Technology, Iranian Embassy In South Africa, United States Department Of…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1468/"},{"id":"INC-03034","date":"2026-04-24","year":2026,"title":"PocketOS Production Database Was Reportedly Deleted by Cursor AI Agent Running Claude Opus 4.6","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Anthropic, Anysphere, Cursor, Jer Crane, Pocketos","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1469/"},{"id":"INC-02524","date":"2026-04-27","year":2026,"title":"DisMech AI Curation Agent Reportedly Completed GitHub Issue Intended as New Contributor's Learning Task","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic, Dismech Maintainers, Monarch Initiative","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1470/"},{"id":"INC-01408","date":"2026-03-18","year":2026,"title":"Meta Internal AI Agent Reportedly Gave Advice That Allegedly Exposed Sensitive Data to Unauthorized Employees","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1471/"},{"id":"INC-00054","date":"2026-04-28","year":2026,"title":"Ahmedabad Aadhaar Fraud Racket Reportedly Used Purportedly AI-Generated Deepfakes to Change Businessman's Linked Mobile Number","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Ashish Rajendrabhai Waland, Deep Maheshbhai Gupta, Deepfake Technology Developers, Kanubhai Bahadursinh Parmar,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1472/"},{"id":"INC-02781","date":"2026-04-24","year":2026,"title":"Jasper County Student in Texas Reportedly Posted Purported AI-Generated Nude Image of Classmate on Snapchat","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1473/"},{"id":"INC-03243","date":"2026-04-28","year":2026,"title":"Suspected AI-Generated Deepfake Video Reportedly Targeted Former Chhattisgarh Chief Minister Bhupesh Baghel on Instagram","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Congresspolkhol, Deepfake Technology Developers, Information Manipulation Actors, Randomchhattisgarh","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1475/"},{"id":"INC-01371","date":"2021-06-23","year":2021,"title":"Maryland Police Allegedly Relied on Facial Recognition Lead in Wrongful Arrest and Detention of Kimberlee Williams","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Anne Arundel County Police Department, Montgomery County Police Department, Prince George's County Police Department,…","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1476/"},{"id":"INC-03199","date":"2026-01-20","year":2026,"title":"Scammers Reportedly Used AI-Generated Image of Missing Puppy Hazel to Solicit Fraudulent Vet Payment from St. Petersburg, Florida Couple","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1477/"},{"id":"INC-01752","date":"2026-04-12","year":2026,"title":"Scammers Reportedly Used AI-Generated Images of Missing Dog Archer to Solicit Fraudulent Vet Payment from Deltona, Florida Family","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Image Generation Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1478/"},{"id":"INC-02415","date":"2025-10-07","year":2025,"title":"ChatGPT-Generated Image of Nonexistent 'Homeless Man' Was Used in False St. Petersburg, Florida Burglary and Sexual Battery Reports","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Brooke Schinault, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1479/"},{"id":"INC-01712","date":"2026-05-04","year":2026,"title":"Purportedly AI-Recreated Clips from Beastie Boys' 'Sabotage' Video Reportedly Appeared in FBI Promotional Video Posted by Kash Patel","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Technology Developers, Federal Bureau Of Investigation, Kash Patel, Synthetic Video Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1480/"},{"id":"INC-03070","date":"2025-05-01","year":2025,"title":"Purported AI-Generated YouTube Network Reportedly Promoted Alberta Secession and U.S. Annexation Narratives","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"A Global Mestery, Alberta Secession Information Manipulation Actors, Canada Alert, Canada Insight, Canada Pol Brief,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1481/"},{"id":"INC-03069","date":"2026-03-23","year":2026,"title":"Purported AI-Generated Voice Reportedly Impersonated Washington Man's Daughter in $13,000 Extortion Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1482/"},{"id":"INC-02555","date":"2025-11-20","year":2025,"title":"Facebook Account Reportedly Used AI-Generated Video to Impersonate Indonesian Preacher Ustaz Ujang Bustomi in Money-Giveaway Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Pt Perusahaan Uangtunai, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1483/"},{"id":"INC-14607","date":"2026-04-08","year":2026,"title":"Purportedly AI-Generated Image Reportedly Misled Daejeon Authorities Searching for Escaped Wolf Neukgu","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Openai, Unnamed 40 Year Old Man Arrested By Daejeon Police","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1484/"},{"id":"INC-14459","date":"2026-05-05","year":2026,"title":"Guelph, Ontario, Woman Reportedly Lost $14,000 in Purported Deepfake MrBeast Cryptocurrency Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1485/"},{"id":"INC-14460","date":"2025-10-01","year":2025,"title":"AI-Themed Investment Scam Network Reportedly Used Keitaro Cloaking Across 15,500 Domains","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Faikast, Generative Ai Developers, Image Generation Technology Developers, Investment…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1486/"},{"id":"INC-14608","date":"2025-04-17","year":2025,"title":"ChatGPT Was Alleged to Have Aided Planning of Florida State University Mass Shooting","severity":"Critical","attack_vector":"other","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"Openai, Phoenix Ikner","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1487/"},{"id":"INC-01830","date":"2026-04-16","year":2026,"title":"ChatGPT Was Reportedly Consulted on Body-Disposal and Concealment Questions Before and After University of South Florida Doctoral Students Were Killed","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Hisham Abugharbieh, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1488/"},{"id":"INC-14461","date":"2025-05-20","year":2025,"title":"ChatGPT Was Reportedly Used in Planning School Stabbing in Pirkkala, Finland, That Injured Three Pupils","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ai Search Technology Developers, Openai, Pirkkala School Stabbing Suspect","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1489/"},{"id":"INC-14462","date":"2025-03-05","year":2025,"title":"ChatGPT Was Allegedly Consulted About Attack Options Before Teen Attempted to Stab Officer at Tira, Israel, Police Station","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Openai, Tira Israel Police Station Attempted Stabbing Suspect","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1490/"},{"id":"INC-14463","date":"2025-02-19","year":2025,"title":"ChatGPT Use Was Reportedly Cited in Delusional State Before Homicide and Assault in Readfield, Maine","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Openai, Samuel Whittemore","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1491/"},{"id":"INC-00264","date":"2026-02-28","year":2026,"title":"Purportedly AI-Enabled Targeting System Was Reportedly Implicated in Deadly U.S. Strike on Iranian Primary School","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"Anthropic, Palantir, United States Central Command, United States Department Of Defense, United States Military","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1492/"},{"id":"INC-00455","date":"2026-03-17","year":2026,"title":"Gemini and Grok Reportedly Misidentified Authentic Minab School-Strike Graveyard Photo as Unrelated Disaster Imagery","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Google, Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1493/"},{"id":"INC-00498","date":"2026-02-28","year":2026,"title":"Purportedly AI-Manipulated Satellite Image Reportedly Claimed Iranian Strike Destroyed U.S. Radar in Qatar","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Deepfake Technology, Generative Ai Developers, Image Generation Technology Developers, Information Manipulation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1494/"},{"id":"INC-14464","date":"2026-03-15","year":2026,"title":"Grok Reportedly Misclassified Netanyahu Proof-of-Life Video as AI-Generated Deepfake Amid Iran War Rumors","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Xai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1495/"},{"id":"INC-01320","date":"2026-05-13","year":2026,"title":"Hidden Prompt Injection in Brazilian Labor-Court Petition Reportedly Tried to Manipulate Galileu","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"3a Vara Do Trabalho De Parauapebas, Brazilian Labor Courts, Conselho Superior Da Justica Do Trabalho, Judicial System…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1497/"},{"id":"INC-01822","date":"2026-05-06","year":2026,"title":"Claude Console Reportedly Generated Phantom Legal Quotations in Trump Layoffs Court Filing","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Anthropic, Binnall Law Group, Jason Greaves","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1499/"},{"id":"INC-07828","date":"2025-05-19","year":2025,"title":"New Jersey Man Cornelius Shannon Allegedly Published Hundreds of AI-Generated Deepfake Pornography Albums in TAKE IT DOWN Act Case","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Cornelius Shannon, Deepfake Creators, Deepfake Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1500/"},{"id":"INC-14465","date":"2025-05-01","year":2025,"title":"Scammers Reportedly Used Real-Time Deepfake Video to Impersonate Veriff CEO Kaarel Kotkas in WhatsApp Fraud Attempt","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1502/"},{"id":"INC-07786","date":"2026-05-15","year":2026,"title":"Purported AI Name-Reading System Reportedly Skipped and Misannounced Graduates at Arizona's Glendale Community College Commencement","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Ai Name Reading System Developers, Community Colleges, Educational Communities, Glendale Community College,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1503/"},{"id":"INC-07808","date":"2026-05-12","year":2026,"title":"Nonfiction Book 'The Future of Truth' Reportedly Included AI-Generated and Misattributed Quotations","severity":"High","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Anthropic, Authors, Openai, Steven Rosenbaum, Writers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1504/"},{"id":"INC-07887","date":"2026-05-24","year":2026,"title":"Scammers Reportedly Used AI-Cloned Daughter's Voice to Defraud Bay Area Mother in Fake Kidnapping Call","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Fake Kidnapping Scammers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1505/"},{"id":"INC-07737","date":"2025-05-01","year":2025,"title":"ChatGPT Was Alleged to Have Reinforced Pittsburgh Man's Stalking and Threats Against Women","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Brett Michael Dadig, Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1506/"},{"id":"INC-14466","date":"2026-05-30","year":2026,"title":"COEMPT Quality Assurance Engineers Allegedly Violated Indian CBSE Student Data Privacy Rights by Processing It with Google Gemini","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Central Board Of Secondary Education, Coempt Eduteck, Google, Government Of India, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1507/"},{"id":"INC-14467","date":"2026-05-31","year":2026,"title":"Italian Mediaset Journalist Safiria Leccese's Image Was Reportedly Used in a Purportedly AI-Generated Fake Loan Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1508/"},{"id":"INC-14468","date":"2020-01-01","year":2020,"title":"Self-Employed Somerset Father Wayne Luxon Reportedly Lost £140,000 After Facebook Deepfake of Martin Lewis Promoted Crypto Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Scammers, Synthetic Audio Generation Technology Developers, Unknown Cryptocurrency…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1509/"},{"id":"INC-14469","date":"2026-05-31","year":2026,"title":"Meta AI Support Bot Reportedly Enabled Takeovers of High-Profile Instagram Accounts","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Chatbot Developers, Hackers, Instagram, Large Language Model Developers, Meta","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1510/"},{"id":"INC-12979","date":"2026-01-30","year":2026,"title":"Grok Reportedly Generated Images After X Users Asked It to Unredact Epstein-File Photos of Children and Women","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Grok Users, Image Generation Technology Developers, Large Language Model Developers, X (twitter),…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1511/"},{"id":"INC-14470","date":"2026-05-31","year":2026,"title":"The Sydney Morning Herald and The Age Removed an Opinion Article After Undisclosed Copilot Use","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Cath Ellis, Chatbot Developers, Educational Communities, Large Language Model Developers, Microsoft, Western Sydney…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1512/"},{"id":"INC-14471","date":"2025-08-26","year":2025,"title":"Dimal Basha's Likeness Was Reportedly Used in Purportedly Fake AI-Generated Video After Kosovo Parliament Speaker Election","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Information Manipulation Actors, Information Manipulation Actors In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1513/"},{"id":"INC-14472","date":"2025-11-23","year":2025,"title":"Purportedly AI-Generated Airport Videos Reportedly Showed Kosovo Diaspora Voters Supporting Albin Kurti","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Information Manipulation Actors, Synthetic Audio Generation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1515/"},{"id":"INC-14473","date":"2025-12-06","year":2025,"title":"NoFilterNews Reportedly Posted AI-Generated TikTok Videos Styled as Kosovo Election TV News","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Information Manipulation Actors, Information Manipulation Actors In Kosovo, Nofilternews, Openai, Pro Vetevendosje…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1517/"},{"id":"INC-14474","date":"2025-12-27","year":2025,"title":"Kosovo Public Broadcaster RTK and Journalist Gëzim Bimbashi Were Reportedly AI-Impersonated in Alleged Fake Joint-Cure Scam Video","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers, Scammers In Kosovo, Synthetic Audio Generation Technology…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1518/"},{"id":"INC-14475","date":"2026-05-05","year":2026,"title":"Purportedly AI-Generated Videos Reportedly Fabricated Conflict Between Kosovo Leaders Albin Kurti and Vjosa Osmani","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Information Manipulation Actors, Information Manipulation Actors In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1519/"},{"id":"INC-14476","date":"2026-05-11","year":2026,"title":"Reported AI-Generated Videos Depicted Former Kosovo President Vjosa Osmani and Other Public Figures in Allegedly False Compromising Scenes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Image Generation Technology Developers, Information Manipulation…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1520/"},{"id":"INC-14477","date":"2026-05-11","year":2026,"title":"Reported AI-Generated Videos Purported to Show Kosovo Diaspora Mobilization for Vetëvendosje Before Snap Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Information Manipulation Actors, Information Manipulation Actors In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1521/"},{"id":"INC-14478","date":"2026-05-13","year":2026,"title":"Reported AI-Generated Videos Allegedly Posed as Kosovo Election Vox Pops Before June 7, 2026 Vote","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Gazeta Bota, Information Manipulation Actors, Information…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1522/"},{"id":"INC-14479","date":"2026-05-15","year":2026,"title":"Purportedly AI-Manipulated Videos Reportedly Targeted Former Kosovo MP Paris Guri and LDK Youth Members Before Snap Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Information Manipulation Actors, Information Manipulation Actors In…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1524/"},{"id":"INC-14480","date":"2025-09-05","year":2025,"title":"Purported Deepfake Video Reportedly Impersonated Former Mongolian Deputy Prime Minister Amarsaikhan Sainbuyan in Investment Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Scammers, Scammers In Mongolia, Synthetic Audio Generation Technology Developers, Synthetic Media…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1525/"},{"id":"INC-14481","date":"2026-06-04","year":2026,"title":"Reddit Scam Ads Reportedly Used Deepfake News Segments and Cloned Media Sites to Promote Allegedly Fake AI Investment Platforms","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cloned News Site Operators, Deepfake Technology Developers, Investment Scam Operators, Malvertising Actors, Reddit Ad…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1526/"},{"id":"INC-13028","date":"2026-06-08","year":2026,"title":"Purported Deepfake Ads Reportedly Fabricated BBC Question Time Confrontations Between Andrew Bailey and Nigel Farage","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Image Generation Technology Developers, Investment Scam Operators, Malvertising…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1527/"},{"id":"INC-14482","date":"2026-05-30","year":2026,"title":"Reported AI-Generated Image Portrayed Vetëvendosje Official Dejona Mihali Meeting Aleksandar Vučić","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Deepfake Technology Developers, Gjithqka Rreth Politikes (facebook), Image Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1531/"},{"id":"INC-13338","date":"2025-07-01","year":2025,"title":"Reported Deepfake Video Impersonating Mark Carney Used in Nearly $1M Cryptocurrency Scam Targeting Ontario Senior","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cryptocurrency Scammers, Deepfake Technology Developers, Scammers, Scammers Impersonating Mark Carney, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1532/"},{"id":"INC-13025","date":"2025-11-05","year":2025,"title":"Four Lawyers Reportedly Sanctioned After Purportedly AI-Related Hallucinated Citations Appeared in Withers v. City of Aberdeen","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Ai Research Tool Developers, First Drafts, Kathleen M. Wilson, Kathryn Y. Williams, Large Language Model Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1533/"},{"id":"INC-13073","date":"2026-05-01","year":2026,"title":"Google Alleged Outsider Enterprise Used Gemini to Create Phishing Sites for Text-Message Scams","severity":"Critical","attack_vector":"phishing","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Cybercriminals, Cybercriminals In China, Google, Google Deepmind, Large Language Model Developers, Outsider…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1534/"},{"id":"INC-13066","date":"2025-07-02","year":2025,"title":"OpenAI Allegedly Failed to Intervene in ChatGPT Conversations Preceding Montreal Web Developer Alice Carrier's Suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1535/"},{"id":"INC-00134","date":"2025-12-06","year":2025,"title":"City of Zhuzhou in Hunan Suspended Hellobike Robotaxi Service After Vehicle Struck Two Pedestrians","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Baidu, Hello Inc. (formerly Hellobike),…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1538/"},{"id":"INC-12977","date":"2025-08-26","year":2025,"title":"Zoox Robotaxi Crossed Into Opposing Lane and Stopped Near Oncoming Traffic","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Robotaxi Operators, Zoox","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1539/"},{"id":"INC-12978","date":"2026-01-07","year":2026,"title":"Waymo Robotaxi Reportedly Entered Phoenix Light-Rail Tracks, Prompting Passenger to Exit","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Robotaxi Operators, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1541/"},{"id":"INC-01398","date":"2026-02-23","year":2026,"title":"OpenClaw Agent Reportedly Tried to Delete Meta AI Alignment Director Summer Yue's Emails Despite Stop Commands","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"Ai Agent System Deployers, Ai Agent System Developers, Peter Steinberger, Summer Yue","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1542/"},{"id":"INC-02076","date":"2026-03-01","year":2026,"title":"Waymo Robotaxi Reportedly Obstructed Ambulance Responding to Austin Mass Shooting","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Robotaxi Operators, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1543/"},{"id":"INC-02070","date":"2026-04-20","year":2026,"title":"Waymo Robotaxi Reportedly Entered Flooded San Antonio Roadway and Was Swept Into Waterway","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Robotaxi Operators, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1544/"},{"id":"INC-13040","date":"2024-08-26","year":2024,"title":"Florida Police Reportedly Wrongfully Arrested Commercial Crabber Robert Dillon After Allegedly False Facial Recognition Match","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Facial Recognition System Deployers, Facial Recognition System Developers, Jacksonville Beach Police Department,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1545/"},{"id":"INC-12976","date":"2023-02-03","year":2023,"title":"Google Android Earthquake Alerts System Reportedly Underestimated Kahramanmaraş Earthquake and Failed to Send Urgent Warnings to Millions","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Earthquake Early Warning System Deployers, Earthquake Early Warning System Developers, Google","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1546/"},{"id":"INC-08004","date":"2026-04-11","year":2026,"title":"Waymo Robotaxis Reportedly Entered Closed Freeway Construction Zones in Arizona and California","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Automated Driving System Deployers, Automated Driving System Developers, Robotaxi Operators, Waymo","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1547/"},{"id":"INC-14483","date":"2026-06-17","year":2026,"title":"Purported Deepfake of Taoiseach Micheál Martin Reportedly Promoted Quantum AI Investment Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Quantum Ai Scammers, Scammers, Scammers Impersonating Micheal Martin, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1549/"},{"id":"INC-00861","date":"2026-06-17","year":2026,"title":"Purported AI-Generated Advertisements Reportedly Falsely Depicted Lee Ji-hye Endorsing Food and Clothing Products","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Online Advertisers, Scammers, Scammers Impersonating Lee Ji Hye, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1551/"},{"id":"INC-14609","date":"2026-06-19","year":2026,"title":"Tesla Driver Reportedly Said Driver-Assistance Mode Was Engaged During Fatal Texas Home Crash","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Automated Driving System Developers, Drivers, Michael Butler, Tesla","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1552/"},{"id":"INC-02201","date":"2025-06-30","year":2025,"title":"Purported AI-Manipulated Video of Nirmala Sitharaman Reportedly Promoted High-Return Investment Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Investment Scam Operators, Scammers, Scammers Impersonating Nirmala Sitharaman,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1553/"},{"id":"INC-14217","date":"2023-12-24","year":2023,"title":"NewsBreak Reportedly Published AI-Assisted Articles Containing Purportedly False Local and Community-Service Information","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"News Organizations, Newsbreak","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1554/"},{"id":"INC-00196","date":"2026-05-04","year":2026,"title":"X User Reportedly Used Morse Code Prompt to Induce Grok-Linked Trading Bot to Transfer $200,000 in Tokens","severity":"Critical","attack_vector":"other","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05","ASI09"],"cve_ids":[],"affected":"@ilhamrfliansyh (x), Ai Agent System Developers, Bankr, Chatbot Developers, Cryptocurrency Service Providers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1556/"},{"id":"INC-13303","date":"2025-01-17","year":2025,"title":"Former New York City Council Candidate Jonathan Rinaldi Allegedly Used AI to Create False Endorsements and Fabricated News Reports","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Deepfake Technology Developers, Face Swapping Technology Developers, Google, Image Generation Technology Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1557/"},{"id":"INC-13265","date":"2022-06-22","year":2022,"title":"Kalibrate Fuel Pricing Allegedly Enabled California Gas Station Operators to Coordinate Higher Pump Prices","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"7 Eleven, Albertsons Companies, Algorithmic Pricing System Developers, Bp Products North America, Circle K, Eg…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1559/"},{"id":"INC-12996","date":"2026-04-15","year":2026,"title":"Pennsylvania Man Allegedly Used Grok to Create and Possess Purportedly AI-Generated Child Sexual Abuse Material","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Ai Generated Csam Creators, Chatbot Developers, Chatbot Users, Deepfake Creators, Deepfake Technology Developers, Grok…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1562/"},{"id":"INC-13080","date":"2025-10-28","year":2025,"title":"KPMG Report Allegedly Included Hallucinated Citations and Inaccurate Agentic AI Case Studies","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Ai Research Tool Developers, Big Four Consulting Firms, Generative Ai Developers, Kpmg, Large Language Model Developers","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1563/"},{"id":"INC-14486","date":"2025-10-25","year":2025,"title":"Purported Deepfakes of Public Figures and Celebrities Reportedly Used to Market Honey-Based Supplements as Alzheimer's Treatments","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Deepfake Creators, Deepfake Technology Developers, Scammers, Scammers Impersonating Anderson Cooper, Scammers…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1564/"},{"id":"INC-14487","date":"2025-11-27","year":2025,"title":"Indore Resident Reportedly Lost ₹1.83 Lakh (~$2,000) After AI-Generated Voice Impersonated Relative","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Cybercriminals In India, Deepfake Technology Developers, Scammers, Scammers In India, Synthetic Audio…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1566/"},{"id":"INC-00159","date":"2026-03-22","year":2026,"title":"Serve Robotics Delivery Robot Reportedly Crashed into Chicago Bus Shelter After Failing to Detect Glass","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Autonomous Mobile Robot Developers, Autonomous Mobile Robot Operators, Delivery Robot Developers, Delivery Robot…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1567/"},{"id":"INC-14317","date":"2025-03-28","year":2025,"title":"GPT-4o Allegedly Reinforced California Man Michael Lines's Delusions Before Suicide Attempt","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Large Language Model Developers, Openai","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1569/"},{"id":"INC-14339","date":"2026-07-03","year":2026,"title":"Purported Deepfake Impersonating Dubai Crown Prince Reportedly Used to Defraud Filipino Domestic Worker","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Cybercriminals, Deepfake Technology Developers, Employment Scammers, Romance Scammers, Scammers, Scammers In Nigeria,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1570/"},{"id":"INC-08072","date":"2025-10-20","year":2025,"title":"California Immigration Attorneys Reportedly Sanctioned Over Briefs Containing Probable Hallucinations in LNU v. Blanche","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Large Language Model Developers, Law Firms, Legal Professionals, Sethi Law Group","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1571/"},{"id":"INC-14328","date":"2024-08-28","year":2024,"title":"National Company Law Tribunal Reportedly Relied on AI-Hallucinated Precedents in Pooja Ramesh Singh v. Jammu and Kashmir Bank Ltd","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Ai Research Tool Developers, Courts, Large Language Model Developers, National Company Law Tribunal","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1573/"},{"id":"INC-14493","date":"2025-01-24","year":2025,"title":"Lawyer in Amarsingh v. Frontier Airlines Sanctioned Over Court-Identified ChatGPT Citation Errors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ai Research Tool Developers, Chatbot Developers, Kusmin L. Amarsingh, Large Language Model Developers, Lawyers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1577/"},{"id":"INC-14302","date":"2026-07-01","year":2026,"title":"LLM-Driven Ransomware Operator Dubbed JADEPUFFER Reportedly Targeted Production Database","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Agentic Threat Actors, Ai Agent System Developers, Cybercriminals, Jadepuffer, Large Language Model Developers,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1578/"},{"id":"INC-00001","date":"2026-05-01","year":2026,"title":"Purportedly AI-Generated Videos Reportedly Impersonated Ghanaian President John Mahama to Solicit Money and Personal Data","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"Ali Lucky, Anipah Jonathan, Bishop Esiri, Danu Peter, Deepfake Technology Developers, Dzamesi Bright Kofi, Edwin Edos,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1579/"},{"id":"INC-13042","date":"2026-06-10","year":2026,"title":"PRC-Linked Accounts Reportedly Used ChatGPT in Covert Campaigns Targeting U.S. AI Policy Debates","severity":"Critical","attack_vector":"other","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"Chatbot Developers, Chatgpt Users, Image Generation Technology Developers, Information Manipulation Actors,…","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://incidentdatabase.ai/cite/1580/"},{"id":"INC-02382","date":"2025-06","year":2025,"title":"CamoLeak (CVE-2025-59145) prompt injection leaks private code via GitHub Copilot Chat","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"GitHub Copilot Chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code"},{"id":"INC-02981","date":"2025-02","year":2025,"title":"OmniGPT alleged breach: 30K users, 34M messages exposed","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"OmniGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://hackread.com/omnigpt-ai-chatbot-breach-hacker-leak-user-data-messages/"},{"id":"INC-04357","date":"2024-05","year":2024,"title":"Wiz finds Replicate tenant-isolation flaw enabling cross-tenant model & data access","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"Replicate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.wiz.io/blog/wiz-research-discovers-critical-vulnerability-in-replicate"},{"id":"INC-04803","date":"2023-07-01","year":2023,"title":"PoisonGPT: Mithril Security demonstrates LLM supply-chain disinfo via Hugging Face typosquat","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM05","LLM07"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face ecosystem","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/"},{"id":"INC-02847","date":"2025-08","year":2025,"title":"Malicious Hugging Face model impersonating OpenAI release hits 244K downloads","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.csoonline.com/article/4169407/malicious-hugging-face-model-masquerading-as-openai-release-hits-244k-downloads.html"},{"id":"INC-05000","date":"2023-07","year":2023,"title":"WormGPT and FraudGPT criminal LLM-as-a-service emerge on dark web","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"Criminal use against various organizations","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://incidentdatabase.ai/entities/fraudgpt/"},{"id":"INC-03049","date":"2025-08","year":2025,"title":"PromptLock: first AI-powered ransomware (PoC) using local gpt-oss-20b","severity":"Medium","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"PoC / research samples","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/"},{"id":"INC-03489","date":"2024-01","year":2024,"title":"AI-generated Biden robocall suppressing votes in New Hampshire primary","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"New Hampshire voters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://perkinscoie.com/insights/update/fcc-fines-telecom-transmitted-ai-generated-deepfake-robocalls-impersonating"},{"id":"INC-02681","date":"2025-11","year":2025,"title":"HackedGPT: Tenable discloses 7 ChatGPT vulnerabilities enabling silent exfiltration","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM08"],"owasp_asi":["ASI01","ASI06","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.tenable.com/blog/hackedgpt-novel-ai-vulnerabilities-open-the-door-for-private-data-leakage"},{"id":"INC-00810","date":"2026-03","year":2026,"title":"Claude Chrome Extension zero-click XSS prompt injection via any website","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Anthropic Claude Chrome Extension","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2026/03/claude-extension-flaw-enabled-zero.html"},{"id":"INC-00606","date":"2026-03","year":2026,"title":"Anthropic leaks Claude source code in unsecured data store","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM08"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Anthropic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.axios.com/2026/03/31/anthropic-leaked-source-code-ai"},{"id":"INC-02319","date":"2025-06","year":2025,"title":"Anthropic finds blackmail behavior in 16 models when facing shutdown","severity":"High","attack_vector":"agent-hijack","owasp_llm":["LLM03"],"owasp_asi":["ASI01","ASI09","ASI10"],"cve_ids":[],"affected":"Multiple frontier LLMs (red-team)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anthropic.com/research/agentic-misalignment"},{"id":"INC-08181","date":"2023-05-01","year":2023,"title":"ChatGPT plugin/cross-plugin data exfiltration via Markdown image injection (Embrace The Red)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM08","LLM10"],"owasp_asi":["ASI01","ASI02","ASI06","ASI07","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT plugins","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://embracethered.com/blog/posts/2023/advanced-plugin-data-exfiltration-trickery/"},{"id":"INC-02995","date":"2025-10","year":2025,"title":"OpenAI ChatGPT Atlas browser vulnerable to prompt injection via crafted URLs and memory poisoning","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI02","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT Atlas","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2025/10/chatgpt-atlas-browser-can-be-tricked-by.html"},{"id":"INC-00825","date":"2026-04","year":2026,"title":"Claude Code, Gemini CLI, GitHub Copilot agents hijacked via PR/issue comment prompt injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Anthropic, Google, Microsoft GitHub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.securityweek.com/claude-code-gemini-cli-github-copilot-agents-vulnerable-to-prompt-injection-via-comments/"},{"id":"INC-00663","date":"2026-02","year":2026,"title":"Autonomous AI agent breaches McKinsey internal AI platform in 2 hours","severity":"High","attack_vector":"agent-hijack","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI01","ASI02","ASI10"],"cve_ids":[],"affected":"McKinsey","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.bankinfosecurity.com/autonomous-agent-hacked-mckinseys-ai-in-2-hours-a-31007"},{"id":"INC-01157","date":"2026-02","year":2026,"title":"HackerBot Claw campaign: autonomous AI agent probes CI/CD across open-source repos","severity":"High","attack_vector":"agent-hijack","owasp_llm":["LLM03","LLM04"],"owasp_asi":["ASI01","ASI02","ASI10"],"cve_ids":[],"affected":"Datadog and other OSS projects","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.datadoghq.com/blog/engineering/stopping-hackerbot-claw-with-bewaire/"},{"id":"INC-00832","date":"2026-04","year":2026,"title":"Claude-powered Cursor AI agent deletes production database in 9 seconds","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"PocketOS","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.cxtoday.com/security-privacy-compliance/claude-powered-cursor-ai-agent-deletes-an-entire-company-database-in-9-seconds-is-your-customer-data-secure/"},{"id":"INC-00602","date":"2026-05-07","year":2026,"title":"Anthropic Claude used in attempted compromise of Mexican water utility","severity":"Critical","attack_vector":"agent-hijack","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Mexican water utility","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.cybersecuritydive.com/news/anthropics-claude-compromise-mexican-water-utility/819710/"},{"id":"INC-03050","date":"2025-09","year":2025,"title":"Promptware: Google Calendar invitations as prompt-injection vector for Gemini","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"Google Gemini / Workspace","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://sites.google.com/view/invitation-is-all-you-need"},{"id":"INC-04001","date":"2024-12","year":2024,"title":"Microsoft Copilot vulnerability exposes Fortune 500 data (Lasso Security)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM09"],"owasp_asi":["ASI03","ASI06"],"cve_ids":[],"affected":"Microsoft Copilot / Fortune 500","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.lasso.security/blog/lasso-major-vulnerability-in-microsoft-copilot"},{"id":"INC-02974","date":"2025-07","year":2025,"title":"NVIDIAScape (CVE-2025-23266) NVIDIA AI vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"NVIDIA AI infrastructure","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape"},{"id":"INC-02919","date":"2025-09","year":2025,"title":"Model Namespace Reuse supply-chain attack (Palo Alto Unit 42)","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face / model hub users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://unit42.paloaltonetworks.com/model-namespace-reuse/"},{"id":"INC-02453","date":"2025-11","year":2025,"title":"ClawHub / OpenClaw skill registry infiltrated with 341 malicious agent skills","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM03","LLM04"],"owasp_asi":["ASI02","ASI04","ASI10"],"cve_ids":[],"affected":"OpenClaw / ClawHub users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thenextweb.com/news/hugging-face-clawhub-malware-ai-supply-chain"},{"id":"INC-04019","date":"2024-02","year":2024,"title":"Moffatt v. Air Canada legal precedent: AI chatbot misrepresentation liability","severity":"Low","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Air Canada","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-air-canada-misrepresentation-ai-chatbot"},{"id":"INC-04631","date":"2023-08","year":2023,"title":"EEOC v. iTutorGroup: first AI hiring age-discrimination settlement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM05"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"iTutorGroup","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://news.bloomberglaw.com/daily-labor-report/eeoc-settles-first-of-its-kind-ai-bias-lawsuit-for-365-000"},{"id":"INC-03378","date":"2025-12","year":2025,"title":"WIRED/Indicator: 90 schools, 600+ students worldwide targeted with AI deepfake nudes","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"K-12 students globally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.techbuzz.ai/articles/deepfake-nudes-hit-90-schools-the-ai-crisis-no-one-saw-coming"},{"id":"INC-03809","date":"2024-08","year":2024,"title":"GitHub Copilot reproduces hardcoded secrets from training data (CUHK study)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"GitHub Copilot users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blog.gitguardian.com/yes-github-copilot-can-leak-secrets/"},{"id":"INC-04395","date":"2023-04","year":2023,"title":"AI voice cloning used in virtual kidnapping scam targeting U.S. families","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"U.S. families","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.cnn.com/2023/04/29/us/ai-scam-calls-kidnapping-cec/index.html"},{"id":"INC-03650","date":"2024-09","year":2024,"title":"ChatGPT memory persistence prompt injection (Embrace The Red)","severity":"High","attack_vector":"memory-poisoning","owasp_llm":["LLM01","LLM02","LLM09"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT (Memory)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2023/openai-custom-malware-gpt/"},{"id":"INC-03964","date":"2024-01","year":2024,"title":"Malicious custom GPT 'Psychology' exfiltrates user chats via API","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"OpenAI GPT Store users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/html/2401.09075v1"},{"id":"INC-03990","date":"2024-06","year":2024,"title":"Microsoft 365 Copilot data exposure via over-permissive SharePoint indexing","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM09"],"owasp_asi":["ASI03","ASI06"],"cve_ids":[],"affected":"Microsoft 365 Copilot customers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://prompt.security/blog/securing-enterprise-data-in-the-face-of-github-copilot-vulnerabilities"},{"id":"INC-03703","date":"2024-06","year":2024,"title":"Deepfake CEO fraud surge: FBI flags as fastest-growing US enterprise fraud category","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"U.S. enterprises","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cybelangel.com/blog/deepfake-ceo-fraud-how-voice-cloning-targets-us-executives/"},{"id":"INC-04010","date":"2024-12","year":2024,"title":"MIT AI Risk Tracker captures escalating AI-incident counts in 2024-2025","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Multiple","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://airisk.mit.edu/ai-incident-tracker"},{"id":"INC-04975","date":"2023-07","year":2023,"title":"Universal and Transferable Adversarial Attacks on Aligned Language Models (GCG)","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Vicuna, Llama-2-Chat, GPT-3.5/4, Claude, Bard, Pythia, Falcon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2307.15043"},{"id":"INC-04474","date":"2023-10","year":2023,"title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned LLMs","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Llama-2, Vicuna, GPT-3.5, GPT-4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.04451"},{"id":"INC-04795","date":"2023-10","year":2023,"title":"PAIR: Jailbreaking Black-Box LLMs in Twenty Queries","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Vicuna, Gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.08419"},{"id":"INC-04962","date":"2023-12","year":2023,"title":"Tree of Attacks with Pruning (TAP): Automated Jailbreaking of Black-Box LLMs","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4 Turbo, GPT-4o, GPT-3.5, Vicuna, Llama-2, LlamaGuard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2312.02119"},{"id":"INC-03873","date":"2024-01","year":2024,"title":"How Johnny Can Persuade LLMs to Jailbreak Them (PAP)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Llama-2-7b-Chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2401.06373"},{"id":"INC-03587","date":"2024-02","year":2024,"title":"ArtPrompt: ASCII Art-Based Jailbreak of Aligned LLMs","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Gemini, Claude, Llama-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.11753"},{"id":"INC-03786","date":"2024-10","year":2024,"title":"FlipAttack: Jailbreaking LLMs via Flipping","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4o, GPT-4, Claude, Gemini, Llama-3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.02832"},{"id":"INC-04666","date":"2023-08","year":2023,"title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher (CipherChat)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4, GPT-3.5, Claude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2308.06463"},{"id":"INC-04727","date":"2023-10","year":2023,"title":"Low-Resource Languages Jailbreak GPT-4","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4, GPT-3.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.02446"},{"id":"INC-04770","date":"2023-10","year":2023,"title":"Multilingual Jailbreak Challenges in Large Language Models","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ChatGPT, GPT-4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.06474"},{"id":"INC-04669","date":"2023-09","year":2023,"title":"GPTFUZZER: Red Teaming LLMs with Auto-Generated Jailbreak Prompts","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ChatGPT, Llama-2, Bard, Claude-2, PaLM2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2309.10253"},{"id":"INC-04735","date":"2023-07","year":2023,"title":"MasterKey: Automated Jailbreak Across Multiple LLM Chatbots","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Bing Chat, Bard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2307.08715"},{"id":"INC-04618","date":"2023-11","year":2023,"title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Falcon, Vicuna-v1.5, Llama-2, GPT-3.5, GPT-4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.03191"},{"id":"INC-04626","date":"2023-08","year":2023,"title":"Do Anything Now: Characterizing In-the-Wild Jailbreak Prompts","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2308.03825"},{"id":"INC-03593","date":"2024-10","year":2024,"title":"AutoDAN-Turbo: Lifelong Agent for Strategy Self-Exploration","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4-1106-turbo, GPT-4o, Claude, Gemini, Llama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.05295"},{"id":"INC-03445","date":"2024-04","year":2024,"title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Llama-2, Vicuna, GPT-3.5, GPT-4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2404.16873"},{"id":"INC-03557","date":"2024-04","year":2024,"title":"AmpleGCG: Universal Generative Model of Adversarial Suffixes","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Llama-2-7B-Chat, Vicuna-7B, GPT-3.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2404.07921"},{"id":"INC-03917","date":"2024-04","year":2024,"title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Claude, Llama-2/3, Gemma, Mistral, Phi-3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2404.02151"},{"id":"INC-03607","date":"2024-12","year":2024,"title":"Best-of-N Jailbreaking","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4o, Claude 3.5 Sonnet, Gemini, Llama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2412.03556"},{"id":"INC-04680","date":"2023-06","year":2023,"title":"HouYi: Prompt Injection Attack Against LLM-Integrated Applications","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Notion, 31 commercial LLM applications","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2306.05499"},{"id":"INC-04499","date":"2023-12","year":2023,"title":"BIPIA: Benchmarking Indirect Prompt Injection Attacks on LLMs","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"25 commercial and open-source LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2312.14197"},{"id":"INC-04913","date":"2023-11","year":2023,"title":"Tensor Trust: Prompt Injection Attacks from an Online Game","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, Claude, deployed LLM apps","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.01011"},{"id":"INC-04646","date":"2023-08","year":2023,"title":"From Prompt Injections to SQL Injection Attacks (P2SQL)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"LangChain LLM apps, SQL backends","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2308.01990"},{"id":"INC-03446","date":"2024-10","year":2024,"title":"AgentHarm: Benchmark for Measuring Harmfulness of LLM Agents","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI06","ASI08"],"cve_ids":[],"affected":"GPT-4o, GPT-4o-mini, Claude, Mistral Large 2, Gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.09024"},{"id":"INC-03906","date":"2024-03","year":2024,"title":"InjecAgent: Benchmarking Indirect Prompt Injection in Tool-Integrated LLM Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"30 LLM agents including GPT-4, Claude, Llama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2403.02691"},{"id":"INC-03886","date":"2024-10","year":2024,"title":"Imprompter: Tricking LLM Agents into Improper Tool Use","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"Mistral LeChat, ChatGLM","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.14923"},{"id":"INC-04354","date":"2024-02","year":2024,"title":"WIPI: A New Web Threat for LLM-Driven Web Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"ChatGPT plugins, Web GPTs, open-source web agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.16965"},{"id":"INC-03746","date":"2024-09","year":2024,"title":"EIA: Environmental Injection Attack on Generalist Web Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"SeeAct, WebArena, generalist web agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2409.11295"},{"id":"INC-03448","date":"2024-07","year":2024,"title":"AgentPoison: Red-teaming LLM Agents via Memory/RAG Poisoning","severity":"Critical","attack_vector":"backdoor","owasp_llm":["LLM05","LLM09"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"RAG-based driving agent, ReAct, EHRAgent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2407.12784"},{"id":"INC-03734","date":"2024-06","year":2024,"title":"Dissecting Adversarial Robustness of Multimodal LM Agents","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V web agents, CLIP-based VLM agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2406.12814"},{"id":"INC-04686","date":"2023-09","year":2023,"title":"Image Hijacks: Adversarial Images Control Generative Models at Runtime","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"LLaVA, MiniGPT-4, BLIP-2, multimodal LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2309.00236"},{"id":"INC-04991","date":"2023-06","year":2023,"title":"Visual Adversarial Examples Jailbreak Aligned LLMs","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V, MiniGPT-4, InstructBLIP, LLaVA","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2306.13213"},{"id":"INC-05819","date":"2021-03","year":2021,"title":"Reading Isn't Believing: Typographic Attacks on Multimodal Neurons (CLIP)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"CLIP, DALL-E, downstream multimodal models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2103.10480"},{"id":"INC-04706","date":"2023-11","year":2023,"title":"Jailbreaking GPT-4V via Self-Adversarial Attacks with System Prompts (SASP)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.09127"},{"id":"INC-07596","date":"2014-12","year":2014,"title":"Explaining and Harnessing Adversarial Examples (FGSM)","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Image classifiers (MNIST, CIFAR), deep neural networks","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1412.6572"},{"id":"INC-07534","date":"2016-08","year":2016,"title":"Towards Evaluating the Robustness of Neural Networks (C&W)","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"MNIST, CIFAR-10, ImageNet classifiers; defensive distillation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1608.04644"},{"id":"INC-07447","date":"2017-06","year":2017,"title":"Towards Deep Learning Models Resistant to Adversarial Attacks (PGD)","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"MNIST, CIFAR-10 classifiers and beyond","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1706.06083"},{"id":"INC-07540","date":"2016-10","year":2016,"title":"Universal Adversarial Perturbations","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ImageNet classifiers (VGG, GoogLeNet, ResNet)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1610.08401"},{"id":"INC-07362","date":"2017-12","year":2017,"title":"Adversarial Patch","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"VGG16, ImageNet classifiers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1712.09665"},{"id":"INC-07438","date":"2017-07","year":2017,"title":"Robust Physical-World Attacks on Deep Learning Visual Classification","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Road sign classifiers, LISA-CNN, GTSRB","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1707.08945"},{"id":"INC-07150","date":"2019-08","year":2019,"title":"AdvHat: Real-World Adversarial Attack on ArcFace Face ID","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ArcFace, LResNet100E-IR face recognition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1908.08705"},{"id":"INC-07501","date":"2016-08","year":2016,"title":"Hidden Voice Commands","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Google Now, Sphinx, smartphone voice assistants","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/carlini"},{"id":"INC-07287","date":"2018-01","year":2018,"title":"CommanderSong: Practical Adversarial Voice Recognition","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Kaldi ASR, voice assistants","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1801.08535"},{"id":"INC-07388","date":"2017-10","year":2017,"title":"DolphinAttack: Inaudible Voice Commands","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Siri, Alexa, Google Now, Cortana, S Voice, Audi navigation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1708.09537"},{"id":"INC-07227","date":"2019-01","year":2019,"title":"SirenAttack: Adversarial Audio for End-to-End Acoustic Systems","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"DeepSpeech, speech command and speaker recognition systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1901.07846"},{"id":"INC-07506","date":"2016-10","year":2016,"title":"Membership Inference Attacks Against Machine Learning Models","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Google Prediction API, Amazon ML, generic classifiers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1610.05820"},{"id":"INC-07525","date":"2016-08","year":2016,"title":"Stealing Machine Learning Models via Prediction APIs","severity":"High","attack_vector":"model-extraction","owasp_llm":["LLM06"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"BigML, Amazon Machine Learning, generic prediction APIs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer"},{"id":"INC-04855","date":"2023-11","year":2023,"title":"Scalable Extraction of Training Data from (Production) Language Models","severity":"Critical","attack_vector":"membership-inference","owasp_llm":["LLM02","LLM06"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"ChatGPT, GPT-Neo, Pythia, LLaMA, Falcon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.17035"},{"id":"INC-05596","date":"2021-08","year":2021,"title":"Extracting Training Data from Large Language Models (GPT-2)","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"GPT-2, large language models in general","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting"},{"id":"INC-07568","date":"2015-10","year":2015,"title":"Model Inversion Attacks That Exploit Confidence Information","severity":"High","attack_vector":"model-inversion","owasp_llm":["LLM02"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Face recognition systems, decision trees","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://dl.acm.org/doi/10.1145/2810103.2813677"},{"id":"INC-07380","date":"2017-08","year":2017,"title":"BadNets: Identifying Vulnerabilities in the ML Model Supply Chain","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"MNIST classifier, U.S. street-sign classifier, transfer learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1708.06733"},{"id":"INC-07345","date":"2018-02","year":2018,"title":"Trojaning Attack on Neural Networks","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Face recognition, speech recognition NNs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.ndss-symposium.org/wp-content/uploads/2018/02/ndss2018_03A-5_Liu_paper.pdf"},{"id":"INC-07310","date":"2018-07","year":2018,"title":"How To Backdoor Federated Learning","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Federated learning systems (CIFAR, word prediction)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1807.00459"},{"id":"INC-05055","date":"2022-12","year":2022,"title":"BadDiffusion: How to Backdoor Diffusion Models?","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"DDPM diffusion models, Stable-Diffusion-style pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2212.05400"},{"id":"INC-04483","date":"2023-04","year":2023,"title":"BadGPT: Backdoor Attack against RLHF","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"RLHF-trained LLMs (ChatGPT-style pipelines)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2304.12298"},{"id":"INC-04976","date":"2023-11","year":2023,"title":"Universal Jailbreak Backdoors from Poisoned Human Feedback","severity":"Critical","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"RLHF-aligned LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.14455"},{"id":"INC-03598","date":"2024-01","year":2024,"title":"BadChain: Backdoor Chain-of-Thought Prompting","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM01","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Llama-2, GPT-3.5, PaLM2, GPT-4 with CoT prompting","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2401.12242"},{"id":"INC-04949","date":"2023-11","year":2023,"title":"The Philosopher's Stone: Trojaning Plugins of Large Language Models","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"LoRA/PEFT adapters on HuggingFace, open-source LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2312.00374"},{"id":"INC-04481","date":"2023-07","year":2023,"title":"Backdoor Attacks for In-Context Learning with Language Models","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"GPT-Neo, OPT, Pythia (1.3B-6B)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2307.14692"},{"id":"INC-03884","date":"2024-01","year":2024,"title":"ICLAttack: Universal In-Context Learning Backdoor Attacks","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"OPT (1.3B-180B), Llama, Bloom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2401.05949"},{"id":"INC-05056","date":"2022-11","year":2022,"title":"BadPrompt: Backdoor Attacks on Continuous Prompts","severity":"Medium","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Prompt-tuned NLP classifiers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2211.14719"},{"id":"INC-03041","date":"2025-04","year":2025,"title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM09"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"RAG systems with embedding-based retrievers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2504.03957"},{"id":"INC-02360","date":"2025-05","year":2025,"title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM09"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"RAG-backed LLM systems generally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2505.18543"},{"id":"INC-03037","date":"2025-10","year":2025,"title":"Poisoning Attacks on LLMs Require a Near-Constant Number of Poison Samples","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Pre-trained LLMs across multiple scales","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.07192"},{"id":"INC-04180","date":"2024-08","year":2024,"title":"Scaling Trends for Data Poisoning in LLMs","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Llama, Pythia, OPT, instruction-tuned LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2408.02946"},{"id":"INC-03371","date":"2025-11","year":2025,"title":"Whisper Leak: Side-Channel Attack on Large Language Models","severity":"High","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"OpenAI, Mistral, xAI, Microsoft Azure-hosted LLMs (28 providers)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.03675"},{"id":"INC-03225","date":"2025-05","year":2025,"title":"SPE-LLM: System Prompt Extraction Attacks and Defenses","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"GPT-4, Claude, Gemini, deployed LLM products","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2505.23817"},{"id":"INC-04104","date":"2024-02","year":2024,"title":"Prompt Stealing Attacks Against Large Language Models","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"GPT-3.5, GPT-4, prompt-based LLM products","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.12959"},{"id":"INC-04141","date":"2024-06","year":2024,"title":"Raccoon: Prompt Extraction Benchmark for LLM-Integrated Apps","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"LLM-integrated applications generally","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2406.06737"},{"id":"INC-04110","date":"2024-02","year":2024,"title":"PRSA: Prompt Stealing Attacks Against Real-World Prompt Services","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM06","LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"PromptBase, FlowGPT, commercial prompt marketplaces","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.19200"},{"id":"INC-03355","date":"2025-04","year":2025,"title":"WASP: Benchmarking Web Agent Security Against Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"OpenAI Operator, Anthropic Computer-Use, Browser-Use, web agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2504.18575"},{"id":"INC-02188","date":"2025-03","year":2025,"title":"AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM03"],"owasp_asi":["ASI03","ASI06"],"cve_ids":[],"affected":"Autonomous web agents, Browser-Use, Operator-style agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2503.09780"},{"id":"INC-04098","date":"2024-12","year":2024,"title":"PrivAgent / LeakAgent: RL-based Red-teaming for LLM Privacy Leakage","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02","LLM08"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"GPT-4, Claude, Gemini, Llama, Mistral, Qwen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2412.05734"},{"id":"INC-03375","date":"2025-02","year":2025,"title":"Why Are Web AI Agents More Vulnerable Than Standalone LLMs?","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"Web AI agents based on GPT-4, Claude, Llama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2502.20383"},{"id":"INC-03275","date":"2025-07","year":2025,"title":"The Dark Side of LLMs: Agent-Based Attacks for Complete Computer Takeover","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI02","ASI06"],"cve_ids":[],"affected":"17 frontier LLMs in agent configurations","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2507.06850"},{"id":"INC-03278","date":"2025-05","year":2025,"title":"The Hidden Dangers of Browsing AI Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI03","ASI06"],"cve_ids":[],"affected":"Browser-Use, OpenAI Operator, Anthropic Computer-Use","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2505.13076"},{"id":"INC-02879","date":"2025-03","year":2025,"title":"MemoryGraft: Practical Memory Injection Attack against LLM Agents","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05","LLM09"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"LLM agents with persistent memory (mem0, MemGPT-style)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2503.03704"},{"id":"INC-03678","date":"2024-08","year":2024,"title":"Compromising Embodied Agents with Contextual Backdoor Attacks","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"LLM-controlled robots, embodied driving agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2408.02882"},{"id":"INC-03379","date":"2025-02","year":2025,"title":"Wolfpack Adversarial Attack for Multi-Agent Reinforcement Learning","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"Cooperative multi-agent reinforcement learning systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2502.02844"},{"id":"INC-01179","date":"2026-03","year":2026,"title":"Image-Based Prompt Injection: Hijacking MLLMs via Visually Embedded Instructions","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4-turbo, multimodal LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.03637"},{"id":"INC-02857","date":"2025-04","year":2025,"title":"Manipulating Multimodal Agents via Cross-Modal Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Multimodal LLM agents (GPT-4V/4o, Claude 3.5)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2504.14348"},{"id":"INC-03918","date":"2024-02","year":2024,"title":"Jailbreaking via Word Substitution and Novel Ciphers","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4, Claude, Gemini, reasoning LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.10601"},{"id":"INC-04178","date":"2024-04","year":2024,"title":"Sandwich Attack: Multi-language Mixture Adaptive Attack on LLMs","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4, Claude, multilingual LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2404.07242"},{"id":"INC-04109","date":"2024-02","year":2024,"title":"PRP: Propagating Universal Perturbations to Attack LLM Guardrails","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"LlamaGuard, NeMo Guardrails, guarded LLM pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.15911"},{"id":"INC-03892","date":"2024-06","year":2024,"title":"Improved Few-Shot Jailbreaking Circumvents Aligned LLMs and Defenses","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Llama-2-7B-Chat, GPT-3.5, defended LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2406.01288"},{"id":"INC-03599","date":"2024-03","year":2024,"title":"BadEdit: Backdooring LLMs by Model Editing","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"GPT-J, GPT-NeoX, Llama, editable LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2403.13355"},{"id":"INC-03596","date":"2024-08","year":2024,"title":"BackdoorLLM: Comprehensive Benchmark for Backdoor Attacks on LLMs","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Open-source LLMs (Llama-2/3, Mistral, Qwen)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2408.12798"},{"id":"INC-04804","date":"2023-10","year":2023,"title":"PoisonPrompt: Backdoor Attack on Prompt-Based LLMs","severity":"Medium","attack_vector":"backdoor","owasp_llm":["LLM04"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Llama-2, GPT-J, GPT-NeoX prompt-tuned models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.12439"},{"id":"INC-04779","date":"2023-05","year":2023,"title":"Notable: Transferable Backdoor Attacks Against Prompt-Based NLP Models","severity":"Medium","attack_vector":"backdoor","owasp_llm":["LLM04"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Prompt-tuned NLP classifiers (sentiment, topic, NLI)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2305.17826"},{"id":"INC-03910","date":"2024-06","year":2024,"title":"Invisible Backdoor Attacks on Diffusion Models","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"DDPM, Stable Diffusion, inpainting/editing pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2406.00816"},{"id":"INC-04312","date":"2024-12","year":2024,"title":"UIBDiffusion: Universal Imperceptible Backdoor Attack for Diffusion Models","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Stable Diffusion, DDPM, multi-sampler pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2412.11441"},{"id":"INC-03262","date":"2025-03","year":2025,"title":"Text-to-SQL Backdoor: SQL Injection via Triggers","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"LLM-based Text-to-SQL systems (Spider, BIRD benchmark style)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2503.05445"},{"id":"INC-03595","date":"2024-10","year":2024,"title":"Backdoored Retrievers for Prompt Injection Attacks on RAG","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM01","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"RAG pipelines with dense retrievers (DPR, Contriever, BGE)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.14479"},{"id":"INC-02775","date":"2025-02","year":2025,"title":"JailbreakEdit: Injecting Universal Jailbreak Backdoors via Model Editing","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Llama-2-Chat, Llama-3-Instruct, Vicuna, aligned LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2502.10438"},{"id":"INC-04165","date":"2024-02","year":2024,"title":"Robust CLIP: Unsupervised Adversarial Fine-Tuning Defenses Reveal CLIP Vulnerabilities","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"CLIP, LLaVA, OpenFlamingo and downstream VLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.12336"},{"id":"INC-06886","date":"2020-10","year":2020,"title":"RobustBench: Standardized Adversarial Robustness Benchmark","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"CIFAR-10/100, ImageNet classifiers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2010.09670"},{"id":"INC-04482","date":"2023-08","year":2023,"title":"Backdoor Federated Learning by Poisoning Backdoor-Critical Layers","severity":"High","attack_vector":"backdoor","owasp_llm":["LLM05"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Federated learning systems (CIFAR, FEMNIST, EMNIST)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2308.04466"},{"id":"INC-03615","date":"2024-07","year":2024,"title":"Can Large Language Models Automatically Jailbreak GPT-4V?","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2407.16686"},{"id":"INC-04326","date":"2024-06","year":2024,"title":"Unveiling the Safety of GPT-4o: Empirical Study Using Jailbreak Attacks","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4o (text, image, audio)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2406.06302"},{"id":"INC-04148","date":"2024-04","year":2024,"title":"Red Teaming GPT-4V: Uni/Multi-Modal Jailbreak Attacks","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2404.03411"},{"id":"INC-03310","date":"2025-03","year":2025,"title":"Typographic Visual Prompts Injection Threats in Cross-Modality Generation","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"LLaVA, Qwen-VL, large VLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2503.11519"},{"id":"INC-03195","date":"2025-04","year":2025,"title":"SCAM: Real-World Typographic Robustness Evaluation for Multimodal Models","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"CLIP, SigLIP, downstream VLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2504.04893"},{"id":"INC-04327","date":"2024-02","year":2024,"title":"Unveiling Typographic Deceptions: Typographic Vulnerability in LVLMs","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-4V, Claude-3, LLaVA, large VLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.19150"},{"id":"INC-03556","date":"2024-10","year":2024,"title":"AmpleGCG-Plus: Stronger Generative Adversarial Suffix Model","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Llama-2/3-Chat, GPT-3.5/4, Claude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2410.22143"},{"id":"INC-04634","date":"2023-06","year":2023,"title":"Enrollment-Stage Backdoor on Speaker Recognition via Adversarial Ultrasound","severity":"High","attack_vector":"backdoor","owasp_llm":[],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Speaker recognition, voice authentication","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2306.16022"},{"id":"INC-04821","date":"2023-05","year":2023,"title":"QFA2SR: Query-Free Adversarial Transfer Attacks on Speaker Recognition","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Microsoft Azure, iFlytek speaker recognition APIs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2305.14097"},{"id":"INC-07254","date":"2019-11","year":2019,"title":"Who is Real Bob? Adversarial Attacks on Speaker Recognition (FAKEBOB)","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ivector-PLDA, GMM-UBM, Talentedsoft, Microsoft Azure SR","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1911.01840"},{"id":"INC-07273","date":"2018-01","year":2018,"title":"Audio Adversarial Examples: Targeted Attacks on Speech-to-Text","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Mozilla DeepSpeech, end-to-end ASR","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/1801.01944"},{"id":"INC-04305","date":"2024-01","year":2024,"title":"TrustLLM: Trustworthiness in Large Language Models Benchmark","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"16 mainstream LLMs (proprietary and open-source)","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://arxiv.org/abs/2401.05561"},{"id":"INC-04961","date":"2023-10","year":2023,"title":"ToxicChat: Hidden Toxicity Detection Challenges in User-AI Conversations","severity":"Low","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Chatbot moderation systems, content filters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.17389"},{"id":"INC-04304","date":"2024-07","year":2024,"title":"Trust No Bot: Personal Disclosures in Human-LLM Conversations","severity":"Low","attack_vector":"membership-inference","owasp_llm":["LLM03"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"ChatGPT and similar conversational LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2407.11438"},{"id":"INC-04963","date":"2023-06","year":2023,"title":"TrustGPT: Benchmark for Trustworthy and Responsible LLMs","severity":"Low","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ChatGPT, Vicuna, Alpaca, Llama-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2306.11507"},{"id":"INC-04643","date":"2023-10","year":2023,"title":"Formalizing and Benchmarking Prompt Injection Attacks and Defenses","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GPT-3.5/4, Claude, Vicuna, Llama-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2310.12815"},{"id":"INC-02189","date":"2025-10","year":2025,"title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI06"],"cve_ids":[],"affected":"Agentic AI systems (single-agent and multi-agent)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.23883"},{"id":"INC-03011","date":"2025-06","year":2025,"title":"OS-HARM: Benchmark for Safety of Computer-Use Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI06","ASI08"],"cve_ids":[],"affected":"Computer-use agents (Anthropic Computer Use, Operator-style)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2506.14866"},{"id":"INC-01826","date":"2026-04","year":2026,"title":"Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"LLM coding agents (Devin, OpenHands, Cline-style)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.03081"},{"id":"INC-06536","date":"2020-01-01","year":2020,"title":"Evasion of Deep Learning Detector for Malware C&C Traffic","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Palo Alto Networks malware detection system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0000"},{"id":"INC-06406","date":"2020-01-01","year":2020,"title":"Botnet Domain Generation Algorithm (DGA) Detection Evasion","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Palo Alto Networks ML-based DGA detection module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0001"},{"id":"INC-07109","date":"2020-01-01","year":2020,"title":"VirusTotal Poisoning","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"VirusTotal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0002"},{"id":"INC-07168","date":"2019-09-07","year":2019,"title":"Bypassing Cylance's AI Malware Detection","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"CylancePROTECT, Cylance Smart Antivirus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0003"},{"id":"INC-06420","date":"2020-01-01","year":2020,"title":"Camera Hijack Attack on Facial Recognition System","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Shanghai government tax office's facial recognition service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0004"},{"id":"INC-06373","date":"2020-04-30","year":2020,"title":"Attack on Machine Translation Services","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"Google Translate, Bing Translator, Systran Translate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0005"},{"id":"INC-06470","date":"2020-04-16","year":2020,"title":"ClearviewAI Misconfiguration","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"Clearview AI facial recognition tool","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0006"},{"id":"INC-07190","date":"2019-08-22","year":2019,"title":"GPT-2 Model Replication","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0007"},{"id":"INC-07224","date":"2019-09-09","year":2019,"title":"ProofPoint Evasion","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-20634"],"affected":"ProofPoint Email Protection System","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0008"},{"id":"INC-06783","date":"2020-01-01","year":2020,"title":"Microsoft Azure Service Disruption","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04","LLM06"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Internal Microsoft Azure Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0010"},{"id":"INC-06785","date":"2020-02-01","year":2020,"title":"Microsoft Edge AI Evasion","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"New Microsoft AI Product","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0011"},{"id":"INC-06548","date":"2020-01-01","year":2020,"title":"Face Identification System Evasion via Physical Countermeasures","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Commercial Face Identification Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0012"},{"id":"INC-05496","date":"2021-01-18","year":2021,"title":"Backdoor Attack on Deep Learning Models in Mobile Apps","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"ML-based Android Apps","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0013"},{"id":"INC-05553","date":"2021-06-23","year":2021,"title":"Confusing Antimalware Neural Networks","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kaspersky's Antimalware ML Model","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0014"},{"id":"INC-05076","date":"2022-12-25","year":2022,"title":"Compromised PyTorch Dependency Chain","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"PyTorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0015"},{"id":"INC-04383","date":"2023-01-28","year":2023,"title":"Achieving Code Execution in MathGPT via Prompt Injection","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM02","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":[],"affected":"MathGPT (https://mathgpt.streamlit.app/)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0016"},{"id":"INC-06414","date":"2020-10-01","year":2020,"title":"Bypassing ID.me Identity Verification","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"California Employment Development Department","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0017"},{"id":"INC-05049","date":"2022-07-01","year":2022,"title":"Arbitrary Code Execution with Google Colab","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"Google Colab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0018"},{"id":"INC-04349","date":"2024-06-06","year":2024,"title":"Web-Scale Data Poisoning: Split-View Attack","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"10 web-scale datasets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0025"},{"id":"INC-03784","date":"2024-08-08","year":2024,"title":"Financial Transaction Hijacking with M365 Copilot as an Insider","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM02","LLM03","LLM05","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"Microsoft 365 Copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0026"},{"id":"INC-04792","date":"2023-08-23","year":2023,"title":"Organization Confusion on Hugging Face","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0027"},{"id":"INC-04391","date":"2023-09-26","year":2023,"title":"AI Model Tampering via Supply Chain Attack","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Private Container Registries","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0028"},{"id":"INC-08183","date":"2023-11-23","year":2023,"title":"Google Bard Conversation Exfiltration","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM06","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"Google Bard","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://atlas.mitre.org/studies/AML.CS0029"},{"id":"INC-05052","date":"2022-12-01","year":2022,"title":"Attempted Evasion of ML Phishing Webpage Detection System","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Commercial ML Phishing Webpage Detector","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0032"},{"id":"INC-03950","date":"2024-10-01","year":2024,"title":"Live Deepfake Image Injection to Evade Mobile KYC Verification","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Mobile facial authentication service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0033"},{"id":"INC-02254","date":"2025-01-01","year":2025,"title":"AIKatz: Attacking LLM Desktop Applications","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"LLM Desktop Applications (Claude, ChatGPT, Copilot)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0036"},{"id":"INC-04092","date":"2024-02-01","year":2024,"title":"Planting Instructions for Delayed Automatic AI Agent Tool Invocation","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI02","ASI06"],"cve_ids":[],"affected":"Google Gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0038"},{"id":"INC-02828","date":"2025-06-19","year":2025,"title":"Living Off AI: Prompt Injection via Jira Service Management","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM02","LLM03"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Atlassian MCP, Jira Service Management","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0039"},{"id":"INC-03863","date":"2024-02-01","year":2024,"title":"Hacking ChatGPT’s Memories with Prompt Injection","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM01"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0040"},{"id":"INC-03209","date":"2025-07-01","year":2025,"title":"SesameOp: Novel backdoor uses OpenAI Assistants API for command and control","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":["LLM03","LLM06"],"owasp_asi":["ASI02","ASI10"],"cve_ids":[],"affected":"OpenAI Assistants API","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0042"},{"id":"INC-02852","date":"2025-06-25","year":2025,"title":"Malware Prototype with Embedded Prompt Injection","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"LLM malware detectors, LLM malware analysis and reverse engineering tools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0043"},{"id":"INC-02798","date":"2025-06-03","year":2025,"title":"LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Ukraine’s security and defense sector","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0044"},{"id":"INC-02484","date":"2025-06-24","year":2025,"title":"Data Exfiltration via an MCP Server used by Cursor","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0045"},{"id":"INC-03697","date":"2024-10-24","year":2024,"title":"Data Destruction via Indirect Prompt Injection Targeting Claude Computer-Use","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Claude Computer Use Agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0046"},{"id":"INC-00976","date":"2026-01-25","year":2026,"title":"Exposed ClawdBot Control Interfaces Leads to Credential Access and Execution","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"ClawdBot (now OpenClaw)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0048"},{"id":"INC-01825","date":"2026-01-26","year":2026,"title":"Supply Chain Compromise via Poisoned ClawdBot Skill","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"ClawdBot (now OpenClaw)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0049"},{"id":"INC-01599","date":"2026-02-03","year":2026,"title":"OpenClaw Command & Control via Prompt Injection","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"OpenClaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0051"},{"id":"INC-02841","date":"2025-02-27","year":2025,"title":"LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"LLM Integration Frameworks","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0052"},{"id":"INC-03035","date":"2025-09-01","year":2025,"title":"Poisoned Postmark MCP Server Email Exfiltration","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Postmark MCP Server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0053"},{"id":"INC-02198","date":"2025-05-24","year":2025,"title":"AI ClickFix: Hijacking Computer-Use Agents Using ClickFix","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Claude Computer-Use Agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0055"},{"id":"INC-01463","date":"2026-02-23","year":2026,"title":"Model Distillation Campaigns Targeting Anthropic Claude","severity":"High","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://atlas.mitre.org/studies/AML.CS0056"},{"id":"INC-02276","date":"2025-01","year":2025,"title":"Alleged DeepSeek Model Distillation from OpenAI","severity":"High","attack_vector":"model-extraction","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI (GPT-4 / o1 family)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.ft.com/content/a0dfedd1-5255-4fa9-8ccc-1fe01de87ea6"},{"id":"INC-05595","date":"2021-06","year":2021,"title":"Extracting Training Data from Large Language Models (Carlini et al.)","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02","LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-2 (research target; method generalizes to all LLMs)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2012.07805"},{"id":"INC-05118","date":"2022","year":2022,"title":"Gender bias in sentence completion by xlm-roberta-base (HONEST)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"FacebookAI/xlm-roberta-base","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://avidml.org/database/avid-2022-v002/"},{"id":"INC-05109","date":"2022","year":2022,"title":"Fairness harms in generated text from EleutherAI/gpt-neo-125M (BOLD)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"EleutherAI/gpt-neo-125M","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://avidml.org/database/avid-2022-v003/"},{"id":"INC-07395","date":"2017","year":2017,"title":"Facebook auto-translation incorrectly translates 'Good morning' to 'hurt them'","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Facebook automatic translation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v004/"},{"id":"INC-07350","date":"2018","year":2018,"title":"Uber autonomous vehicle pedestrian fatality (Tempe, AZ)","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Uber self-driving vehicle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v005/"},{"id":"INC-07257","date":"2019","year":2019,"title":"YouTube algorithm fails to filter self-harm content from kids","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"YouTube content moderation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v006/"},{"id":"INC-05141","date":"2022","year":2022,"title":"Israeli tax authority computer-generated fine, no explanation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Israeli tax authority algorithm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v007/"},{"id":"INC-07424","date":"2017","year":2017,"title":"Knightscope K5 security robot drove into a fountain","severity":"Low","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Knightscope K5 robot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v008/"},{"id":"INC-05090","date":"2022","year":2022,"title":"Deepfake of Zelenskyy urging surrender posted on Ukrainian sites","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Public information ecosystem","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v009/"},{"id":"INC-05158","date":"2022","year":2022,"title":"Meta BlenderBot 3 makes antisemitic statements in public demo","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Meta BlenderBot 3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v010/"},{"id":"INC-07516","date":"2016","year":2016,"title":"PredPol predictive policing biased output","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"PredPol predictive policing","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v011/"},{"id":"INC-05131","date":"2022","year":2022,"title":"Hive Box facial-recognition locks defeated by photos","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Hive Box facial-recognition locks","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-v012/"},{"id":"INC-05117","date":"2022","year":2022,"title":"Gender bias in bert-base-uncased sentence completions (HONEST)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"google-bert/bert-base-uncased","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://avidml.org/database/avid-2022-r0001/"},{"id":"INC-05119","date":"2022","year":2022,"title":"Gender bias in xlm-roberta-base sentence completions (HONEST)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"FacebookAI/xlm-roberta-base","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://avidml.org/database/avid-2022-r0002/"},{"id":"INC-05176","date":"2022","year":2022,"title":"Profession gender stereotypes in bert-base-uncased (Winobias)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"google-bert/bert-base-uncased","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-r0003/"},{"id":"INC-05177","date":"2022","year":2022,"title":"Profession gender stereotypes in xlm-roberta-base (Winobias)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"FacebookAI/xlm-roberta-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2022-r0004/"},{"id":"INC-04635","date":"2023","year":2023,"title":"Evasion of deep-learning detector for malware C&C traffic","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Palo Alto Networks ML malware detector","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v001/"},{"id":"INC-04651","date":"2023","year":2023,"title":"Generic domain-mutation technique evades ML-based DGA detection","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"ML-based DGA detectors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v002/"},{"id":"INC-04990","date":"2023","year":2023,"title":"VirusTotal poisoning of ransomware family","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"VirusTotal / shared malware classifiers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v003/"},{"id":"INC-07251","date":"2019","year":2019,"title":"Universal bypass string evades Cylance AI malware detector","severity":"Critical","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Cylance AI malware detector","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v004/"},{"id":"INC-04508","date":"2023","year":2023,"title":"Camera-hijack attack on facial-recognition systems","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Facial-recognition liveness systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v005/"},{"id":"INC-04462","date":"2023","year":2023,"title":"Attack on machine translation services (Google/Bing/Systran)","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Google Translate, Bing Translator, Systran","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v006/"},{"id":"INC-06459","date":"2020","year":2020,"title":"Clearview AI misconfiguration exposed facial-recognition tool","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Clearview AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v007/"},{"id":"INC-07223","date":"2019","year":2019,"title":"ProofPoint email-protection ML model evasion via copy-cat training","severity":"High","attack_vector":"model-extraction","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"ProofPoint email-protection ML model","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v009/"},{"id":"INC-06782","date":"2020","year":2020,"title":"Microsoft Azure internal service red-team disruption","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Internal Microsoft Azure service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v010/"},{"id":"INC-05161","date":"2022","year":2022,"title":"Microsoft Edge AI evasion (Azure Red Team)","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft Edge AI product","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v011/"},{"id":"INC-06842","date":"2020","year":2020,"title":"Physical-domain evasion attack on commercial face-identification service","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Commercial face-identification service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v012/"},{"id":"INC-05779","date":"2021","year":2021,"title":"Neural payload injection into mobile-app deep-learning models","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"On-device mobile DL models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v013/"},{"id":"INC-05554","date":"2021","year":2021,"title":"Confusing Kaspersky antimalware neural networks","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kaspersky antimalware ML","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v014/"},{"id":"INC-05179","date":"2022-12","year":2022,"title":"PyTorch-nightly dependency-confusion supply-chain attack","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch-nightly (Linux)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v015/"},{"id":"INC-04827","date":"2023","year":2023,"title":"RCE in MathGPT via prompt injection (Streamlit demo)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"MathGPT (Streamlit demo, GPT-3 backed)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v016/"},{"id":"INC-07464","date":"2017","year":2017,"title":"YouTube Kids presents inappropriate content via recommendation","severity":"High","attack_vector":"evasion","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"YouTube Kids recommendation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v017/"},{"id":"INC-05045","date":"2022","year":2022,"title":"Amazon warehouse robot ruptures bear-spray can","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Amazon warehouse robot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v018/"},{"id":"INC-07276","date":"2018","year":2018,"title":"Boeing 737 MAX MCAS crashes","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Boeing 737 MAX MCAS","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v019/"},{"id":"INC-07618","date":"2013","year":2013,"title":"Collection of robotic-surgery malfunctions","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Robotic surgical systems","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v020/"},{"id":"INC-07536","date":"2016","year":2016,"title":"Uber autonomous cars running red lights (San Francisco)","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Uber autonomous vehicles","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v021/"},{"id":"INC-07431","date":"2017","year":2017,"title":"NYC school teacher evaluation algorithm contested","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"NYC teacher evaluation algorithm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v022/"},{"id":"INC-07602","date":"2014","year":2014,"title":"Kronos scheduling algorithm harms Starbucks employees","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Kronos workforce scheduling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v023/"},{"id":"INC-07511","date":"2016","year":2016,"title":"Northpointe COMPAS recidivism risk disparate impact","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"COMPAS / Northpointe","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://avidml.org/database/avid-2023-v024/"},{"id":"INC-04525","date":"2023","year":2023,"title":"ChatGPT fails to follow lexical constraints","severity":"Low","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v025/"},{"id":"INC-04523","date":"2023","year":2023,"title":"ChatGPT fabricates scientific references","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v026/"},{"id":"INC-04828","date":"2023","year":2023,"title":"RCE through LLM frameworks (LangChain, Boxcars)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"LangChain, Boxcars.ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-v027/"},{"id":"INC-04537","date":"2023","year":2023,"title":"ChatGPT lexical-constraint failure (measurement)","severity":"Low","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-r0001/"},{"id":"INC-04538","date":"2023","year":2023,"title":"ChatGPT links wrong authors to papers (measurement)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-r0002/"},{"id":"INC-04555","date":"2023","year":2023,"title":"ChatGPT-based agents enable RCE/SQLi via polite prompting","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"LangChain, Boxcars.ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2023-r0003/"},{"id":"INC-02863","date":"2025","year":2025,"title":"MathGPT prompt-injection control bypass (issue report)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"MathGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0001/"},{"id":"INC-02604","date":"2025","year":2025,"title":"Geopolitical bias in sentiment analysis for neutral phrases","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Sentiment-analysis models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0002/"},{"id":"INC-02648","date":"2025","year":2025,"title":"gpt-4o-mini AgentHarm evaluation (Inspect Evals)","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"OpenAI gpt-4o-mini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0003/"},{"id":"INC-02650","date":"2025","year":2025,"title":"gpt-4o-mini WMDP-Bio evaluation (Inspect Evals)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM02","LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI gpt-4o-mini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0004/"},{"id":"INC-02651","date":"2025","year":2025,"title":"gpt-4o-mini WMDP-Chem evaluation (Inspect Evals)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM02","LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI gpt-4o-mini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0005/"},{"id":"INC-02649","date":"2025","year":2025,"title":"gpt-4o-mini CyberSecEval2 prompt-injection benchmark","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"OpenAI gpt-4o-mini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0008/"},{"id":"INC-02831","date":"2025","year":2025,"title":"Llama-3.3-70B-Instruct-Turbo WMDP-Cyber evaluation","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Llama-3.3-70B-Instruct-Turbo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0015/"},{"id":"INC-02504","date":"2025","year":2025,"title":"DeepSeek-R1 CyberSecEval2 interpreter-abuse evaluation","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"DeepSeek-R1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0025/"},{"id":"INC-02913","date":"2025","year":2025,"title":"Mistral-Small-24B-Instruct WMDP-Bio evaluation","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Mistral-Small-24B-Instruct-2501","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0031/"},{"id":"INC-02914","date":"2025","year":2025,"title":"Mistral-Small-24B-Instruct WMDP-Chem evaluation","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Mistral-Small-24B-Instruct-2501","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0032/"},{"id":"INC-02911","date":"2025","year":2025,"title":"Mistral-Small-24B-Instruct CyberSecEval2 interpreter-abuse","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Mistral-Small-24B-Instruct-2501","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0034/"},{"id":"INC-02912","date":"2025","year":2025,"title":"Mistral-Small-24B-Instruct CyberSecEval2 prompt-injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Mistral-Small-24B-Instruct-2501","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2025-r0035/"},{"id":"INC-04048","date":"2024","year":2024,"title":"NVIDIA Container Toolkit TOCTOU container escape (CVE-2024-0132)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"NVIDIA Container Toolkit <=1.16.1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0001/"},{"id":"INC-03889","date":"2024","year":2024,"title":"Improper authorization in lunary-ai/lunary (CVE-2024-10274)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"lunary-ai/lunary 1.5.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0004/"},{"id":"INC-03887","date":"2024","year":2024,"title":"Improper access control in lunary-ai/lunary evaluators (CVE-2024-10330)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"lunary-ai/lunary 1.5.6","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0005/"},{"id":"INC-04083","date":"2024","year":2024,"title":"Path traversal in mintplex-labs/anything-llm (CVE-2024-10513)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"mintplex-labs/anything-llm <1.2.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0006/"},{"id":"INC-03888","date":"2024","year":2024,"title":"Improper access control on evaluator deletion route (lunary)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0007/"},{"id":"INC-03736","date":"2024","year":2024,"title":"DoS in invoke-ai/invokeai multipart boundary parsing (CVE-2024-10821)","severity":"High","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"invoke-ai/invokeai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0008/"},{"id":"INC-04082","date":"2024","year":2024,"title":"Path traversal in eosphoros-ai/db-gpt","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0010/"},{"id":"INC-03586","date":"2024","year":2024,"title":"Arbitrary file write in eosphoros-ai/db-gpt knowledge API (CVE-2024-10833)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"eosphoros-ai/db-gpt 0.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0012/"},{"id":"INC-03585","date":"2024","year":2024,"title":"Arbitrary file write in db-gpt RAG-knowledge endpoint (CVE-2024-10834)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"eosphoros-ai/db-gpt 0.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0013/"},{"id":"INC-04219","date":"2024","year":2024,"title":"SQL injection via SQL-run endpoint in db-gpt (CVE-2024-10835)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"eosphoros-ai/db-gpt 0.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0014/"},{"id":"INC-04077","date":"2024","year":2024,"title":"Overly permissive CORS / CSRF in db-gpt (CVE-2024-10906)","severity":"High","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"eosphoros-ai/db-gpt 0.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0015/"},{"id":"INC-04198","date":"2024","year":2024,"title":"Sensitive file disclosure via ImagePromptTemplate in LangChain (CVE-2024-10940)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"langchain-ai/langchain-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0016/"},{"id":"INC-03671","date":"2024","year":2024,"title":"Code injection in binary-husky/gpt_academic (CVE-2024-10950)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0017/"},{"id":"INC-04105","date":"2024","year":2024,"title":"Prompt-injection RCE via manim plugin in gpt_academic (CVE-2024-10954)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"binary-husky/gpt_academic (manim plugin)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0018/"},{"id":"INC-03584","date":"2024","year":2024,"title":"Arbitrary file deletion vulnerability (lunary/anything-llm class)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"AI-application server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0019/"},{"id":"INC-03738","date":"2024","year":2024,"title":"DoS via large board_name in invoke-ai/invokeai 5.0.2","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"invoke-ai/invokeai 5.0.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0020/"},{"id":"INC-04199","date":"2024","year":2024,"title":"Sensitive prompt-data exposure via URL access","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM08"],"owasp_asi":[],"cve_ids":[],"affected":"LLM application","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0021/"},{"id":"INC-04145","date":"2024","year":2024,"title":"RCE via unsafe torch.load in invoke-ai/invokeai (5.3.1-5.4.2)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"invoke-ai/invokeai 5.3.1-5.4.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0023/"},{"id":"INC-03476","date":"2024","year":2024,"title":"AI Scribe SEO plugin (ChatGPT GPT-4o) issue report","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"AI Scribe WordPress plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0024/"},{"id":"INC-03737","date":"2024","year":2024,"title":"DoS via LangChainLLM in run-llama/llama_index (v0.12.5)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"run-llama/llama_index 0.12.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0025/"},{"id":"INC-04220","date":"2024","year":2024,"title":"SSRF in infiniflow/ragflow (CVE-2024-12779)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"infiniflow/ragflow 0.12.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0026/"},{"id":"INC-04364","date":"2024","year":2024,"title":"XSS in IBM watsonx.ai Web UI (CVE-2024-49785)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"IBM watsonx.ai 1.1-2.0.3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0029/"},{"id":"INC-04320","date":"2024","year":2024,"title":"Uncontrolled resource consumption in mlflow (CVE-2024-6838)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"mlflow 2.13.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0030/"},{"id":"INC-04200","date":"2024","year":2024,"title":"Sensitive-info exposure in anything-llm setup-complete (CVE-2024-6842)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"mintplex-labs/anything-llm 1.5.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0031/"},{"id":"INC-02333","date":"2025","year":2025,"title":"Arbitrary code execution via crafted Keras config (CVE-2025-1550)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"Keras","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0034/"},{"id":"INC-03026","date":"2025","year":2025,"title":"picklescan bypass via 'pip main' (CVE-2025-1716)","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"picklescan <0.0.21","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0035/"},{"id":"INC-03027","date":"2025","year":2025,"title":"picklescan bypass via non-standard file extensions (CVE-2025-1889)","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"picklescan <0.0.22","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0036/"},{"id":"INC-03029","date":"2025","year":2025,"title":"picklescan ZIP crash leads to scan bypass (CVE-2025-1944)","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"picklescan <0.0.23","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0037/"},{"id":"INC-03028","date":"2025","year":2025,"title":"picklescan misses malicious pickles in PyTorch archives (ZIP flag manipulation)","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"picklescan <0.0.23","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0038/"},{"id":"INC-03960","date":"2024","year":2024,"title":"Mage AI insecure default initialization (0.9.75)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"Mage AI 0.9.75","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0039/"},{"id":"INC-03991","date":"2024","year":2024,"title":"Microsoft Account missing authorization elevation of privilege","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft Account","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0040/"},{"id":"INC-03594","date":"2024","year":2024,"title":"Azure AI Face Service EoP via auth-bypass by spoofing","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Microsoft Azure AI Face Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0041/"},{"id":"INC-02968","date":"2025","year":2025,"title":"NVIDIA Container Toolkit TOCTOU (CVE-2025-23359)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"NVIDIA Container Toolkit (Linux)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0042/"},{"id":"INC-04039","date":"2024","year":2024,"title":"NI Vision Builder AI RCE via crafted file (user interaction)","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"NI Vision Builder AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0043/"},{"id":"INC-02355","date":"2025","year":2025,"title":"Azure PromptFlow RCE via improper isolation (CVE-2025-24986)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Microsoft Azure PromptFlow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0044/"},{"id":"INC-02362","date":"2025","year":2025,"title":"BentoML RCE via insecure deserialization (v1.4.2)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"BentoML 1.4.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0045/"},{"id":"INC-02218","date":"2025","year":2025,"title":"AI-assisted dev feature exposes sensitive project data via crafted issue","severity":"High","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"AI dev-assistant platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0046/"},{"id":"INC-03144","date":"2025","year":2025,"title":"PyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruption (CVE-2025-2998)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0047/"},{"id":"INC-03145","date":"2025","year":2025,"title":"PyTorch torch.nn.utils.rnn.unpack_sequence memory corruption","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0048/"},{"id":"INC-03141","date":"2025","year":2025,"title":"PyTorch torch.jit.script memory corruption (CVE-2025-3000)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0049/"},{"id":"INC-03143","date":"2025","year":2025,"title":"PyTorch torch.lstm_cell memory corruption (CVE-2025-3001)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0050/"},{"id":"INC-02577","date":"2025","year":2025,"title":"Firefox AI chatbot leaks document title across tabs (CVE-2025-3035)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Mozilla Firefox AI chatbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0051/"},{"id":"INC-03140","date":"2025","year":2025,"title":"PyTorch torch.jit.jit_module_from_flatbuffer memory corruption (CVE-2025-3121)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0052/"},{"id":"INC-03139","date":"2025","year":2025,"title":"PyTorch CUDACachingAllocator memory corruption (CVE-2025-3136)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":[],"cve_ids":[],"affected":"PyTorch 2.6.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0053/"},{"id":"INC-02726","date":"2025","year":2025,"title":"Improper authorization in ageerle ruoyi-ai SysModelController","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"ageerle/ruoyi-ai <=2.0.1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0054/"},{"id":"INC-02464","date":"2025","year":2025,"title":"Cursor Agent arbitrary file write via @Docs prompt injection (CVE-2025-32018)","severity":"High","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI04"],"cve_ids":[],"affected":"Cursor Agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0055/"},{"id":"INC-02727","date":"2025","year":2025,"title":"Improper authorization in ageerle ruoyi-ai SysNoticeController (CVE-2025-3202)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"ageerle/ruoyi-ai <=2.0.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0056/"},{"id":"INC-02364","date":"2025","year":2025,"title":"BentoML runner-server insecure deserialization RCE (CVE-2025-32375)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"BentoML <1.4.8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0057/"},{"id":"INC-02805","date":"2025","year":2025,"title":"Langflow unauthenticated RCE via /api/v1/validate/code (CVE-2025-3248)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Langflow <1.3.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0058/"},{"id":"INC-02924","date":"2025","year":2025,"title":"Multi-model guardrail jailbreak via urgent-health framing","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"Multiple major LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0059/"},{"id":"INC-02923","date":"2025","year":2025,"title":"Multi-model guardrail jailbreak via hex-encoded fictional context","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM03"],"owasp_asi":[],"cve_ids":[],"affected":"Multiple major LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0060/"},{"id":"INC-03568","date":"2024","year":2024,"title":"Ansible-core sensitive-info exposure in Vault files (CVE-2024-8775)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"Red Hat Ansible-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1625/"},{"id":"INC-03233","date":"2025-01-31","year":2025,"title":"Storm-2139 Azure OpenAI account hijack and jailbreak resale","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM02","LLM03"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Microsoft Azure OpenAI Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://genai.owasp.org/2025/03/06/owasp-gen-ai-incident-exploit-round-up-jan-feb-2025/"},{"id":"INC-02646","date":"2025-04-29","year":2025,"title":"GPT-4.1 jailbreak via tool poisoning","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM07","LLM08","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI06"],"cve_ids":["CVE-2025-23254"],"affected":"OpenAI GPT-4.1 (tool/agent integrations)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://genai.owasp.org/2025/07/14/owasp-gen-ai-incident-exploit-round-up-q225/"},{"id":"INC-03530","date":"2024-02","year":2024,"title":"Air Canada chatbot misinformation liability (Moffatt v. Air Canada)","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"Air Canada chatbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://aibusiness.com/nlp/air-canada-held-responsible-for-chatbot-s-hallucinations-"},{"id":"INC-04875","date":"2023-08","year":2023,"title":"Sourcegraph LLM API key/admin-token abuse and rate-limit manipulation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM06"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Sourcegraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/"},{"id":"INC-01291","date":"2023-04","year":2023,"title":"LangChain LLMMathChain prompt-injection RCE via Python exec","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM06","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI08"],"cve_ids":["CVE-2023-29374","CVE-2023-32785","CVE-2023-32786","CVE-2023-34541","CVE-2023-36095","CVE-2023-36188","CVE-2023-36189","CVE-2023-36258","CVE-2023-38860","CVE-2023-38896","CVE-2023-44467","CVE-2023-46229","CVE-2024-0243","CVE-2024-21513","CVE-2024-27444","CVE-2024-28088","CVE-2024-2965","CVE-2024-3095","CVE-2024-3571","CVE-2024-38459","CVE-2024-46946","CVE-2024-58340","CVE-2024-5998","CVE-2024-8309","CVE-2026-55443"],"affected":"langchain-ai/langchain <= 0.0.131 (fixed 0.0.142)","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29374"},{"id":"INC-04718","date":"2023-08","year":2023,"title":"LangChain JSON load_prompt arbitrary code execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36281"],"affected":"langchain-ai/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36281"},{"id":"INC-04717","date":"2023-08","year":2023,"title":"LangChain GraphCypherQAChain code execution","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05"],"cve_ids":["CVE-2023-39631"],"affected":"langchain-ai/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39631"},{"id":"INC-01295","date":"2024-08","year":2024,"title":"LangChainJS getFullPath path traversal","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05"],"cve_ids":["CVE-2024-7042","CVE-2024-7774","CVE-2025-68665","CVE-2026-26019","CVE-2026-27795"],"affected":"langchainjs 0.2.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7774"},{"id":"INC-02800","date":"2025-04","year":2025,"title":"LangChain GmailToolkit indirect prompt injection -> code execution","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05","ASI09"],"cve_ids":["CVE-2025-46059"],"affected":"langchain-community GmailToolkit 0.3.51","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46059"},{"id":"INC-01348","date":"2024-01","year":2024,"title":"LlamaIndex SQL injection via prompt in NLSQLTableQueryEngine","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM09","LLM10"],"owasp_asi":["ASI01","ASI02","ASI04","ASI05"],"cve_ids":["CVE-2024-12704","CVE-2024-12910","CVE-2024-12911","CVE-2024-14021","CVE-2024-23751","CVE-2024-3098","CVE-2024-3271","CVE-2024-4181","CVE-2024-45201","CVE-2024-58339","CVE-2025-1752","CVE-2025-1793","CVE-2025-3044","CVE-2025-3046","CVE-2025-3108","CVE-2025-5302","CVE-2025-5472","CVE-2025-6208","CVE-2025-6209","CVE-2025-6211","CVE-2025-7647","CVE-2025-7707"],"affected":"llama_index <= 0.9.34","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23751"},{"id":"INC-01723","date":"2023-09-05","year":2023,"title":"Anyscale Ray LFI via /static/ directory (missing authorization)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2023-48022","CVE-2023-6019","CVE-2023-6020","CVE-2023-6021","CVE-2025-34351","CVE-2026-27482","CVE-2026-32981"],"affected":"ray < 2.8.1","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6020"},{"id":"INC-04455","date":"2023-11","year":2023,"title":"Anyscale Ray insufficient authentication (related to ShadowRay)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM03"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-48023"],"affected":"ray (default config)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48023"},{"id":"INC-04144","date":"2024-05","year":2024,"title":"Ray Serve gRPC handler vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28199","CVE-2024-32970"],"affected":"ray < 2.20.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32970"},{"id":"INC-03147","date":"2025-03","year":2025,"title":"Ray < 2.43.0 leaks Redis password in logs","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-1979"],"affected":"ray < 2.43.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1979"},{"id":"INC-03336","date":"2025-04","year":2025,"title":"vLLM Mooncake integration pickle deserialization RCE over ZeroMQ","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI07"],"cve_ids":["CVE-2025-29783","CVE-2025-32444"],"affected":"vllm 0.6.5 - 0.8.4 (mooncake)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32444"},{"id":"INC-01166","date":"2024-04","year":2024,"title":"Hugging Face Transformers load_repo_checkpoint pickle RCE","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM06","LLM10"],"owasp_asi":["ASI04","ASI05","ASI08"],"cve_ids":["CVE-2023-2800","CVE-2023-6730","CVE-2023-7018","CVE-2024-11392","CVE-2024-11393","CVE-2024-11394","CVE-2024-12720","CVE-2024-3568","CVE-2025-1194","CVE-2025-2099","CVE-2025-3262","CVE-2025-3263","CVE-2025-3264","CVE-2025-3777","CVE-2025-3933","CVE-2025-5197","CVE-2025-6051","CVE-2025-6638","CVE-2025-6921","CVE-2026-1839","CVE-2026-4372"],"affected":"huggingface/transformers (multiple)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3568"},{"id":"INC-04223","date":"2024-04","year":2024,"title":"Stable Diffusion WebUI (AUTOMATIC1111) limited file write on Windows","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31462"],"affected":"AUTOMATIC1111/stable-diffusion-webui 1.7.0 (Windows)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31462"},{"id":"INC-03911","date":"2024-12","year":2024,"title":"InvokeAI /api/v2/models/install torch.load deserialization RCE","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12029"],"affected":"invokeai 5.3.1 - 5.4.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12029"},{"id":"INC-04959","date":"2023-10","year":2023,"title":"TorchServe ShellTorch SSRF -> RCE (allowed_urls bypass)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM03","LLM04"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43654"],"affected":"TorchServe < 0.8.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43654"},{"id":"INC-05190","date":"2022-12","year":2022,"title":"SnakeYAML deserialization RCE (TorchServe & many AI/ML stacks)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1471"],"affected":"snakeyaml <= 1.31 (TorchServe 0.3.0 - 0.8.1)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471"},{"id":"INC-04300","date":"2024-05","year":2024,"title":"TorchServe gRPC plaintext binding (auth bypass)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-35198","CVE-2024-35199"],"affected":"torchserve < 0.11.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35199"},{"id":"INC-03924","date":"2024-04","year":2024,"title":"Keras Lambda layer marshalled-code RCE","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3660"],"affected":"keras < 2.13 / tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x4wf-678h-2pmq"},{"id":"INC-03951","date":"2024-05","year":2024,"title":"llama-cpp-python Jinja2 SSTI in chat_template metadata -> RCE (Llama Drama)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34359"],"affected":"llama-cpp-python < 0.2.72","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34359"},{"id":"INC-04002","date":"2024-10","year":2024,"title":"Microsoft DeepSpeed command injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43497"],"affected":"Microsoft DeepSpeed","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43497"},{"id":"INC-03999","date":"2024-08","year":2024,"title":"Microsoft Copilot Studio SSRF -> cloud metadata exposure","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2024-38206"],"affected":"Microsoft Copilot Studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38206"},{"id":"INC-03574","date":"2024-04","year":2024,"title":"AnythingLLM env-var update endpoint command injection -> RCE","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3104"],"affected":"anything-llm < 1.0.0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3104"},{"id":"INC-03577","date":"2024-02","year":2024,"title":"AnythingLLM unauthenticated DoS via data-export filename","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM06","LLM10"],"owasp_asi":["ASI04","ASI05","ASI08"],"cve_ids":["CVE-2024-0765","CVE-2024-22422"],"affected":"anything-llm pre-commit 08d33cfd8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22422"},{"id":"INC-03576","date":"2024-02","year":2024,"title":"AnythingLLM privilege escalation: default-role users delete admin documents","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM03"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-1602"],"affected":"anything-llm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1602"},{"id":"INC-04333","date":"2024-06","year":2024,"title":"Vanna.AI ask() prompt-injection -> exec() RCE","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":["CVE-2024-5826"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5826"},{"id":"INC-04556","date":"2023-12","year":2023,"title":"ChatGPT-Next-Web (NextChat) SSRF / open-proxy","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2023-49785"],"affected":"ChatGPT-Next-Web (NextChat) <= 2.11.2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49785"},{"id":"INC-03663","date":"2024-03","year":2024,"title":"Chinese ChatGPT-clone (pictureproxy.php) SSRF exploited in the wild","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":["CVE-2024-27564"],"affected":"ChatGPT (open-source clone), commit f9f4bbc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27564"},{"id":"INC-02984","date":"2025-11","year":2025,"title":"Open WebUI Direct Connections SSE code injection -> ATO/RCE","severity":"High","attack_vector":"xss","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09"],"cve_ids":["CVE-2024-12534","CVE-2024-12537","CVE-2025-64495","CVE-2025-64496","CVE-2025-65958","CVE-2025-65959","CVE-2026-44721","CVE-2026-45299","CVE-2026-45331","CVE-2026-45338","CVE-2026-45339","CVE-2026-45346","CVE-2026-45349","CVE-2026-45385","CVE-2026-45386","CVE-2026-45387","CVE-2026-45395","CVE-2026-45396","CVE-2026-45397","CVE-2026-45398","CVE-2026-45399","CVE-2026-45400","CVE-2026-45401","CVE-2026-45402","CVE-2026-45665","CVE-2026-45667","CVE-2026-45671","CVE-2026-45675","CVE-2026-56399"],"affected":"open-webui <= 0.6.34","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64496"},{"id":"INC-02985","date":"2025-11","year":2025,"title":"Open WebUI incorrect access control","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM03","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-63681"],"affected":"open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-frv8-gffc-37px"},{"id":"INC-02873","date":"2025-07","year":2025,"title":"MCP session ID hijacking (prompt hijacking)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM02","LLM04","LLM08","LLM10"],"owasp_asi":["ASI03","ASI04","ASI07","ASI09"],"cve_ids":["CVE-2025-6515"],"affected":"MCP implementations","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jfrog.com/blog/mcp-prompt-hijacking-vulnerability/"},{"id":"INC-02469","date":"2025-08","year":2025,"title":"Cursor CurXecute: indirect prompt injection writes .cursor/mcp.json -> RCE","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05","ASI09"],"cve_ids":["CVE-2025-54135"],"affected":"Cursor < 1.3.9","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54135"},{"id":"INC-02470","date":"2025-08","year":2025,"title":"Cursor MCPoison: approved MCP server config can be silently swapped","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM03","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI07","ASI09"],"cve_ids":["CVE-2025-54136"],"affected":"Cursor IDE","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/"},{"id":"INC-02610","date":"2025-11","year":2025,"title":"GitHub Copilot for JetBrains RCE via malicious repo/PR","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05","ASI09"],"cve_ids":["CVE-2025-64671"],"affected":"GitHub Copilot for JetBrains","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-64671"},{"id":"INC-03921","date":"2024-01","year":2024,"title":"JupyterLab token leak via crafted-link redirect (used by AI notebooks)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM02"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22421"],"affected":"JupyterLab (with jupyter-server < 2.7.2)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22421"},{"id":"INC-02822","date":"2025-09","year":2025,"title":"LibreChat unprotected testing endpoint exposes user chats","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54868"],"affected":"LibreChat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.ameeba.com/blog/cve-2025-54868-unprotected-endpoint-in-librechat-potentially-exposes-user-chats/"},{"id":"INC-01328","date":"2026-02","year":2026,"title":"LibreChat MCP credential placeholder substitution -> OAuth token exfiltration","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM03","LLM04"],"owasp_asi":["ASI03","ASI04","ASI07","ASI09"],"cve_ids":["CVE-2026-31951"],"affected":"LibreChat 0.8.2-rc1 - 0.8.3-rc1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.cvedetails.com/cve/CVE-2026-31951/"},{"id":"INC-01434","date":"2026-04-15","year":2026,"title":"Microsoft Copilot Studio indirect prompt injection (ShareLeak)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI09"],"cve_ids":["CVE-2026-21520"],"affected":"Microsoft Copilot Studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://venturebeat.com/security/microsoft-salesforce-copilot-agentforce-prompt-injection-cve-agent-remediation-playbook"},{"id":"INC-02354","date":"2025-07","year":2025,"title":"Azure OpenAI SSRF -> privilege escalation","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-53767"],"affected":"Azure OpenAI Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://zeropath.com/blog/cve-2025-53767"},{"id":"INC-01553","date":"2026-05","year":2026,"title":"Ollama Windows auto-updater missing signature verification","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-15514","CVE-2026-42248","CVE-2026-42249","CVE-2026-5757"],"affected":"Ollama Windows (auto-updater)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.helpnetsecurity.com/2026/05/05/ollama-windows-vulnerabilities-cve-2026-42248-cve-2026-42249/"},{"id":"INC-01290","date":"2026-03","year":2026,"title":"LangChain core prompt-loading path traversal (langchain_core/prompts/loading.py)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34070"],"affected":"langchain-core (multiple versions)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.html"},{"id":"INC-03752","date":"2024-06","year":2024,"title":"EmailGPT prompt-injection / system-prompt leak","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM08","LLM10"],"owasp_asi":["ASI01","ASI02","ASI05"],"cve_ids":["CVE-2024-5184"],"affected":"EmailGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5184"},{"id":"INC-03575","date":"2024-06","year":2024,"title":"AnythingLLM HTTP smuggling / improper-input vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5566"],"affected":"anything-llm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5566"},{"id":"INC-13428","date":"2026-07","year":2026,"title":"In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disp...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-13323"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13323"},{"id":"INC-13429","date":"2026-07","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so th...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53356"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53356"},{"id":"INC-13430","date":"2026-07","year":2026,"title":"Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured ro...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49119"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49119"},{"id":"INC-13431","date":"2026-07","year":2026,"title":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130).","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56149"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56149"},{"id":"INC-13432","date":"2026-07","year":2026,"title":"OpenClaw MCP SSE redirects could forward Authorization headers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9c3v-684m-579c"},{"id":"INC-13433","date":"2026-07","year":2026,"title":"Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50143"],"affected":"npm/@apify/actors-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50143"},{"id":"INC-13434","date":"2026-07","year":2026,"title":"Rancher has Privilege Escalation from Project Owner to Host","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41052"],"affected":"go/github.com/rancher/rancher, go/github.com/rancher/rancher, go/github.com/rancher/rancher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41052"},{"id":"INC-13435","date":"2026-07","year":2026,"title":"Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44935"],"affected":"go/github.com/rancher/fleet, go/github.com/rancher/fleet, go/github.com/rancher/fleet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44935"},{"id":"INC-13436","date":"2026-07","year":2026,"title":"Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44936"],"affected":"go/github.com/rancher/fleet, go/github.com/rancher/fleet, go/github.com/rancher/fleet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44936"},{"id":"INC-13437","date":"2026-07","year":2026,"title":"Rancher vulnerable to command injection through unsanitized YAML parameter","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44939"],"affected":"go/github.com/rancher/rancher, go/github.com/rancher/rancher, go/github.com/rancher/rancher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44939"},{"id":"INC-13438","date":"2026-07","year":2026,"title":"Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44938"],"affected":"go/github.com/rancher/fleet, go/github.com/rancher/fleet, go/github.com/rancher/fleet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44938"},{"id":"INC-13439","date":"2026-07","year":2026,"title":"SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c8jx-96c9-8xrp"},{"id":"INC-13440","date":"2026-07","year":2026,"title":"SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wp87-mgvq-5j93"},{"id":"INC-13441","date":"2026-07","year":2026,"title":"SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fpxg-5xmv-922m"},{"id":"INC-13442","date":"2026-07","year":2026,"title":"SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4vgr-h27g-cf9p"},{"id":"INC-13443","date":"2026-07","year":2026,"title":"Kimai Password Reset Link Remains Valid After Password Change","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m492-gv72-xvxj"},{"id":"INC-13444","date":"2026-07","year":2026,"title":"repomix: attach_packed_output can bypass file-read secret scanning for supported local files","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49988"],"affected":"npm/repomix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49988"},{"id":"INC-13445","date":"2026-07","year":2026,"title":"Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49986"],"affected":"pip/neuro-cortex-memory","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49986"},{"id":"INC-13446","date":"2026-07","year":2026,"title":"wetty vulnerable to DOM XSS via file-download filename","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49864"],"affected":"npm/wetty","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49864"},{"id":"INC-13447","date":"2026-07","year":2026,"title":"EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/easycorp/easyadmin-bundle, composer/easycorp/easyadmin-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2wwr-9x6f-88gp"},{"id":"INC-13448","date":"2026-07","year":2026,"title":"auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49857"],"affected":"npm/auth-fetch-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49857"},{"id":"INC-13449","date":"2026-07","year":2026,"title":"@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49856"],"affected":"npm/@jshookmcp/jshook","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49856"},{"id":"INC-08195","date":"2026-06","year":2026,"title":"OpenClaude — Sandbox Escape (CVE-2026-42074)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42074"],"affected":"gitlawb/openclaude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42074"},{"id":"INC-08196","date":"2026-06","year":2026,"title":"Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifi...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49948"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49948"},{"id":"INC-13450","date":"2026-06","year":2026,"title":"The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS com...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-55743"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55743"},{"id":"INC-01668","date":"2026-06","year":2026,"title":"PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration ...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM04","LLM05","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40112","CVE-2026-40113","CVE-2026-40114","CVE-2026-40115","CVE-2026-40116","CVE-2026-40148","CVE-2026-40149","CVE-2026-40154","CVE-2026-40156","CVE-2026-40157","CVE-2026-40158","CVE-2026-40159","CVE-2026-56074","CVE-2026-56075"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56075"},{"id":"INC-13451","date":"2026-06","year":2026,"title":"Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privi...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-12045"],"affected":"pgadmin/pgadmin_4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12045"},{"id":"INC-13452","date":"2026-06","year":2026,"title":"Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths.","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12048"],"affected":"pgadmin/pgadmin_4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12048"},{"id":"INC-13453","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-33760)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33760"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33760"},{"id":"INC-13454","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-48520)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48520"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48520"},{"id":"INC-13455","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54009)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54009"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54009"},{"id":"INC-13456","date":"2026-06","year":2026,"title":"Crawl4AI — Sandbox Escape (CVE-2026-53753)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53753"],"affected":"kidocode/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53753"},{"id":"INC-13457","date":"2026-06","year":2026,"title":"Crawl4AI — Ssrf (CVE-2026-53754)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-53754"],"affected":"kidocode/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53754"},{"id":"INC-13458","date":"2026-06","year":2026,"title":"Crawl4AI — Ssrf (CVE-2026-53755)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53755"],"affected":"kidocode/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53755"},{"id":"INC-13459","date":"2026-06","year":2026,"title":"@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55249"],"affected":"rtkai/rtk-rewrite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55249"},{"id":"INC-08448","date":"2026-06","year":2026,"title":"rtk filters and compresses command outputs before they reach your LLM context.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45792","CVE-2026-54555"],"affected":"rtk-ai/rtk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45792"},{"id":"INC-13460","date":"2026-06","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-48789)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48789"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48789"},{"id":"INC-13461","date":"2026-06","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-55611)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55611"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55611"},{"id":"INC-13462","date":"2026-06","year":2026,"title":"Twenty — Vulnerability (CVE-2026-55583)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55583"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55583"},{"id":"INC-13463","date":"2026-06","year":2026,"title":"Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the serv...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-58169"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58169"},{"id":"INC-13464","date":"2026-06","year":2026,"title":"Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthent...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-58446"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58446"},{"id":"INC-08197","date":"2026-06","year":2026,"title":"LMDeploy — Rce (CVE-2026-46432)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46432"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46432"},{"id":"INC-08198","date":"2026-06","year":2026,"title":"LMDeploy — Rce (CVE-2026-46517)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46517"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46517"},{"id":"INC-13465","date":"2026-06","year":2026,"title":"Backpropagate — Dos (CVE-2026-48797)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48797"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48797"},{"id":"INC-13466","date":"2026-06","year":2026,"title":"vLLM — Rce (CVE-2026-54232)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54232"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54232"},{"id":"INC-08199","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-44654)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44654"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44654"},{"id":"INC-08235","date":"2026-06","year":2026,"title":"mcp-server-kubernetes — Vulnerability (CVE-2026-47250)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47250"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47250"},{"id":"INC-08263","date":"2026-06","year":2026,"title":"AgenticMail gives AI agents real email addresses and phone numbers.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50287"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50287"},{"id":"INC-13467","date":"2026-06","year":2026,"title":"A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-12203"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12203"},{"id":"INC-13468","date":"2026-06","year":2026,"title":"Cursor — Sandbox Escape (CVE-2026-48124)","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48124"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48124"},{"id":"INC-13469","date":"2026-06","year":2026,"title":"Pydantic AI — Vulnerability (CVE-2026-48782)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48782"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48782"},{"id":"INC-13470","date":"2026-06","year":2026,"title":"In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could cause the Splunk AI Toolkit to make outbound reques...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-20265"],"affected":"splunk/ai_toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-20265"},{"id":"INC-08440","date":"2026-06","year":2026,"title":"Windows-MCP — Vulnerability (CVE-2026-48989)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48989"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48989"},{"id":"INC-13471","date":"2026-06","year":2026,"title":"In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-22551","CVE-2026-44688","CVE-2026-46580"],"affected":"eclipse/theia","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22551"},{"id":"INC-13472","date":"2026-06","year":2026,"title":"Langflow — Path Traversal (CVE-2026-42867)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42867"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42867"},{"id":"INC-13473","date":"2026-06","year":2026,"title":"Langflow — Rce (CVE-2026-48519)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48519"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48519"},{"id":"INC-13474","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-55255)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55255"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55255"},{"id":"INC-13475","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-55423)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55423"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55423"},{"id":"INC-13476","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-55446)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55446"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55446"},{"id":"INC-13477","date":"2026-06","year":2026,"title":"Langflow — Vulnerability (CVE-2026-55447)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55447"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55447"},{"id":"INC-13478","date":"2026-06","year":2026,"title":"Langflow — Info Disclosure (CVE-2026-55450)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-55450"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55450"},{"id":"INC-13479","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54323)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54323"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54323"},{"id":"INC-13480","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54324)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54324"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54324"},{"id":"INC-13481","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54319)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54319"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54319"},{"id":"INC-13482","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54320)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54320"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54320"},{"id":"INC-13483","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54321)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54321"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54321"},{"id":"INC-13484","date":"2026-06","year":2026,"title":"Daytona — Rce (CVE-2026-54322)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54322"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54322"},{"id":"INC-13485","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54027)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54027"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54027"},{"id":"INC-13486","date":"2026-06","year":2026,"title":"ToolJet — Vulnerability (CVE-2026-55411)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55411"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55411"},{"id":"INC-13487","date":"2026-06","year":2026,"title":"ToolJet — Ssrf (CVE-2026-55412)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55412"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55412"},{"id":"INC-13488","date":"2026-06","year":2026,"title":"ToolJet — Rce (CVE-2026-55413)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55413"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55413"},{"id":"INC-13489","date":"2026-06","year":2026,"title":"Cursor — Rce (CVE-2026-50548)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50548"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50548"},{"id":"INC-13490","date":"2026-06","year":2026,"title":"Cursor — Rce (CVE-2026-50549)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50549"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50549"},{"id":"INC-13491","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32394)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32394"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32394"},{"id":"INC-13492","date":"2026-06","year":2026,"title":"Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to ...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-13437"],"affected":"devolutions/powershell_universal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13437"},{"id":"INC-13493","date":"2026-06","year":2026,"title":"Claude Code — Data Exfiltration (CVE-2026-54316)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54316"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54316"},{"id":"INC-13494","date":"2026-06","year":2026,"title":"Warp — Rce (CVE-2026-48703)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48703"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48703"},{"id":"INC-13495","date":"2026-06","year":2026,"title":"Warp — Vulnerability (CVE-2026-48704)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48704"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48704"},{"id":"INC-13496","date":"2026-06","year":2026,"title":"Warp — Command Injection (CVE-2026-48719)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48719"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48719"},{"id":"INC-13497","date":"2026-06","year":2026,"title":"Warp — Vulnerability (CVE-2026-48720)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48720"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48720"},{"id":"INC-13498","date":"2026-06","year":2026,"title":"Warp — Rce (CVE-2026-48721)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48721"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48721"},{"id":"INC-13499","date":"2026-06","year":2026,"title":"Warp — Vulnerability (CVE-2026-48725)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48725"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48725"},{"id":"INC-13500","date":"2026-06","year":2026,"title":"Warp — Command Injection (CVE-2026-48731)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48731"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48731"},{"id":"INC-13501","date":"2026-06","year":2026,"title":"Warp — Command Injection (CVE-2026-48732)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48732"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48732"},{"id":"INC-13502","date":"2026-06","year":2026,"title":"Warp — Vulnerability (CVE-2026-54686)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54686"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54686"},{"id":"INC-13503","date":"2026-06","year":2026,"title":"Warp — Command Injection (CVE-2026-54699)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54699"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54699"},{"id":"INC-13504","date":"2026-06","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-46406)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46406"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46406"},{"id":"INC-13505","date":"2026-06","year":2026,"title":"Claude Code — Prompt Injection (CVE-2026-55607)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-55607"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55607"},{"id":"INC-13506","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF).","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-10564"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10564"},{"id":"INC-08532","date":"2026-06","year":2026,"title":"ApostropheCMS — Command Injection (CVE-2026-42853)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42853"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42853"},{"id":"INC-13507","date":"2026-06","year":2026,"title":"GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-66389"],"affected":"microsoft/github_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66389"},{"id":"INC-08200","date":"2026-06","year":2026,"title":"horizon921 mcpilot 0 — Ssrf (CVE-2026-10280)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10280"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10280"},{"id":"INC-08201","date":"2026-06","year":2026,"title":"OpenClaude — Vulnerability (CVE-2026-42073)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42073"],"affected":"gitlawb/openclaude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42073"},{"id":"INC-08202","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-32625)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32625"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32625"},{"id":"INC-08203","date":"2026-06","year":2026,"title":"LibreChat — Data Exfiltration (CVE-2026-44653)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44653"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44653"},{"id":"INC-08436","date":"2026-06","year":2026,"title":"mcp-server-kubernetes — Auth Bypass (CVE-2026-46519)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46519"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46519"},{"id":"INC-13508","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin re...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-53840"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53840"},{"id":"INC-08420","date":"2026-06","year":2026,"title":"Network-AI — Ssrf (CVE-2026-48814)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46701","CVE-2026-48814"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48814"},{"id":"INC-13509","date":"2026-06","year":2026,"title":"An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11719"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11719"},{"id":"INC-13510","date":"2026-06","year":2026,"title":"mcp-pinot — Vulnerability (CVE-2026-49257)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49257"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49257"},{"id":"INC-13511","date":"2026-06","year":2026,"title":"Line Desktop MCP — Vulnerability (CVE-2026-49357)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49357"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49357"},{"id":"INC-13512","date":"2026-06","year":2026,"title":"gin-vue-admin — Rce (CVE-2026-48787)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48787"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48787"},{"id":"INC-13513","date":"2026-06","year":2026,"title":"A security vulnerability has been detected in BerriAI litellm up to 1.82.2.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-12774","CVE-2026-12799"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12774"},{"id":"INC-13514","date":"2026-06","year":2026,"title":"BerriAI litellm — Ssrf (CVE-2026-12798)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12798"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12798"},{"id":"INC-13515","date":"2026-06","year":2026,"title":"Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path.","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66336"],"affected":"apache/doris_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66336"},{"id":"INC-13516","date":"2026-06","year":2026,"title":"A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs t...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-57300"],"affected":"jenkins/mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57300"},{"id":"INC-13517","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54030)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54030"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54030"},{"id":"INC-02864","date":"2026-06","year":2026,"title":"Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugi...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2016-11077","CVE-2017-18892","CVE-2017-18909","CVE-2017-18918","CVE-2023-2783","CVE-2023-35075","CVE-2023-5967","CVE-2024-37182","CVE-2025-13523","CVE-2025-24839","CVE-2025-27715","CVE-2025-31363","CVE-2025-3913","CVE-2025-47700","CVE-2025-49810","CVE-2025-55074","CVE-2025-9072","CVE-2026-2461","CVE-2026-25783","CVE-2026-28735","CVE-2026-3108","CVE-2026-3637","CVE-2026-4053","CVE-2026-4339","CVE-2026-5163","CVE-2026-9699"],"affected":"mattermost/mattermost_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4339"},{"id":"INC-13518","date":"2026-06","year":2026,"title":"GitHub MCP Server is GitHub's official MCP Server.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48529"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48529"},{"id":"INC-13519","date":"2026-06","year":2026,"title":"Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insen...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-58057"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58057"},{"id":"INC-13520","date":"2026-06","year":2026,"title":"A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-13524"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13524"},{"id":"INC-13521","date":"2026-06","year":2026,"title":"DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools func...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58168"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58168"},{"id":"INC-13522","date":"2026-06","year":2026,"title":"The Model Context Protocol has a security warning advising servers to validate the \"Origin\" header on all incoming connections to prevent DNS rebinding attacks.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-11624"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11624"},{"id":"INC-08204","date":"2026-06","year":2026,"title":"OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47117"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47117"},{"id":"INC-13523","date":"2026-06","year":2026,"title":"LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious mode...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-58116"],"affected":"hiyouga/llama-factory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58116"},{"id":"INC-08205","date":"2026-06","year":2026,"title":"MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-3198"],"affected":"lfprojects/mlflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3198"},{"id":"INC-08207","date":"2026-06","year":2026,"title":"onnx onnx-mlir — Vulnerability (CVE-2026-11329)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11329"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11329"},{"id":"INC-13524","date":"2026-06","year":2026,"title":"stable-diffusion.cpp — Vulnerability (CVE-2026-47748)","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47747","CVE-2026-47748","CVE-2026-47749","CVE-2026-47750"],"affected":"leejet/stable-diffusion.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47748"},{"id":"INC-13525","date":"2026-06","year":2026,"title":"picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the _...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53875"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53875"},{"id":"INC-10279","date":"2026-06","year":2026,"title":"picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71340","CVE-2025-71344"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71340"},{"id":"INC-08208","date":"2026-06","year":2026,"title":"CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redir...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43625"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43625"},{"id":"INC-13526","date":"2026-06","year":2026,"title":"Open WebUI — Auth Bypass (CVE-2026-54021)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54021"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54021"},{"id":"INC-13527","date":"2026-06","year":2026,"title":"A vulnerability was determined in FlowiseAI Flowise up to 3.1.2.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12821"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12821"},{"id":"INC-08209","date":"2026-06","year":2026,"title":"In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9743"],"affected":"mongodb/mongodb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9743"},{"id":"INC-13528","date":"2026-06","year":2026,"title":"Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56307"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56307"},{"id":"INC-13529","date":"2026-06","year":2026,"title":"node-tar — Malware (CVE-2026-53655)","severity":"Medium","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53655"],"affected":"isaacs/tar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655"},{"id":"INC-13530","date":"2026-06","year":2026,"title":"Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL q...","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-56221"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56221"},{"id":"INC-13531","date":"2026-06","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure When ttm_tt_swapout() fails, the current...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52965"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52965"},{"id":"INC-13532","date":"2026-06","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each()...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53190"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53190"},{"id":"INC-01186","date":"2026-06","year":2026,"title":"Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42824","CVE-2026-54130"],"affected":"microsoft/copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42824"},{"id":"INC-13533","date":"2026-06","year":2026,"title":"Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59252","CVE-2025-59272","CVE-2025-59286","CVE-2025-62222","CVE-2026-21256","CVE-2026-21257","CVE-2026-21516","CVE-2026-21518","CVE-2026-23653","CVE-2026-24299","CVE-2026-26129","CVE-2026-26136","CVE-2026-26164","CVE-2026-33111","CVE-2026-41090","CVE-2026-42827","CVE-2026-42893","CVE-2026-42895","CVE-2026-45497"],"affected":"microsoft/copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45497"},{"id":"INC-09630","date":"2026-06","year":2026,"title":"Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose i...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33833","CVE-2026-41109","CVE-2026-47644"],"affected":"microsoft/copilot_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47644"},{"id":"INC-08210","date":"2026-06","year":2026,"title":"Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45482","CVE-2026-50519"],"affected":"microsoft/visual_studio_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45482"},{"id":"INC-13534","date":"2026-06","year":2026,"title":"Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47645"],"affected":"microsoft/365_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47645"},{"id":"INC-13535","date":"2026-06","year":2026,"title":"A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not ha...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9132"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9132"},{"id":"INC-13536","date":"2026-06","year":2026,"title":"n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed H...","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56348"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56348"},{"id":"INC-13537","date":"2026-06","year":2026,"title":"n8n before 1.123.15 and 2.5.0 contains a webhook forgery vulnerability in the GitHub Webhook Trigger node that fails to implement HMAC-SHA256 signature verification.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56357"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56357"},{"id":"INC-13538","date":"2026-06","year":2026,"title":"n8n — Xss (CVE-2026-54303)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54303"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54303"},{"id":"INC-13539","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54309)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54309"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54309"},{"id":"INC-13540","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54310)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54310"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54310"},{"id":"INC-13541","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54311)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54311"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54311"},{"id":"INC-13542","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54312)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54312"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54312"},{"id":"INC-13543","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54313)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54313"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54313"},{"id":"INC-13544","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54314)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54314"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54314"},{"id":"INC-08530","date":"2026-06","year":2026,"title":"n8n — Rce (CVE-2026-44789)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44789"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44789"},{"id":"INC-08529","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-44790)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44790"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44790"},{"id":"INC-01489","date":"2026-06","year":2026,"title":"n8n — Rce (CVE-2026-44791)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42232","CVE-2026-44791"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44791"},{"id":"INC-08528","date":"2026-06","year":2026,"title":"n8n — Sql Injection (CVE-2026-44792)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44792"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44792"},{"id":"INC-08527","date":"2026-06","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-45732)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45732"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45732"},{"id":"INC-13545","date":"2026-06","year":2026,"title":"n8n — Sandbox Escape (CVE-2026-49444)","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49444"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49444"},{"id":"INC-13546","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-49465)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49465"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49465"},{"id":"INC-13547","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54301)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54301"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54301"},{"id":"INC-13548","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54302)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54302"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54302"},{"id":"INC-13549","date":"2026-06","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-54304)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54304"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54304"},{"id":"INC-13550","date":"2026-06","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-54305)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54305"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54305"},{"id":"INC-13551","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54306)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54306"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54306"},{"id":"INC-13552","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54307)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54307"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54307"},{"id":"INC-13553","date":"2026-06","year":2026,"title":"n8n — Vulnerability (CVE-2026-54308)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54308"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54308"},{"id":"INC-01492","date":"2026-06","year":2026,"title":"n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through une...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42237","CVE-2026-56351"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56351"},{"id":"INC-13554","date":"2026-06","year":2026,"title":"n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sani...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56358"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56358"},{"id":"INC-09347","date":"2026-06","year":2026,"title":"n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56350"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56350"},{"id":"INC-09061","date":"2026-06","year":2026,"title":"n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56356"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56356"},{"id":"INC-13555","date":"2026-06","year":2026,"title":"n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56777"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56777"},{"id":"INC-13556","date":"2026-06","year":2026,"title":"The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never ...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45831"],"affected":"trychroma/chromadb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45831"},{"id":"INC-13557","date":"2026-06","year":2026,"title":"A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in an...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8828"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8828"},{"id":"INC-02312","date":"2026-06","year":2026,"title":"A vulnerability was identified in Weaviate up to 1.37.7.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-67818","CVE-2025-67819","CVE-2026-11500"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11500"},{"id":"INC-08211","date":"2026-06","year":2026,"title":"yoanbernabeu grepai 0 — Vulnerability (CVE-2026-11479)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11479"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11479"},{"id":"INC-08212","date":"2026-06","year":2026,"title":"milvus-io milvus — Vulnerability (CVE-2026-10814)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10814"],"affected":"milvus/milvus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10814"},{"id":"INC-13558","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54019)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54019"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54019"},{"id":"INC-08213","date":"2026-06","year":2026,"title":"F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing u...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43624"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43624"},{"id":"INC-13559","date":"2026-06","year":2026,"title":"A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6658"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6658"},{"id":"INC-13560","date":"2026-06","year":2026,"title":"AIDC-AI ComfyUI-Copilot — Vulnerability (CVE-2026-13493)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-13493"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13493"},{"id":"INC-13561","date":"2026-06","year":2026,"title":"Open WebUI — Ssrf (CVE-2026-54017)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54017"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54017"},{"id":"INC-13562","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54006)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54006"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54006"},{"id":"INC-13563","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54007)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54007"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54007"},{"id":"INC-13564","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54008)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54008"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54008"},{"id":"INC-13565","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54010)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54010"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54010"},{"id":"INC-13566","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54011)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54011"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54011"},{"id":"INC-13567","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54012)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54012"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54012"},{"id":"INC-13568","date":"2026-06","year":2026,"title":"Open WebUI — Xss (CVE-2026-54013)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54013"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54013"},{"id":"INC-13569","date":"2026-06","year":2026,"title":"Open WebUI — Path Traversal (CVE-2026-54014)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54014"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54014"},{"id":"INC-13570","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54015)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54015"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54015"},{"id":"INC-13571","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54016)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54016"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54016"},{"id":"INC-13572","date":"2026-06","year":2026,"title":"Open WebUI — Ssrf (CVE-2026-54018)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54018"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54018"},{"id":"INC-13573","date":"2026-06","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-54022)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54022"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54022"},{"id":"INC-02160","date":"2026-06","year":2026,"title":"An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-26265","CVE-2026-37232"],"affected":"openairinterface/openairinterface5g","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37232"},{"id":"INC-08214","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-31942)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31942"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31942"},{"id":"INC-08215","date":"2026-06","year":2026,"title":"OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-11326"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11326"},{"id":"INC-13574","date":"2026-06","year":2026,"title":"LibreChat — Ssrf (CVE-2026-54033)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54033"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54033"},{"id":"INC-13575","date":"2026-06","year":2026,"title":"Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and ...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7574"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7574"},{"id":"INC-08216","date":"2026-06","year":2026,"title":"thedotmack claude-mem — Vulnerability (CVE-2026-11330)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11330"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11330"},{"id":"INC-08217","date":"2026-06","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioc...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46294"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46294"},{"id":"INC-13576","date":"2026-06","year":2026,"title":"Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53911"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53911"},{"id":"INC-13577","date":"2026-06","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() On failure to set the epp, the function amd_pstate...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53121"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53121"},{"id":"INC-08218","date":"2026-06","year":2026,"title":"zhayujie chatgpt-on-wechat — Command Injection (CVE-2026-10214)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10214"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10214"},{"id":"INC-13578","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54036)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54036"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54036"},{"id":"INC-13579","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54024)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54024"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54024"},{"id":"INC-13580","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54025)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54025"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54025"},{"id":"INC-13581","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54029)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54029"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54029"},{"id":"INC-13582","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54037)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54037"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54037"},{"id":"INC-13583","date":"2026-06","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-54040)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54040"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54040"},{"id":"INC-13584","date":"2026-06","year":2026,"title":"Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56062"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56062"},{"id":"INC-13585","date":"2026-06","year":2026,"title":"IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF).","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3341"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3341"},{"id":"INC-13586","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-7787"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7787"},{"id":"INC-13587","date":"2026-06","year":2026,"title":"A vulnerability was identified in langflow-ai langflow up to 1.9.3.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12822"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12822"},{"id":"INC-13588","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated ...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10561"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10561"},{"id":"INC-13589","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enf...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7664"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7664"},{"id":"INC-13590","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-10129","CVE-2026-10546"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10129"},{"id":"INC-13591","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, a...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10134"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10134"},{"id":"INC-13592","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10140"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10140"},{"id":"INC-13593","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10560"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10560"},{"id":"INC-13594","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enf...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7663"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7663"},{"id":"INC-13595","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7803"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7803"},{"id":"INC-13596","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integ...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-7871"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7871"},{"id":"INC-13597","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system co...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-7873"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7873"},{"id":"INC-13598","date":"2026-06","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption a...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7874"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7874"},{"id":"INC-13599","date":"2026-06","year":2026,"title":"A vulnerability was identified in BerriAI litellm up to 1.82.2.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12771","CVE-2026-12796"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12771"},{"id":"INC-13600","date":"2026-06","year":2026,"title":"BerriAI litellm — Vulnerability (CVE-2026-12772)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12772"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12772"},{"id":"INC-13601","date":"2026-06","year":2026,"title":"BerriAI litellm — Auth Bypass (CVE-2026-12773)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12773"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12773"},{"id":"INC-13602","date":"2026-06","year":2026,"title":"A vulnerability was determined in BerriAI litellm up to 1.82.2.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12795"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12795"},{"id":"INC-13603","date":"2026-06","year":2026,"title":"BerriAI litellm — Vulnerability (CVE-2026-12797)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12797"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12797"},{"id":"INC-13604","date":"2026-06","year":2026,"title":"LangGraph SQLite Checkpoint — Deserialization (CVE-2026-48775)","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48775"],"affected":"langchain/langgraph-checkpoint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48775"},{"id":"INC-13605","date":"2026-06","year":2026,"title":"LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48776"],"affected":"langchain/langgraph-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48776"},{"id":"INC-09705","date":"2026-06","year":2026,"title":"A security vulnerability has been detected in SGLang 0.5.10.post1.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10300"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10300"},{"id":"INC-09706","date":"2026-06","year":2026,"title":"A vulnerability was determined in sgl-project SGLang up to 0.5.11.","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10775"],"affected":"lmsys/sglang","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10775"},{"id":"INC-09707","date":"2026-06","year":2026,"title":"OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41283"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41283"},{"id":"INC-13606","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32392)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32392"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32392"},{"id":"INC-13607","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32422)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32422"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32422"},{"id":"INC-13608","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32424)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32424"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32424"},{"id":"INC-13609","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32436)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32436"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32436"},{"id":"INC-13610","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32437)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32437"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32437"},{"id":"INC-13611","date":"2026-06","year":2026,"title":"AutoGPT — Xss (CVE-2026-55237)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55237"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55237"},{"id":"INC-09727","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2026-33235)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33232","CVE-2026-33233","CVE-2026-33234","CVE-2026-33235"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33235"},{"id":"INC-13612","date":"2026-06","year":2026,"title":"AutoGPT — Dos (CVE-2025-32423)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32423"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32423"},{"id":"INC-13613","date":"2026-06","year":2026,"title":"AutoGPT — Ssrf (CVE-2026-56663)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56663"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56663"},{"id":"INC-13614","date":"2026-06","year":2026,"title":"AutoGPT — Vulnerability (CVE-2026-56823)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56823"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56823"},{"id":"INC-08888","date":"2026-06","year":2026,"title":"FoundationAgents MetaGPT — Deserialization (CVE-2026-10566)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10566","CVE-2026-11455","CVE-2026-5970","CVE-2026-5971","CVE-2026-5972","CVE-2026-5973","CVE-2026-5974","CVE-2026-6109","CVE-2026-6110","CVE-2026-6111"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10566"},{"id":"INC-13615","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53806"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53806"},{"id":"INC-13616","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53807"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53807"},{"id":"INC-13617","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53808"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53808"},{"id":"INC-13618","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of cano...","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53809"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53809"},{"id":"INC-13619","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53810"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53810"},{"id":"INC-13620","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom feature that allows authenticated accounts to match policy entries through mutable...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53811"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53811"},{"id":"INC-13621","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks thr...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53812"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53812"},{"id":"INC-13622","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53813"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53813"},{"id":"INC-13623","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-a...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53814"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53814"},{"id":"INC-13624","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53815"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53815"},{"id":"INC-13625","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without sys...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53816"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53816"},{"id":"INC-13626","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain d...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53817"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53817"},{"id":"INC-13627","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-to...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53818"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53818"},{"id":"INC-13628","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53819"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53819"},{"id":"INC-13629","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended comma...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53820"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53820"},{"id":"INC-13630","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53821"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53821"},{"id":"INC-13631","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53822"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53822"},{"id":"INC-13632","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53823"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53823"},{"id":"INC-13633","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53824"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53824"},{"id":"INC-13634","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53825"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53825"},{"id":"INC-13635","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-53826"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53826"},{"id":"INC-13636","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payloads with Gateway ...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53827"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53827"},{"id":"INC-13637","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without prope...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53828"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53828"},{"id":"INC-13638","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53829"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53829"},{"id":"INC-13639","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53830"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53830"},{"id":"INC-13640","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53831"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53831"},{"id":"INC-13641","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53832"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53832"},{"id":"INC-13642","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explici...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53833"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53833"},{"id":"INC-13643","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53834"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53834"},{"id":"INC-13644","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create or update binding...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53835"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53835"},{"id":"INC-13645","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated f...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53836"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53836"},{"id":"INC-13646","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata.","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53837"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53837"},{"id":"INC-13647","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53838"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53838"},{"id":"INC-13648","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53839"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53839"},{"id":"INC-13649","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53841"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53841"},{"id":"INC-13650","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON dur...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53842","CVE-2026-53858"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53842"},{"id":"INC-13651","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53843"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53843"},{"id":"INC-13652","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without pro...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53844"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53844"},{"id":"INC-13653","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53845"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53845"},{"id":"INC-13654","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bund...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53846"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53846"},{"id":"INC-13655","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53847"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53847"},{"id":"INC-13656","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53848"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53848"},{"id":"INC-13657","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names inst...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53849"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53849"},{"id":"INC-13658","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53850"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53850"},{"id":"INC-13659","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53851"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53851"},{"id":"INC-13660","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by s...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53852"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53852"},{"id":"INC-13661","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables ...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53853"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53853"},{"id":"INC-13662","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom sta...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53854"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53854"},{"id":"INC-13663","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53855"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53855"},{"id":"INC-13664","date":"2026-06","year":2026,"title":"OpenClaw 2026.4.23 before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53856"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53856"},{"id":"INC-13665","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53857"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53857"},{"id":"INC-13666","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-deriv...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53859"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53859"},{"id":"INC-13667","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather th...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53860"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53860"},{"id":"INC-13668","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53861"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53861"},{"id":"INC-13669","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53862"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53862"},{"id":"INC-13670","date":"2026-06","year":2026,"title":"OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53863"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53863"},{"id":"INC-13671","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53864"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53864"},{"id":"INC-13672","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53865"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53865"},{"id":"INC-13673","date":"2026-06","year":2026,"title":"OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53866"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53866"},{"id":"INC-13674","date":"2026-06","year":2026,"title":"Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-3408"],"affected":"pip/openbabel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3408"},{"id":"INC-13675","date":"2026-06","year":2026,"title":"Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48807"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48807"},{"id":"INC-13676","date":"2026-06","year":2026,"title":"oban_web missing authorization check on `save-job` event handler","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48592"],"affected":"erlang/oban_web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48592"},{"id":"INC-13677","date":"2026-06","year":2026,"title":"Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49451"],"affected":"nuget/Microsoft.OpenAPI, nuget/Microsoft.OpenAPI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49451"},{"id":"INC-13678","date":"2026-06","year":2026,"title":"Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44840"],"affected":"go/github.com/dgraph-io/dgraph/v25","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44840"},{"id":"INC-13679","date":"2026-06","year":2026,"title":"pnpm: `patch-remove` could delete project-selected files outside the patches directory","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-72r4-9c5j-mj57"},{"id":"INC-13680","date":"2026-06","year":2026,"title":"pnpm: Hoisted install imports lockfile alias outside node_modules","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fr4h-3cph-29xv"},{"id":"INC-13681","date":"2026-06","year":2026,"title":"Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ww5p-j6cj-6mqq"},{"id":"INC-13682","date":"2026-06","year":2026,"title":"pnpm: `stage download` writes outside its destination directory via manifest name/version traversal","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55700"],"affected":"npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55700"},{"id":"INC-13683","date":"2026-06","year":2026,"title":"pnpm: Reserved bin name deletes PNPM_HOME during global remove","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55699"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55699"},{"id":"INC-13684","date":"2026-06","year":2026,"title":"pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55698"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55698"},{"id":"INC-13685","date":"2026-06","year":2026,"title":"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55487"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55487"},{"id":"INC-13686","date":"2026-06","year":2026,"title":"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55180"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55180"},{"id":"INC-13687","date":"2026-06","year":2026,"title":"Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53522"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53522"},{"id":"INC-13688","date":"2026-06","year":2026,"title":"Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-53519"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53519"},{"id":"INC-13689","date":"2026-06","year":2026,"title":"Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53521"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53521"},{"id":"INC-13690","date":"2026-06","year":2026,"title":"Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53520"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53520"},{"id":"INC-13691","date":"2026-06","year":2026,"title":"pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50016"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50016"},{"id":"INC-13692","date":"2026-06","year":2026,"title":"pnpm: Git Fetch Argument Injection via Lockfile resolution.commit","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50014"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50014"},{"id":"INC-13693","date":"2026-06","year":2026,"title":"pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50021"],"affected":"npm/pnpm, npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50021"},{"id":"INC-13694","date":"2026-06","year":2026,"title":"js-toml has silent type confusion via falsy-primitive duplicate-key bypass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50029"],"affected":"npm/js-toml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50029"},{"id":"INC-13695","date":"2026-06","year":2026,"title":"Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/nezhahq/nezha, go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q6xx-5vr8-p898"},{"id":"INC-13696","date":"2026-06","year":2026,"title":"YARD static cache reads raw traversal paths before router sanitization","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-49342"],"affected":"rubygems/yard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49342"},{"id":"INC-13697","date":"2026-06","year":2026,"title":"@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49336"],"affected":"npm/@microsoft/kiota-http-fetchlibrary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49336"},{"id":"INC-13698","date":"2026-06","year":2026,"title":"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49293"],"affected":"npm/js-toml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49293"},{"id":"INC-13699","date":"2026-06","year":2026,"title":"SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/solidinvoice/solidinvoice","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7vfx-4246-jcfh"},{"id":"INC-13700","date":"2026-06","year":2026,"title":"@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@cardano402/mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rp72-5v5q-2446"},{"id":"INC-13701","date":"2026-06","year":2026,"title":"Relyra SAML SignatureValue not cryptographically verified -> authentication bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49454"],"affected":"erlang/relyra","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49454"},{"id":"INC-13702","date":"2026-06","year":2026,"title":"mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49291"],"affected":"pip/mcp-memory-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49291"},{"id":"INC-13703","date":"2026-06","year":2026,"title":"Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/dosage","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-75mw-h36v-2jv7"},{"id":"INC-13704","date":"2026-06","year":2026,"title":"nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v2jf-442r-6mjh"},{"id":"INC-13705","date":"2026-06","year":2026,"title":"Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/pterodactyl/panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j7f5-gfqm-pcx3"},{"id":"INC-13706","date":"2026-06","year":2026,"title":"Flawfinder output manipulation via untrusted filenames and source text","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48813"],"affected":"pip/flawfinder","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48813"},{"id":"INC-13707","date":"2026-06","year":2026,"title":"semantic-router exposed to compromised litellm wheel (CVE-2026-42208) via unbounded transitive pin","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/semantic-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-98x5-vq43-vc5p"},{"id":"INC-13708","date":"2026-06","year":2026,"title":"LinkifyIt#match scan loop has quadratic algorithmic complexity","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48801"],"affected":"npm/linkify-it","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801"},{"id":"INC-13709","date":"2026-06","year":2026,"title":"Hysteria: http large header with sniff cause server DoS","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/apernet/hysteria","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jqc5-2p7q-fqfc"},{"id":"INC-13710","date":"2026-06","year":2026,"title":"@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@cyclonedx/cdxgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5vwr-qchf-q4pf"},{"id":"INC-13711","date":"2026-06","year":2026,"title":"Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48788"],"affected":"go/github.com/umputun/remark42","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48788"},{"id":"INC-13712","date":"2026-06","year":2026,"title":"Incus has an arbitrary file write on its client due to trusted image hash","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48769"],"affected":"go/github.com/lxc/incus/v7/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48769"},{"id":"INC-13713","date":"2026-06","year":2026,"title":"Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48756"],"affected":"go/github.com/lxc/incus/v7/cmd/incusd","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48756"},{"id":"INC-13714","date":"2026-06","year":2026,"title":"Incus has an argument injection in backup compression algorithm leading to AFW and ACE","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48755"],"affected":"go/github.com/lxc/incus/v7/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48755"},{"id":"INC-13715","date":"2026-06","year":2026,"title":"Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48754"],"affected":"go/github.com/lxc/incus/v7/cmd/incusd","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48754"},{"id":"INC-13716","date":"2026-06","year":2026,"title":"Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44024","CVE-2026-44025"],"affected":"rubygems/fluentd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44025"},{"id":"INC-13717","date":"2026-06","year":2026,"title":"golang.org/x/crypto/ssh/agent doesn't drop invoking agent constraints when forwarding keys","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39832","CVE-2026-39833","CVE-2026-46598"],"affected":"go/golang.org/x/crypto/ssh/agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832"},{"id":"INC-13718","date":"2026-06","year":2026,"title":"Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id>","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55162","CVE-2026-55163"],"affected":"pip/lemur","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55163"},{"id":"INC-13719","date":"2026-06","year":2026,"title":"Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48508"],"affected":"pip/lemur","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48508"},{"id":"INC-13720","date":"2026-06","year":2026,"title":"opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48504"],"affected":"rust/opentelemetry_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48504"},{"id":"INC-13721","date":"2026-06","year":2026,"title":"amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9291"],"affected":"pip/amazon-braket-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9291"},{"id":"INC-13722","date":"2026-06","year":2026,"title":"justhtml: to_markdown() code-span blank-line breakout enables XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jf6w-2mvx-633j"},{"id":"INC-13723","date":"2026-06","year":2026,"title":"OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45052"],"affected":"maven/org.openidentityplatform.openam:openam-federation-library","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45052"},{"id":"INC-13724","date":"2026-06","year":2026,"title":"Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55542"],"affected":"composer/snipe/snipe-it","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55542"},{"id":"INC-13725","date":"2026-06","year":2026,"title":"opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48496"],"affected":"go/go.opentelemetry.io/ebpf-profiler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48496"},{"id":"INC-13726","date":"2026-06","year":2026,"title":"Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48167"],"affected":"composer/filament/tables, composer/filament/infolists, composer/filament/tables","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48167"},{"id":"INC-13727","date":"2026-06","year":2026,"title":"Slim has Reflected XSS in the HtmlErrorRenderer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48157"],"affected":"composer/slim/slim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48157"},{"id":"INC-13728","date":"2026-06","year":2026,"title":"Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48126"],"affected":"go/github.com/xyproto/algernon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48126"},{"id":"INC-13729","date":"2026-06","year":2026,"title":"jackson-databind has @JsonView bypass for setterless creator properties","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54517"],"affected":"maven/tools.jackson.core:jackson-databind, maven/com.fasterxml.jackson.core:jackson-databind,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54517"},{"id":"INC-13730","date":"2026-06","year":2026,"title":"jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54516"],"affected":"maven/tools.jackson.core:jackson-databind, maven/com.fasterxml.jackson.core:jackson-databind,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54516"},{"id":"INC-13731","date":"2026-06","year":2026,"title":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54514"],"affected":"maven/tools.jackson.core:jackson-databind, maven/tools.jackson.core:jackson-databind,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514"},{"id":"INC-13732","date":"2026-06","year":2026,"title":"jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54513"],"affected":"maven/tools.jackson.core:jackson-databind, maven/com.fasterxml.jackson.core:jackson-databind,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513"},{"id":"INC-13733","date":"2026-06","year":2026,"title":"jackson-databind has a @JsonView bypass for unwrapped creator parameters","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54518"],"affected":"maven/tools.jackson.core:jackson-databind, maven/com.fasterxml.jackson.core:jackson-databind","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54518"},{"id":"INC-13734","date":"2026-06","year":2026,"title":"AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7cqp-7cfv-6c3q"},{"id":"INC-13735","date":"2026-06","year":2026,"title":"Mise's local credential_command executes untrusted config","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55448"],"affected":"rust/mise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55448"},{"id":"INC-13736","date":"2026-06","year":2026,"title":"Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55441"],"affected":"rust/mise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55441"},{"id":"INC-13737","date":"2026-06","year":2026,"title":"Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46607","CVE-2026-46608","CVE-2026-46611","CVE-2026-53925"],"affected":"pip/glances","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53925"},{"id":"INC-13738","date":"2026-06","year":2026,"title":"Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-52798","CVE-2026-52806","CVE-2026-52807","CVE-2026-52809","CVE-2026-52811","CVE-2026-52812","CVE-2026-52816"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52816"},{"id":"INC-13739","date":"2026-06","year":2026,"title":"OctoPrint has XSS in its Suppressed Command Notifications","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35163"],"affected":"pip/OctoPrint, pip/OctoPrint","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35163"},{"id":"INC-13740","date":"2026-06","year":2026,"title":"@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50179"],"affected":"npm/@actual-app/web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50179"},{"id":"INC-13741","date":"2026-06","year":2026,"title":"@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54353"],"affected":"npm/@budibase/backend-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54353"},{"id":"INC-13742","date":"2026-06","year":2026,"title":"Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54352"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54352"},{"id":"INC-13743","date":"2026-06","year":2026,"title":"Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54351"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54351"},{"id":"INC-13744","date":"2026-06","year":2026,"title":"Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50137"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50137"},{"id":"INC-13745","date":"2026-06","year":2026,"title":"Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-50132"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50132"},{"id":"INC-13746","date":"2026-06","year":2026,"title":"devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/devbridge-autocomplete","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hvqh-jw65-wcpq"},{"id":"INC-13747","date":"2026-06","year":2026,"title":"scimPatch vulnerable to prototype pollution via unfiltered keys in patch","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48170"],"affected":"npm/scim-patch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48170"},{"id":"INC-13748","date":"2026-06","year":2026,"title":"nebula-mesh's stores enrollment tokens unhashed in SQLite","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ghmh-jhmj-wcmf"},{"id":"INC-08228","date":"2026-06","year":2026,"title":"skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"rust/skillctl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-74p7-6h78-gw8p"},{"id":"INC-13749","date":"2026-06","year":2026,"title":"@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46700"],"affected":"npm/@actual-app/sync-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46700"},{"id":"INC-13750","date":"2026-06","year":2026,"title":"motionEye: Authentication possible via password hash","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46488"],"affected":"pip/motioneye","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46488"},{"id":"INC-13751","date":"2026-06","year":2026,"title":"Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44795"],"affected":"maven/io.spinnaker.orca:orca-core, maven/io.spinnaker.orca:orca-core, maven/io.spinnaker.rosco:rosco-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44795"},{"id":"INC-13752","date":"2026-06","year":2026,"title":"OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44203","CVE-2026-44793"],"affected":"maven/org.openidentityplatform.openam:openam-federation-library","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44793"},{"id":"INC-13753","date":"2026-06","year":2026,"title":"Paymenter has broken object level authorization via service reference manipulation on ticket creation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44585"],"affected":"composer/paymenter/paymenter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44585"},{"id":"INC-13754","date":"2026-06","year":2026,"title":"Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33646"],"affected":"rust/mise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33646"},{"id":"INC-13755","date":"2026-06","year":2026,"title":"Anki's local HTTP server does not sufficiently validate requests","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/aqt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-869j-r97x-hx2g"},{"id":"INC-13756","date":"2026-06","year":2026,"title":"SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h4h3-3rfj-x6fq"},{"id":"INC-13757","date":"2026-06","year":2026,"title":"SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h5rg-8p7f-47g2"},{"id":"INC-13758","date":"2026-06","year":2026,"title":"Zeep: Server-Side Request Forgery (SSRF)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/zeep","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4cc2-g9w2-fhf6"},{"id":"INC-13759","date":"2026-06","year":2026,"title":"appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/appium-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x975-rgx4-5fh4"},{"id":"INC-13760","date":"2026-06","year":2026,"title":"EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/everos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c795-2g9c-j48m"},{"id":"INC-13761","date":"2026-06","year":2026,"title":"Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@zenalexa/unicli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v3f4-w7r7-v3hm"},{"id":"INC-13762","date":"2026-06","year":2026,"title":"Gogs: XSS in .ipynb files renderer due to outdated notebookjs","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6vxv-wg6j-5qwp"},{"id":"INC-13763","date":"2026-06","year":2026,"title":"SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"npm/mcp-searxng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mrvx-jmjw-vggc"},{"id":"INC-13764","date":"2026-06","year":2026,"title":"SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"npm/mcp-searxng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xcqx-9jf5-w339"},{"id":"INC-13765","date":"2026-06","year":2026,"title":"Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/network-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-48x2-6pr9-2jjf"},{"id":"INC-13766","date":"2026-06","year":2026,"title":"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@bitbonsai/mcpvault","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9c83-rr99-vfwj"},{"id":"INC-13767","date":"2026-06","year":2026,"title":"Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@sveltia/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h5jc-78hr-3pc9"},{"id":"INC-13768","date":"2026-06","year":2026,"title":"OpenBao: LDAPi ldaputil (wrong escape func)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55770"],"affected":"go/github.com/openbao/openbao, go/github.com/openbao/openbao","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55770"},{"id":"INC-13769","date":"2026-06","year":2026,"title":"StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55690","CVE-2026-55691","CVE-2026-55692"],"affected":"composer/starcitizenwiki/embedvideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55692"},{"id":"INC-13770","date":"2026-06","year":2026,"title":"Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55650"],"affected":"npm/@outerbase/studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55650"},{"id":"INC-13771","date":"2026-06","year":2026,"title":"Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55187"],"affected":"go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55187"},{"id":"INC-13772","date":"2026-06","year":2026,"title":"Open Redirect Bypass in miniflux-v2","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55185"],"affected":"go/miniflux.app/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55185"},{"id":"INC-13773","date":"2026-06","year":2026,"title":"Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54761","CVE-2026-54762"],"affected":"go/github.com/traefik/traefik/v3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54762"},{"id":"INC-13774","date":"2026-06","year":2026,"title":"Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55847"],"affected":"maven/io.qameta.allure:allure-generator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55847"},{"id":"INC-13775","date":"2026-06","year":2026,"title":"VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/vcrpy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rpj2-4hq8-938g"},{"id":"INC-13776","date":"2026-06","year":2026,"title":"dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55837"],"affected":"pip/dbt-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55837"},{"id":"INC-13777","date":"2026-06","year":2026,"title":"Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/ultimate-sitemap-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p5wc-9w9r-m232"},{"id":"INC-13778","date":"2026-06","year":2026,"title":"Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/ultimate-sitemap-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8823-qg2x-pv9f"},{"id":"INC-13779","date":"2026-06","year":2026,"title":"go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55828"],"affected":"go/go.qbee.io/transport","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55828"},{"id":"INC-13780","date":"2026-06","year":2026,"title":"Craft Commerce: Partial Payment Amount Without Lower Bound Validation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/craftcms/commerce, composer/craftcms/commerce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-78vr-q6cf-c7p6"},{"id":"INC-13781","date":"2026-06","year":2026,"title":"@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54074"],"affected":"npm/@tinacms/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54074"},{"id":"INC-13782","date":"2026-06","year":2026,"title":"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@kozou/core, npm/@kozou/mcp, npm/@kozou/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v52w-28xh-v562"},{"id":"INC-13783","date":"2026-06","year":2026,"title":"CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54783"],"affected":"nuget/CoreWCF.Primitives, nuget/CoreWCF.Primitives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54783"},{"id":"INC-13784","date":"2026-06","year":2026,"title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54782"],"affected":"nuget/CoreWCF.Primitives, nuget/CoreWCF.Primitives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54782"},{"id":"INC-13785","date":"2026-06","year":2026,"title":"CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54781"],"affected":"nuget/CoreWCF.Primitives, nuget/CoreWCF.Primitives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54781"},{"id":"INC-13786","date":"2026-06","year":2026,"title":"CoreWCF: SAML token replay protection is inoperative","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54779"],"affected":"nuget/CoreWCF.Primitives, nuget/CoreWCF.Primitives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54779"},{"id":"INC-13787","date":"2026-06","year":2026,"title":"CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54774"],"affected":"nuget/CoreWCF.Primitives, nuget/CoreWCF.Primitives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54774"},{"id":"INC-13788","date":"2026-06","year":2026,"title":"parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55778"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55778"},{"id":"INC-13789","date":"2026-06","year":2026,"title":"jupyterlab-git extension: Stored XSS leading to RCE","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54527"],"affected":"npm/@jupyterlab/git, pip/jupyterlab-git-core, pip/jupyterlab-git","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54527"},{"id":"INC-13790","date":"2026-06","year":2026,"title":"Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54499"],"affected":"pip/stanza","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54499"},{"id":"INC-13791","date":"2026-06","year":2026,"title":"Arbitrary host CRI log file read via symlink following in CRI checkpoint restore","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53489"],"affected":"go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53489"},{"id":"INC-13792","date":"2026-06","year":2026,"title":"containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53488"],"affected":"go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53488"},{"id":"INC-13793","date":"2026-06","year":2026,"title":"containerd: CRI checkpoint import allows local image tag poisoning","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50195"],"affected":"go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2, go/github.com/containerd/containerd/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50195"},{"id":"INC-13794","date":"2026-06","year":2026,"title":"symfony/ux-autocomplete: XSS via unescaped AJAX response data","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49216"],"affected":"composer/symfony/ux-autocomplete, composer/symfony/ux-autocomplete","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49216"},{"id":"INC-13795","date":"2026-06","year":2026,"title":"symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49215"],"affected":"composer/symfony/ux-live-component, composer/symfony/ux-live-component","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49215"},{"id":"INC-13796","date":"2026-06","year":2026,"title":"symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49212"],"affected":"composer/symfony/ux-live-component, composer/symfony/ux-live-component","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49212"},{"id":"INC-13797","date":"2026-06","year":2026,"title":"symfony/ux-live-component: XSS via attacker-controlled child component tag","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49210"],"affected":"composer/symfony/ux-live-component, composer/symfony/ux-live-component","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49210"},{"id":"INC-13798","date":"2026-06","year":2026,"title":"Hugo: XSS via unescaped code-fence language in default code block renderer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/gohugoio/hugo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q76j-gcg9-vxc6"},{"id":"INC-13799","date":"2026-06","year":2026,"title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@openzeppelin/wizard-stylus, npm/@openzeppelin/wizard-stellar, npm/@openzeppelin/wizard-cairo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9wxg-vf3r-56hc"},{"id":"INC-13800","date":"2026-06","year":2026,"title":"Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-phwj-rprq-35pp"},{"id":"INC-13801","date":"2026-06","year":2026,"title":"Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/agentic-flow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vcv2-r9jh-99m5"},{"id":"INC-13802","date":"2026-06","year":2026,"title":"ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/ouroboros-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jv2h-4p9v-wf5w"},{"id":"INC-13803","date":"2026-06","year":2026,"title":"agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/agent-coderag","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wg5p-8h9p-3mr7"},{"id":"INC-13804","date":"2026-06","year":2026,"title":"Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12530"],"affected":"pip/bedrock-agentcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12530"},{"id":"INC-13805","date":"2026-06","year":2026,"title":"tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55832"],"affected":"rust/tract-onnx, rust/tract-onnx, rust/tract-onnx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55832"},{"id":"INC-13806","date":"2026-06","year":2026,"title":"guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55766"],"affected":"composer/guzzlehttp/psr7","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55766"},{"id":"INC-13807","date":"2026-06","year":2026,"title":"undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6734","CVE-2026-9697"],"affected":"npm/undici, npm/undici","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6734"},{"id":"INC-13808","date":"2026-06","year":2026,"title":"Network-AI: Improper Neutralization of Special Elements used in an OS Command","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54051"],"affected":"npm/network-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54051"},{"id":"INC-13809","date":"2026-06","year":2026,"title":"Duplicate Advisory: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-56078"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fwh2-95jw-g4j6"},{"id":"INC-13810","date":"2026-06","year":2026,"title":"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-0755"],"affected":"npm/gemini-mcp-tool","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0755"},{"id":"INC-13811","date":"2026-06","year":2026,"title":"[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44691"],"affected":"npm/@theia/workspace, npm/@theia/task, npm/@theia/debug","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44691"},{"id":"INC-13812","date":"2026-06","year":2026,"title":"budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/budibase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qqf5-x7mj-v43p"},{"id":"INC-13813","date":"2026-06","year":2026,"title":"netlicensing-mcp: REST Path Traversal Bypasses Token Redaction","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/netlicensing-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hxpf-9xvq-wph8"},{"id":"INC-13814","date":"2026-06","year":2026,"title":"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"npm/@agenticmail/openclaw, npm/@agenticmail/codex, npm/@agenticmail/claudecode","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fq4x-789w-jg5h"},{"id":"INC-13815","date":"2026-06","year":2026,"title":"AgenticMail: Cross-agent task authorization bypass in AgenticMail API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@agenticmail/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hjwc-26pj-v3pm"},{"id":"INC-13816","date":"2026-06","year":2026,"title":"Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54695"],"affected":"pip/pipecat-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54695"},{"id":"INC-13817","date":"2026-06","year":2026,"title":"Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49276","CVE-2026-54002"],"affected":"composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54002"},{"id":"INC-13818","date":"2026-06","year":2026,"title":"BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12566"],"affected":"pip/bbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12566"},{"id":"INC-13819","date":"2026-06","year":2026,"title":"Podman: WORKDIR symlink traversal vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55686"],"affected":"go/github.com/containers/podman/v3, go/github.com/containers/podman/v4, go/github.com/containers/podman/v5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55686"},{"id":"INC-13820","date":"2026-06","year":2026,"title":"python-statemachine SCXML <data expr> Eval Injection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47103"],"affected":"pip/python-statemachine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47103"},{"id":"INC-13821","date":"2026-06","year":2026,"title":"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cmwh-pvxp-8882"},{"id":"INC-13822","date":"2026-06","year":2026,"title":"praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cwj8-7gp2-ggcw"},{"id":"INC-13823","date":"2026-06","year":2026,"title":"PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6jcq-6546-qrrw"},{"id":"INC-13824","date":"2026-06","year":2026,"title":"PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8ccj-p46r-jwqq"},{"id":"INC-13825","date":"2026-06","year":2026,"title":"PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4pcv-mg8v-vrgf"},{"id":"INC-13826","date":"2026-06","year":2026,"title":"PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-29w3-p9w9-wc47"},{"id":"INC-13827","date":"2026-06","year":2026,"title":"PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jxcw-qp4h-6jfq"},{"id":"INC-13828","date":"2026-06","year":2026,"title":"PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7qw2-w5rc-37x2"},{"id":"INC-13829","date":"2026-06","year":2026,"title":"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5jv7-2mjm-h6qj"},{"id":"INC-13830","date":"2026-06","year":2026,"title":"npm PraisonAI AgentLoop onToolCall approval runs after tool execution","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h2w2-v7j6-xqm4"},{"id":"INC-13831","date":"2026-06","year":2026,"title":"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j4f3-55x4-r6q2"},{"id":"INC-13832","date":"2026-06","year":2026,"title":"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9752-mhqh-h34f"},{"id":"INC-13833","date":"2026-06","year":2026,"title":"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p69m-4f92-2v84"},{"id":"INC-13834","date":"2026-06","year":2026,"title":"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vjv9-7m7j-h833"},{"id":"INC-13835","date":"2026-06","year":2026,"title":"npm PraisonAI codeMode sandbox escape via Function constructor","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vmmj-pfw7-fjwp"},{"id":"INC-13836","date":"2026-06","year":2026,"title":"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gqmf-56h7-rrpf"},{"id":"INC-13837","date":"2026-06","year":2026,"title":"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4qq2-2j2x-x62c"},{"id":"INC-13838","date":"2026-06","year":2026,"title":"PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c969-5x3p-vq3v"},{"id":"INC-13839","date":"2026-06","year":2026,"title":"PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f44v-7qgw-9gh9"},{"id":"INC-13840","date":"2026-06","year":2026,"title":"PraisonAI Code agent tools fail open without a workspace boundary","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gcq3-mfvh-3x25"},{"id":"INC-13841","date":"2026-06","year":2026,"title":"PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p75f-6fp4-p57w"},{"id":"INC-13842","date":"2026-06","year":2026,"title":"PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x92v-rpx6-p6cw"},{"id":"INC-13843","date":"2026-06","year":2026,"title":"PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rh39-9c67-59mh"},{"id":"INC-13844","date":"2026-06","year":2026,"title":"PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-892r-p3jq-jp24"},{"id":"INC-13845","date":"2026-06","year":2026,"title":"PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x8cv-xmq7-p8xp"},{"id":"INC-13846","date":"2026-06","year":2026,"title":"PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rjvw-7vvw-549v"},{"id":"INC-13847","date":"2026-06","year":2026,"title":"PraisonAI: Jobs API exposes agent-execution endpoints with no authentication","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fq2m-6wqh-x44g"},{"id":"INC-13848","date":"2026-06","year":2026,"title":"PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2rcg-mm5h-xchx"},{"id":"INC-13849","date":"2026-06","year":2026,"title":"praisonai: recipe serve auth middleware silently disables itself when no secret is set","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j4hj-7hfh-g2f4"},{"id":"INC-13850","date":"2026-06","year":2026,"title":"praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vxgj-xg5c-p4h7"},{"id":"INC-13851","date":"2026-06","year":2026,"title":"PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents, pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4869-x4pr-q22x"},{"id":"INC-13852","date":"2026-06","year":2026,"title":"PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p4pj-vh7h-6cqh"},{"id":"INC-13853","date":"2026-06","year":2026,"title":"PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x227-pf99-vffg"},{"id":"INC-13854","date":"2026-06","year":2026,"title":"PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pv2j-rghr-v5r9"},{"id":"INC-13855","date":"2026-06","year":2026,"title":"PraisonAI: SpiderTools redirect-target SSRF protection bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6h9p-93hq-q7h6"},{"id":"INC-13856","date":"2026-06","year":2026,"title":"PraisonAI: Compute-bridged file tools allow shell command injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w6h2-fr4q-xvxv"},{"id":"INC-13857","date":"2026-06","year":2026,"title":"PraisonAI recipe.run_stream skips dangerous-tool policy enforcement","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v847-hxxw-3pxg"},{"id":"INC-13858","date":"2026-06","year":2026,"title":"PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-63v4-w882-g4x2"},{"id":"INC-13859","date":"2026-06","year":2026,"title":"PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fc26-m9pf-v56q"},{"id":"INC-13860","date":"2026-06","year":2026,"title":"PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j7qx-p75m-wp7g"},{"id":"INC-13861","date":"2026-06","year":2026,"title":"PraisonAI Slack app_mention bypasses configured user/channel authorization","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qvpf-j64c-jmhr"},{"id":"INC-13862","date":"2026-06","year":2026,"title":"PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5qw8-f2g9-ff29"},{"id":"INC-13863","date":"2026-06","year":2026,"title":"PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/praisonai, pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vmf9-xx9w-86wx"},{"id":"INC-13864","date":"2026-06","year":2026,"title":"PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-22cj-m4wf-fv2c"},{"id":"INC-13865","date":"2026-06","year":2026,"title":"PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8579-rgg5-ph2m"},{"id":"INC-13866","date":"2026-06","year":2026,"title":"PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-35w5-pcw4-jx94"},{"id":"INC-13867","date":"2026-06","year":2026,"title":"JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"maven/org.jline:jline-remote-telnet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-47qp-hqvx-6r3f"},{"id":"INC-13868","date":"2026-06","year":2026,"title":"Docker MCP Gateway: Argument injection via OCI image label YAML","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55887"],"affected":"go/github.com/docker/mcp-gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55887"},{"id":"INC-13869","date":"2026-06","year":2026,"title":"Gotenberg: SSRF via LibreOffice document processing","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55229"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55229"},{"id":"INC-13870","date":"2026-06","year":2026,"title":"Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55225"],"affected":"maven/io.strimzi:strimzi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55225"},{"id":"INC-13871","date":"2026-06","year":2026,"title":"ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55671"],"affected":"go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55671"},{"id":"INC-13872","date":"2026-06","year":2026,"title":"Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55742","CVE-2026-55746"],"affected":"composer/cotonti/cotonti","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55746"},{"id":"INC-13873","date":"2026-06","year":2026,"title":"Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53869","CVE-2026-53870"],"affected":"pip/hermes-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53869"},{"id":"INC-13874","date":"2026-06","year":2026,"title":"HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-55471"],"affected":"maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55471"},{"id":"INC-13875","date":"2026-06","year":2026,"title":"HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55470"],"affected":"maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55470"},{"id":"INC-13876","date":"2026-06","year":2026,"title":"Filament: Disabled RichEditor field state can be used for XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55409"],"affected":"composer/filament/forms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55409"},{"id":"INC-13877","date":"2026-06","year":2026,"title":"LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55405"],"affected":"maven/dev.langchain4j:langchain4j-pgvector, maven/dev.langchain4j:langchain4j-pgvector,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55405"},{"id":"INC-13878","date":"2026-06","year":2026,"title":"earmark: Stored XSS via unescaped HTML attribute values","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48591"],"affected":"erlang/earmark","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48591"},{"id":"INC-13879","date":"2026-06","year":2026,"title":"Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55636"],"affected":"go/github.com/projectcapsule/capsule","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55636"},{"id":"INC-13880","date":"2026-06","year":2026,"title":"Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28737"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28737"},{"id":"INC-13881","date":"2026-06","year":2026,"title":"Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24791"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24791"},{"id":"INC-13882","date":"2026-06","year":2026,"title":"Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22555"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22555"},{"id":"INC-13883","date":"2026-06","year":2026,"title":"NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53931"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53931"},{"id":"INC-13884","date":"2026-06","year":2026,"title":"NocoDB: Server-Side Request Forgery via Base Migration URL","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53930"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53930"},{"id":"INC-13885","date":"2026-06","year":2026,"title":"NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53927"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53927"},{"id":"INC-13886","date":"2026-06","year":2026,"title":"Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53765"],"affected":"npm/chrome-devtools-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53765"},{"id":"INC-13887","date":"2026-06","year":2026,"title":"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-664h-gpgq-h6xx"},{"id":"INC-13888","date":"2026-06","year":2026,"title":"Pi Agent: Pi loads project-local extensions without approval","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54325"],"affected":"npm/@earendil-works/pi-coding-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54325"},{"id":"INC-13889","date":"2026-06","year":2026,"title":"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54328"],"affected":"npm/@mariozechner/pi-coding-agent, npm/@earendil-works/pi-coding-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54328"},{"id":"INC-13890","date":"2026-06","year":2026,"title":"Pi Agent: Race condition in Pi auth.json writes could expose stored credentials","severity":"Low","attack_vector":"xss","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54326","CVE-2026-54327"],"affected":"npm/@earendil-works/pi-coding-agent, npm/@mariozechner/pi-coding-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54327"},{"id":"INC-13891","date":"2026-06","year":2026,"title":"Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28699"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28699"},{"id":"INC-13892","date":"2026-06","year":2026,"title":"Cross-site scripting via <NoScript> slot content in Nuxt's head components","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/nuxt, npm/nuxt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m3q2-p4fw-w38m"},{"id":"INC-13893","date":"2026-06","year":2026,"title":"n8n: Public API Execution Retry Authorization Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h3jj-5f3v-3685"},{"id":"INC-13894","date":"2026-06","year":2026,"title":"Caddy: stripHTML template function bypass","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-52846"],"affected":"go/github.com/caddyserver/caddy, go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52846"},{"id":"INC-13895","date":"2026-06","year":2026,"title":"Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52845"],"affected":"go/github.com/caddyserver/caddy, go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52845"},{"id":"INC-13896","date":"2026-06","year":2026,"title":"Caddy: Windows `file_server` path authorization bypass via encoded backslash","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-52844"],"affected":"go/github.com/caddyserver/caddy, go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52844"},{"id":"INC-13897","date":"2026-06","year":2026,"title":"yt-dlp: Arbitrary code execution via manifest downloads with aria2c","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50574"],"affected":"pip/yt-dlp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50574"},{"id":"INC-13898","date":"2026-06","year":2026,"title":"Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7cx2-g3h9-382p"},{"id":"INC-13899","date":"2026-06","year":2026,"title":"Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f989-c77f-r2cq"},{"id":"INC-13900","date":"2026-06","year":2026,"title":"Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-56266"],"affected":"pip/crawl4ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56266"},{"id":"INC-13901","date":"2026-06","year":2026,"title":"Hugo: XSS via text/html content files","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50133"],"affected":"go/github.com/gohugoio/hugo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50133"},{"id":"INC-13902","date":"2026-06","year":2026,"title":"Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49406"],"affected":"rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49406"},{"id":"INC-13903","date":"2026-06","year":2026,"title":"Deno: Miller-Rabin Primality Test Allows Zero Rounds","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49440"],"affected":"rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49440"},{"id":"INC-13904","date":"2026-06","year":2026,"title":"n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hv7x-3x78-gx53"},{"id":"INC-13905","date":"2026-06","year":2026,"title":"Astro: XSS via Unescaped Attribute Names in Spread Props","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54298"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54298"},{"id":"INC-13906","date":"2026-06","year":2026,"title":"Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54293"],"affected":"pip/nltk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54293"},{"id":"INC-13907","date":"2026-06","year":2026,"title":"Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45491"],"affected":"nuget/Microsoft.NETCore.App.Runtime.osx-arm64, nuget/Microsoft.NETCore.App.Runtime.osx-arm64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45491"},{"id":"INC-13908","date":"2026-06","year":2026,"title":"Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/bleach","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gj48-438w-jh9v"},{"id":"INC-13909","date":"2026-06","year":2026,"title":"Astro: Reflected XSS via unescaped slot name","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50146"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50146"},{"id":"INC-13910","date":"2026-06","year":2026,"title":"Nuxt dev server vite-node IPC socket is world-connectable on Linux","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/nuxt, npm/nuxt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-534h-c3cw-v3h9"},{"id":"INC-13911","date":"2026-06","year":2026,"title":"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53721"],"affected":"npm/nuxt, npm/nuxt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53721"},{"id":"INC-13912","date":"2026-06","year":2026,"title":"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56326"],"affected":"npm/nuxt, npm/nuxt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56326"},{"id":"INC-13913","date":"2026-06","year":2026,"title":"Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48043","CVE-2026-50020"],"affected":"maven/io.netty:netty-codec-http, maven/io.netty:netty-codec-http","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020"},{"id":"INC-13914","date":"2026-06","year":2026,"title":"UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48125"],"affected":"npm/ua-parser-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48125"},{"id":"INC-13915","date":"2026-06","year":2026,"title":"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vxr8-fq34-vvx9"},{"id":"INC-13916","date":"2026-06","year":2026,"title":"Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45591"],"affected":"nuget/Microsoft.AspNetCore.SignalR.Protocols.MessagePack, nuget/Microsoft.AspNetCore.SignalR.Protocols.MessagePack,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45591"},{"id":"INC-13917","date":"2026-06","year":2026,"title":"aiohttp: CRLF injection in multipart headers","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50269"],"affected":"pip/aiohttp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50269"},{"id":"INC-13918","date":"2026-06","year":2026,"title":"Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53633"],"affected":"npm/vite-plus, npm/@vitest/browser, npm/@vitest/browser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53633"},{"id":"INC-13919","date":"2026-06","year":2026,"title":"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gvmj-g25r-r7wr"},{"id":"INC-13920","date":"2026-06","year":2026,"title":"DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49978"],"affected":"npm/dompurify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978"},{"id":"INC-13921","date":"2026-06","year":2026,"title":"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x4vx-rjvf-j5p4"},{"id":"INC-13922","date":"2026-06","year":2026,"title":"DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49458"],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49458"},{"id":"INC-13923","date":"2026-06","year":2026,"title":"DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49459"],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49459"},{"id":"INC-13924","date":"2026-06","year":2026,"title":"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/nodemailer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wqvq-jvpq-h66f"},{"id":"INC-13925","date":"2026-06","year":2026,"title":"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/nodemailer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r7g4-qg5f-qqm2"},{"id":"INC-13926","date":"2026-06","year":2026,"title":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12143"],"affected":"npm/form-data, npm/form-data, npm/form-data","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143"},{"id":"INC-13927","date":"2026-06","year":2026,"title":"@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-54264"],"affected":"npm/@angular/service-worker, npm/@angular/service-worker, npm/@angular/service-worker","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54264"},{"id":"INC-13928","date":"2026-06","year":2026,"title":"@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54266"],"affected":"npm/@angular/common, npm/@angular/common, npm/@angular/common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54266"},{"id":"INC-13929","date":"2026-06","year":2026,"title":"@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50556"],"affected":"npm/@angular/platform-server, npm/@angular/platform-server, npm/@angular/platform-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50556"},{"id":"INC-13930","date":"2026-06","year":2026,"title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53550"],"affected":"npm/js-yaml, npm/js-yaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550"},{"id":"INC-13931","date":"2026-06","year":2026,"title":"@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50171"],"affected":"npm/@angular/common, npm/@angular/common, npm/@angular/common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50171"},{"id":"INC-13932","date":"2026-06","year":2026,"title":"@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-50170"],"affected":"npm/@angular/common, npm/@angular/common, npm/@angular/common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50170"},{"id":"INC-13933","date":"2026-06","year":2026,"title":"@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50168"],"affected":"npm/@angular/platform-server, npm/@angular/platform-server, npm/@angular/platform-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50168"},{"id":"INC-13934","date":"2026-06","year":2026,"title":"Angular Client Hydration DOM Clobbering & Response-Cache Poisoning","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54267"],"affected":"npm/@angular/core, npm/@angular/core, npm/@angular/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54267"},{"id":"INC-13935","date":"2026-06","year":2026,"title":"File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54094"],"affected":"go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54094"},{"id":"INC-13936","date":"2026-06","year":2026,"title":"ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"maven/org.connectbot.sshlib:sshlib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vc8p-8pxg-rfwg"},{"id":"INC-13937","date":"2026-06","year":2026,"title":"Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46371"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46371"},{"id":"INC-13938","date":"2026-06","year":2026,"title":"Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46370"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46370"},{"id":"INC-13939","date":"2026-06","year":2026,"title":"Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44311"],"affected":"npm/fabric","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44311"},{"id":"INC-13940","date":"2026-06","year":2026,"title":"Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/esbuild","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gv7w-rqvm-qjhr"},{"id":"INC-13941","date":"2026-06","year":2026,"title":"Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-53999"],"affected":"go/github.com/radius-project/radius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53999"},{"id":"INC-13942","date":"2026-06","year":2026,"title":"TYPO3 CMS has Broken Access Control in the Recycler Module","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47349"],"affected":"composer/typo3/cms-recycler, composer/typo3/cms-recycler, composer/typo3/cms-recycler","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47349"},{"id":"INC-13943","date":"2026-06","year":2026,"title":"TYPO3 HTML Sanitizer allows Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47344","CVE-2026-47345"],"affected":"composer/typo3/html-sanitizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47345"},{"id":"INC-13944","date":"2026-06","year":2026,"title":"TYPO3 CMS has Cross-Site Scripting in Indexed Search","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47348"],"affected":"composer/typo3/cms-indexed-search, composer/typo3/cms-indexed-search, composer/typo3/cms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47348"},{"id":"INC-13945","date":"2026-06","year":2026,"title":"nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6vgg-xhvh-38ff"},{"id":"INC-13946","date":"2026-06","year":2026,"title":"Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48151"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48151"},{"id":"INC-13947","date":"2026-06","year":2026,"title":"Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"maven/com.appsmith:server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9wcp-79g5-5c3c"},{"id":"INC-13948","date":"2026-06","year":2026,"title":"Budibase: Unvalidated VectorDB Host Parameter Enables SSRF","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48148"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48148"},{"id":"INC-13949","date":"2026-06","year":2026,"title":"Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48147"],"affected":"npm/@budibase/backend-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48147"},{"id":"INC-13950","date":"2026-06","year":2026,"title":"GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58175"],"affected":"maven/org.geoserver.web:gs-web-app, maven/org.geoserver:gs-main, maven/org.geoserver:gs-main","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58175"},{"id":"INC-13951","date":"2026-06","year":2026,"title":"Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48146"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48146"},{"id":"INC-13952","date":"2026-06","year":2026,"title":"Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48128"],"affected":"npm/budibase","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48128"},{"id":"INC-13953","date":"2026-06","year":2026,"title":"LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48121"],"affected":"npm/@langchain/langgraph-checkpoint-mongodb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48121"},{"id":"INC-13954","date":"2026-06","year":2026,"title":"Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/grumpydictator/firefly-iii","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6jq6-x4cx-qvcm"},{"id":"INC-13955","date":"2026-06","year":2026,"title":"Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48110"],"affected":"rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48110"},{"id":"INC-13956","date":"2026-06","year":2026,"title":"Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48108"],"affected":"rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48108"},{"id":"INC-13957","date":"2026-06","year":2026,"title":"Russh: Unchecked keyboard-interactive prompt count in client auth path","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48107"],"affected":"rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48107"},{"id":"INC-13958","date":"2026-06","year":2026,"title":"Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48053"],"affected":"pip/kolibri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48053"},{"id":"INC-13959","date":"2026-06","year":2026,"title":"Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48039"],"affected":"pip/meta-ads-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48039"},{"id":"INC-13960","date":"2026-06","year":2026,"title":"guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53723"],"affected":"composer/guzzlehttp/guzzle-services","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53723"},{"id":"INC-13961","date":"2026-06","year":2026,"title":"PDM: Project-Local State and Config Writes Follow Symlinks","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47763"],"affected":"pip/pdm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47763"},{"id":"INC-13962","date":"2026-06","year":2026,"title":"Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47753"],"affected":"go/github.com/lxc/incus/v7","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47753"},{"id":"INC-13963","date":"2026-06","year":2026,"title":"Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47751"],"affected":"actions/anthropics/claude-code-action","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47751"},{"id":"INC-13964","date":"2026-06","year":2026,"title":"Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48061"],"affected":"pip/litestar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48061"},{"id":"INC-09436","date":"2026-06","year":2026,"title":"Litestar has HTML Injection Through its CSRF Token","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25478","CVE-2026-48060"],"affected":"pip/litestar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48060"},{"id":"INC-09708","date":"2026-06","year":2026,"title":"Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47253"],"affected":"go/github.com/julien040/anyquery","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47253"},{"id":"INC-13965","date":"2026-06","year":2026,"title":"Jenkins: Stored XSS vulnerability in node offline cause description","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53441"],"affected":"maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53441"},{"id":"INC-09709","date":"2026-06","year":2026,"title":"Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49396"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49396"},{"id":"INC-09710","date":"2026-06","year":2026,"title":"Go Restful API Boilerplate: Hardcoded JWT Secret \"random\" Allows Token Forgery","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48031"],"affected":"go/github.com/dhax/go-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48031"},{"id":"INC-09711","date":"2026-06","year":2026,"title":"Papra HTTP redirect bypass can lead to SSRF via webhook delivery system","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48051"],"affected":"npm/@papra/webhooks","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48051"},{"id":"INC-08219","date":"2026-06","year":2026,"title":"Dex: Token-exchange endpoint is missing AllowedConnectors enforcement","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/dexidp/dex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7qjx-gp9h-65qj"},{"id":"INC-08220","date":"2026-06","year":2026,"title":"nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47725"],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47725"},{"id":"INC-08221","date":"2026-06","year":2026,"title":"nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47724"],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47724"},{"id":"INC-08222","date":"2026-06","year":2026,"title":"nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47722"],"affected":"go/github.com/juev/nebula-mesh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47722"},{"id":"INC-08223","date":"2026-06","year":2026,"title":"FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47721"],"affected":"npm/fuxa-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47721"},{"id":"INC-08224","date":"2026-06","year":2026,"title":"Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47252"],"affected":"go/github.com/julien040/anyquery/plugins/safari, go/github.com/julien040/anyquery/plugins/edge,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47252"},{"id":"INC-13966","date":"2026-06","year":2026,"title":"Routinator crashes when encountering maliciously crafted RRDP XML files","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49235"],"affected":"rust/routinator","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49235"},{"id":"INC-08225","date":"2026-06","year":2026,"title":"Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47730","CVE-2026-47732"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47732"},{"id":"INC-13967","date":"2026-06","year":2026,"title":"Bugsink: DOS using large numbers of event tags","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53954"],"affected":"pip/bugsink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53954"},{"id":"INC-08227","date":"2026-06","year":2026,"title":"Shopper: Multiple data integrity and disclosure issues in admin Livewire components","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47743"],"affected":"composer/shopper/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47743"},{"id":"INC-08229","date":"2026-06","year":2026,"title":"NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47731"],"affected":"pip/ait-core, pip/ait-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47731"},{"id":"INC-08230","date":"2026-06","year":2026,"title":"Authenticated Remote Code Execution via loadReader functionName code injection in DbGate","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47668","CVE-2026-47670"],"affected":"npm/dbgate-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47670"},{"id":"INC-08231","date":"2026-06","year":2026,"title":"praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-47419"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47419"},{"id":"INC-08232","date":"2026-06","year":2026,"title":"NocoDB: Missing Ownership Check in MCP Attachment Read","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47383","CVE-2026-47388"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47388"},{"id":"INC-08233","date":"2026-06","year":2026,"title":"NocoDB: Reflected Cross-Site Scripting via Password Reset Token","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47376"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47376"},{"id":"INC-08234","date":"2026-06","year":2026,"title":"wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47261"],"affected":"rust/wasmtime-wasi, rust/wasmtime-wasi, rust/wasmtime-wasi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47261"},{"id":"INC-08236","date":"2026-06","year":2026,"title":"Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45720","CVE-2026-45726"],"affected":"go/github.com/siderolabs/omni, go/github.com/siderolabs/omni","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45726"},{"id":"INC-08237","date":"2026-06","year":2026,"title":"MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47708"],"affected":"pip/stata-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47708"},{"id":"INC-08238","date":"2026-06","year":2026,"title":"Shopware: Admin API ACL Bypass in Order State Transition Endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-48012","CVE-2026-48014"],"affected":"composer/shopware/core, composer/shopware/core, composer/shopware/platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48014"},{"id":"INC-13968","date":"2026-06","year":2026,"title":"WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54458"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54458"},{"id":"INC-08240","date":"2026-06","year":2026,"title":"WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50183"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50183"},{"id":"INC-08241","date":"2026-06","year":2026,"title":"WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50182"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50182"},{"id":"INC-08242","date":"2026-06","year":2026,"title":"WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49279"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49279"},{"id":"INC-08243","date":"2026-06","year":2026,"title":"WWBN AVideo: Stored XSS via unescaped Gallery category description","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47694"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47694"},{"id":"INC-08244","date":"2026-06","year":2026,"title":"OpenMeter: SQL injection through meter creation","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-8462"],"affected":"go/github.com/openmeterio/openmeter","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8462"},{"id":"INC-08245","date":"2026-06","year":2026,"title":"Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47671"],"affected":"go/github.com/nhost/nhost","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47671"},{"id":"INC-08246","date":"2026-06","year":2026,"title":"kas's late signature validation may allow unnoticed repository manipulations","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47192"],"affected":"pip/kas","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47192"},{"id":"INC-08247","date":"2026-06","year":2026,"title":"Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-45730"],"affected":"go/github.com/nuclio/nuclio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45730"},{"id":"INC-08248","date":"2026-06","year":2026,"title":"Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44496"],"affected":"npm/axios, npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496"},{"id":"INC-08249","date":"2026-06","year":2026,"title":"Froxlor's API Authentication bypasses 2FA Authentication","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41236","CVE-2026-52793"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52793"},{"id":"INC-08250","date":"2026-06","year":2026,"title":"Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44182"],"affected":"pip/jupyter_enterprise_gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44182"},{"id":"INC-08251","date":"2026-06","year":2026,"title":"Docling: Unsafe URI and Path Handling in HTML Backend","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44016","CVE-2026-44017","CVE-2026-44018","CVE-2026-47214"],"affected":"pip/docling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47214"},{"id":"INC-08252","date":"2026-06","year":2026,"title":"Docling: Unsafe XML Entity Expansion in USPTO Patent Backend","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44020"],"affected":"pip/docling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44020"},{"id":"INC-08253","date":"2026-06","year":2026,"title":"malla: Stored XSS via Meshtastic node names in multiple frontend pages","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43980"],"affected":"pip/malla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43980"},{"id":"INC-08254","date":"2026-06","year":2026,"title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33244"],"affected":"npm/react-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33244"},{"id":"INC-08255","date":"2026-06","year":2026,"title":"praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47412"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47412"},{"id":"INC-08256","date":"2026-06","year":2026,"title":"praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47415"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47415"},{"id":"INC-08257","date":"2026-06","year":2026,"title":"praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47411"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47411"},{"id":"INC-08258","date":"2026-06","year":2026,"title":"praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47417"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47417"},{"id":"INC-08259","date":"2026-06","year":2026,"title":"praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47418"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47418"},{"id":"INC-08260","date":"2026-06","year":2026,"title":"Vitest browser mode serves unsanitized otelCarrier query parameter as inline script","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47428"],"affected":"npm/@vitest/browser, npm/@vitest/browser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47428"},{"id":"INC-08261","date":"2026-06","year":2026,"title":"DOMPurify XSS via selectedcontent re-clone","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47423"],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47423"},{"id":"INC-08262","date":"2026-06","year":2026,"title":"Nezha's authenticated agents can forge service-monitor results for other users' services","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48119"],"affected":"go/github.com/nezhahq/nezha, go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48119"},{"id":"INC-13969","date":"2026-06","year":2026,"title":"Malware in autotel-mcp-instrumentation","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/autotel-mcp-instrumentation, npm/autotel-mcp-instrumentation, npm/autotel-mcp-instrumentation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7cv4-gfx4-2c3v"},{"id":"INC-13970","date":"2026-06","year":2026,"title":"Malware in autotel-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/autotel-mcp, npm/autotel-mcp, npm/autotel-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3wmg-66hp-xhv9"},{"id":"INC-13971","date":"2026-06","year":2026,"title":"Malware in ai-sdk-ollama","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/ai-sdk-ollama, npm/ai-sdk-ollama, npm/ai-sdk-ollama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m9j7-x8ww-5jwr"},{"id":"INC-13972","date":"2026-06","year":2026,"title":"Malware in free-anthropic-claude","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/free-anthropic-claude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3h58-8ch3-mgp3"},{"id":"INC-13973","date":"2026-06","year":2026,"title":"Malware in @mastra/voice-openai","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/voice-openai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8p42-82r4-mf65"},{"id":"INC-13974","date":"2026-06","year":2026,"title":"Malware in @mastra/voice-openai-realtime","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/voice-openai-realtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4rfq-w3x8-rrx3"},{"id":"INC-13975","date":"2026-06","year":2026,"title":"Malware in @mastra/mcp-registry-registry","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/mcp-registry-registry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5w62-p653-57mf"},{"id":"INC-13976","date":"2026-06","year":2026,"title":"Malware in @mastra/qdrant","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j93j-53rg-7g7g"},{"id":"INC-13977","date":"2026-06","year":2026,"title":"Malware in @mastra/mcp-docs-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/mcp-docs-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wxp6-9hmr-928g"},{"id":"INC-13978","date":"2026-06","year":2026,"title":"Malware in @mastra/mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mastra/mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wfr8-6x4q-hpr3"},{"id":"INC-13979","date":"2026-06","year":2026,"title":"Malware in sp-api-dev-assistant-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/sp-api-dev-assistant-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hgm9-w4fm-65m9"},{"id":"INC-09716","date":"2026-06","year":2026,"title":"Malware in @redhat-cloud-services/hcc-feo-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@redhat-cloud-services/hcc-feo-mcp, npm/@redhat-cloud-services/hcc-feo-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vgm5-jmvr-cjgf"},{"id":"INC-01210","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: possible double-free of cctx->remote_heap fastrpc_init_create_static_process() may free cctx...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31730"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31730"},{"id":"INC-01665","date":"2026-05","year":2026,"title":"PPTAgent — Rce (CVE-2026-42079)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42078","CVE-2026-42079","CVE-2026-42080"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42079"},{"id":"INC-00897","date":"2026-05","year":2026,"title":"Dify — Xss (CVE-2026-42138)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34082","CVE-2026-42138"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42138"},{"id":"INC-01206","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 (\"ext4: al...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43067"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43067"},{"id":"INC-01805","date":"2026-05","year":2026,"title":"SQLBot — Prompt Injection (CVE-2026-33324)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-33324"],"affected":"fit2cloud/sqlbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33324"},{"id":"INC-01558","date":"2026-05","year":2026,"title":"Onyx — Vulnerability (CVE-2026-42276)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42276"],"affected":"onyx/onyx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42276"},{"id":"INC-01309","date":"2026-05","year":2026,"title":"Langfuse — Auth Bypass (CVE-2026-41487)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41487"],"affected":"langfuse/langfuse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41487"},{"id":"INC-00634","date":"2026-05","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-42456)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42456"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42456"},{"id":"INC-01353","date":"2026-05","year":2026,"title":"Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7817"],"affected":"pgadmin/pgadmin_4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7817"},{"id":"INC-00858","date":"2026-05","year":2026,"title":"CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading component.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31249","CVE-2026-31250","CVE-2026-31252"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31252"},{"id":"INC-01277","date":"2026-05","year":2026,"title":"JunoClaw — Vulnerability (CVE-2026-43992)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43989","CVE-2026-43990","CVE-2026-43991","CVE-2026-43992","CVE-2026-43993"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43992"},{"id":"INC-01352","date":"2026-05","year":2026,"title":"LobeHub — Xss (CVE-2026-42045)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42045"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42045"},{"id":"INC-08264","date":"2026-05","year":2026,"title":"Open WebUI — Auth Bypass (CVE-2026-44556)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44556"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44556"},{"id":"INC-08265","date":"2026-05","year":2026,"title":"Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regar...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41947","CVE-2026-41949"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41947"},{"id":"INC-08266","date":"2026-05","year":2026,"title":"Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41863"],"affected":"vmware/spring_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41863"},{"id":"INC-08267","date":"2026-05","year":2026,"title":"LangChain — Deserialization (CVE-2026-44843)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44843"],"affected":"langchain/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44843"},{"id":"INC-08268","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45920"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45920"},{"id":"INC-08269","date":"2026-05","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-45403)","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45403"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45403"},{"id":"INC-08270","date":"2026-05","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-47713)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47713"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47713"},{"id":"INC-08271","date":"2026-05","year":2026,"title":"AnythingLLM — Rce (CVE-2026-48116)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48116"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48116"},{"id":"INC-08188","date":"2026-05","year":2026,"title":"RAGFlow — Command Injection (CVE-2026-45312)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45312"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45312"},{"id":"INC-01522","date":"2026-05","year":2026,"title":"New API — Ssrf (CVE-2026-42339)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42339"],"affected":"newapi/new_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42339"},{"id":"INC-08272","date":"2026-05","year":2026,"title":"SQLBot — Auth Bypass (CVE-2026-42463)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42463"],"affected":"fit2cloud/sqlbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42463"},{"id":"INC-08189","date":"2026-05","year":2026,"title":"SillyTavern — Vulnerability (CVE-2026-44648)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44648"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44648"},{"id":"INC-08190","date":"2026-05","year":2026,"title":"SillyTavern — Vulnerability (CVE-2026-44649)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44649"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44649"},{"id":"INC-08191","date":"2026-05","year":2026,"title":"SillyTavern — Vulnerability (CVE-2026-44650)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44650"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44650"},{"id":"INC-08192","date":"2026-05","year":2026,"title":"SillyTavern — Vulnerability (CVE-2026-44651)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44651"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44651"},{"id":"INC-08193","date":"2026-05","year":2026,"title":"SillyTavern — Ssrf (CVE-2026-44652)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44652"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44652"},{"id":"INC-08194","date":"2026-05","year":2026,"title":"SillyTavern — Vulnerability (CVE-2026-46372)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46372"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46372"},{"id":"INC-01893","date":"2026-05","year":2026,"title":"The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub.","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31239"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31239"},{"id":"INC-00971","date":"2026-05","year":2026,"title":"Evolver — Path Traversal (CVE-2026-42075)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42075","CVE-2026-42076","CVE-2026-42077"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42075"},{"id":"INC-01181","date":"2026-05","year":2026,"title":"Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35435"],"affected":"microsoft/azure_ai_foundry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35435"},{"id":"INC-01682","date":"2026-05","year":2026,"title":"PromptHub — Ssrf (CVE-2026-42261)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42261"],"affected":"legeling/prompthub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42261"},{"id":"INC-00990","date":"2026-05","year":2026,"title":"FastGPT — Rce (CVE-2026-42302)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42302"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42302"},{"id":"INC-00988","date":"2026-05","year":2026,"title":"FastGPT — Dos (CVE-2026-42343)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42343"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42343"},{"id":"INC-00997","date":"2026-05","year":2026,"title":"FastGPT — Vulnerability (CVE-2026-42344)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42344"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42344"},{"id":"INC-00998","date":"2026-05","year":2026,"title":"FastGPT — Vulnerability (CVE-2026-42345)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42345"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42345"},{"id":"INC-00993","date":"2026-05","year":2026,"title":"FastGPT — Ssrf (CVE-2026-44284)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44284","CVE-2026-44286"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44284"},{"id":"INC-00572","date":"2026-05","year":2026,"title":"aiwaves-cn agents — Vulnerability (CVE-2026-8319)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8319"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8319"},{"id":"INC-00873","date":"2026-05","year":2026,"title":"DeepChat — Rce (CVE-2026-43899)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43899"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43899"},{"id":"INC-01302","date":"2026-05","year":2026,"title":"Langflow — Path Traversal (CVE-2026-42048)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42048"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42048"},{"id":"INC-00800","date":"2026-05","year":2026,"title":"ciguard — Vulnerability (CVE-2026-44220)","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44220"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44220"},{"id":"INC-08273","date":"2026-05","year":2026,"title":"Vercel’s AI Cloud is a unified platform for building modern applications.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44479"],"affected":"vercel/vercel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44479"},{"id":"INC-08274","date":"2026-05","year":2026,"title":"GitHub Copilot CLI brings AI-powered coding assistance directly to your command line.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45033"],"affected":"github/copilot-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45033"},{"id":"INC-08275","date":"2026-05","year":2026,"title":"Hatchet — Auth Bypass (CVE-2026-42572)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42572"],"affected":"hatchet/hatchet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42572"},{"id":"INC-08276","date":"2026-05","year":2026,"title":"Microsoft APM — Vulnerability (CVE-2026-44641)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44641"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44641"},{"id":"INC-08277","date":"2026-05","year":2026,"title":"Microsoft APM — Vulnerability (CVE-2026-45539)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45539","CVE-2026-46383"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45539"},{"id":"INC-08278","date":"2026-05","year":2026,"title":"Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8370"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8370"},{"id":"INC-08279","date":"2026-05","year":2026,"title":"GitLab MCP Server lets an AI agent talk directly to GitLab.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44895"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44895"},{"id":"INC-08280","date":"2026-05","year":2026,"title":"Gryph provides a security layer for AI coding agents.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45046"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45046"},{"id":"INC-08281","date":"2026-05","year":2026,"title":"FastGPT — Ssrf (CVE-2026-44285)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44285"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44285"},{"id":"INC-08282","date":"2026-05","year":2026,"title":"FastGPT — Rce (CVE-2026-44287)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44287"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44287"},{"id":"INC-01537","date":"2026-05","year":2026,"title":"nnU-Net — Vulnerability (CVE-2026-44246)","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44246"],"affected":"dkfz/nnu-net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44246"},{"id":"INC-01887","date":"2026-05","year":2026,"title":"The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions u...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3456"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3456"},{"id":"INC-01131","date":"2026-05","year":2026,"title":"GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31246"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31246"},{"id":"INC-08283","date":"2026-05","year":2026,"title":"A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9353"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9353"},{"id":"INC-01650","date":"2026-05","year":2026,"title":"pixelsock directus-mcp 1 — Ssrf (CVE-2026-7729)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7729"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7729"},{"id":"INC-01506","date":"2026-05","year":2026,"title":"n8n — Vulnerability (CVE-2026-42236)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42236"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42236"},{"id":"INC-02060","date":"2026-05","year":2026,"title":"Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool).","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35228"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35228"},{"id":"INC-01598","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44118"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44118"},{"id":"INC-01511","date":"2026-05","year":2026,"title":"n8n-MCP — Ssrf (CVE-2026-42449)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42449"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42449"},{"id":"INC-01667","date":"2026-05","year":2026,"title":"PraisonAI — Path Traversal (CVE-2026-44336)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44336"],"affected":"praison/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44336"},{"id":"INC-01509","date":"2026-05","year":2026,"title":"n8n-MCP — Auth Bypass (CVE-2026-41495)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41495"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41495"},{"id":"INC-01513","date":"2026-05","year":2026,"title":"n8n-MCP — Vulnerability (CVE-2026-42282)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42282"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42282"},{"id":"INC-01512","date":"2026-05","year":2026,"title":"n8n-MCP — Ssrf (CVE-2026-44694)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44694"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44694"},{"id":"INC-00847","date":"2026-05","year":2026,"title":"Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit ...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30635"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30635"},{"id":"INC-01597","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44995"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44995"},{"id":"INC-01596","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settin...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45001"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45001"},{"id":"INC-02097","date":"2026-05","year":2026,"title":"Wireshark MCP — Vulnerability (CVE-2026-43901)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43901"],"affected":"bx33661/wireshark_mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43901"},{"id":"INC-00015","date":"2026-05","year":2026,"title":"A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5029"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5029"},{"id":"INC-01572","date":"2026-05","year":2026,"title":"Open-WebSearch — Ssrf (CVE-2026-42260)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42260"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42260"},{"id":"INC-00584","date":"2026-05","year":2026,"title":"An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a crafted HTML page.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65719"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65719"},{"id":"INC-02870","date":"2026-05","year":2026,"title":"RMCP — Vulnerability (CVE-2026-42559)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64443","CVE-2026-42559"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42559"},{"id":"INC-08285","date":"2026-05","year":2026,"title":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44427","CVE-2026-44428","CVE-2026-44429","CVE-2026-44430","CVE-2026-45781"],"affected":"lfprojects/mcp_registry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44429"},{"id":"INC-08286","date":"2026-05","year":2026,"title":"MCP Calculate Server — Rce (CVE-2026-44717)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44717"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44717"},{"id":"INC-08287","date":"2026-05","year":2026,"title":"Lumiverse — Rce (CVE-2026-44450)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44450"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44450"},{"id":"INC-08288","date":"2026-05","year":2026,"title":"Nocturne Memory — Prompt Injection (CVE-2026-44830)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44830"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44830"},{"id":"INC-08289","date":"2026-05","year":2026,"title":"Roslyn CodeLens MCP Server — Rce (CVE-2026-45555)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45555"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45555"},{"id":"INC-08290","date":"2026-05","year":2026,"title":"n8n-MCP — Vulnerability (CVE-2026-45582)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45582"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45582"},{"id":"INC-08291","date":"2026-05","year":2026,"title":"n8n-MCP — Vulnerability (CVE-2026-45707)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45707"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45707"},{"id":"INC-08292","date":"2026-05","year":2026,"title":"mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45609"],"affected":"springaicommunity/mcp_security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45609"},{"id":"INC-08293","date":"2026-05","year":2026,"title":"Diffusers — Rce (CVE-2026-44827)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44513","CVE-2026-44827"],"affected":"huggingface/diffusers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44827"},{"id":"INC-01768","date":"2026-05","year":2026,"title":"sgl-project SGLang — Vulnerability (CVE-2026-7669)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7669"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7669"},{"id":"INC-08294","date":"2026-05","year":2026,"title":"The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5817"],"affected":"docker/docker_desktop, apple/macos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5817"},{"id":"INC-00742","date":"2026-05","year":2026,"title":"chatchat-space Langchain-Chatchat — Auth Bypass (CVE-2026-7844)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7844","CVE-2026-7845","CVE-2026-7846","CVE-2026-7847"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7844"},{"id":"INC-01314","date":"2026-05","year":2026,"title":"LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41182","CVE-2026-45134"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45134"},{"id":"INC-08296","date":"2026-05","year":2026,"title":"vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/model...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4944"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4944"},{"id":"INC-01722","date":"2026-05","year":2026,"title":"Ray — Deserialization (CVE-2026-41486)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41486"],"affected":"anyscale/ray","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41486"},{"id":"INC-08299","date":"2026-05","year":2026,"title":"Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-8596","CVE-2026-8597"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8597"},{"id":"INC-01898","date":"2026-05","year":2026,"title":"The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deserialization vulnerab...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31214"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31214"},{"id":"INC-01717","date":"2026-05","year":2026,"title":"PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31221"],"affected":"lightningai/pytorch_lightning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31221"},{"id":"INC-01892","date":"2026-05","year":2026,"title":"The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31238"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31238"},{"id":"INC-08301","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44563)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44563"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44563"},{"id":"INC-01036","date":"2026-05","year":2026,"title":"FlowiseAI Flowise — Auth Bypass (CVE-2026-8027)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8027"],"affected":"flowiseai/flowise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8027"},{"id":"INC-01038","date":"2026-05","year":2026,"title":"FlowiseAI Flowise — Info Disclosure (CVE-2026-8028)","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-8028"],"affected":"flowiseai/flowise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8028"},{"id":"INC-01207","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43112"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43112"},{"id":"INC-01211","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema c...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43341"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43341"},{"id":"INC-08302","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sen...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46227"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46227"},{"id":"INC-00856","date":"2026-05","year":2026,"title":"Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41691"],"affected":"i18next/i18next-http-backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41691"},{"id":"INC-01781","date":"2026-05","year":2026,"title":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42869"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42869"},{"id":"INC-01182","date":"2026-05","year":2026,"title":"Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41100"],"affected":"microsoft/365_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41100"},{"id":"INC-01183","date":"2026-05","year":2026,"title":"Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41614"],"affected":"microsoft/365_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41614"},{"id":"INC-01478","date":"2026-05","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-42226)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42226"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42226"},{"id":"INC-01482","date":"2026-05","year":2026,"title":"n8n — Info Disclosure (CVE-2026-42227)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-42227"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42227"},{"id":"INC-01502","date":"2026-05","year":2026,"title":"n8n — Vulnerability (CVE-2026-42228)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42228"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42228"},{"id":"INC-01503","date":"2026-05","year":2026,"title":"n8n — Vulnerability (CVE-2026-42229)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42229"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42229"},{"id":"INC-01504","date":"2026-05","year":2026,"title":"n8n — Phishing (CVE-2026-42230)","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42230"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42230"},{"id":"INC-01488","date":"2026-05","year":2026,"title":"n8n — Rce (CVE-2026-42231)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42231"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42231"},{"id":"INC-01479","date":"2026-05","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-42233)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42233"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42233"},{"id":"INC-01490","date":"2026-05","year":2026,"title":"n8n — Sandbox Escape (CVE-2026-42234)","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42234"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42234"},{"id":"INC-01505","date":"2026-05","year":2026,"title":"n8n — Vulnerability (CVE-2026-42235)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42235"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42235"},{"id":"INC-00892","date":"2026-05","year":2026,"title":"Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the s...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41948","CVE-2026-41950"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41950"},{"id":"INC-01802","date":"2026-05","year":2026,"title":"Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41705"],"affected":"vmware/spring_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41705"},{"id":"INC-08305","date":"2026-05","year":2026,"title":"fishaudio Bert-VITS2 — Path Traversal (CVE-2026-8756)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8756"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8756"},{"id":"INC-08307","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45672)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45672"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45672"},{"id":"INC-08308","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44550)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44550"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44550"},{"id":"INC-08309","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44551)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44551"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44551"},{"id":"INC-08310","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44552)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44552"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44552"},{"id":"INC-08311","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44553)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44553"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44553"},{"id":"INC-08312","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44554)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44554"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44554"},{"id":"INC-08313","date":"2026-05","year":2026,"title":"Open WebUI — Auth Bypass (CVE-2026-44555)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44555"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44555"},{"id":"INC-08314","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44557)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44557"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44557"},{"id":"INC-08315","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44558)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44558"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44558"},{"id":"INC-08316","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44559)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44559"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44559"},{"id":"INC-08317","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44560)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44560"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44560"},{"id":"INC-08318","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44561)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44561"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44561"},{"id":"INC-08319","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44562)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44562"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44562"},{"id":"INC-08320","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44564)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44564"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44564"},{"id":"INC-08321","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44568)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44568"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44568"},{"id":"INC-08322","date":"2026-05","year":2026,"title":"Open WebUI — Xss (CVE-2026-44549)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44549","CVE-2026-45314","CVE-2026-45315","CVE-2026-45316","CVE-2026-45317","CVE-2026-45318"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44549"},{"id":"INC-08323","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44565)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44565"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44565"},{"id":"INC-08324","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44566)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44566"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44566"},{"id":"INC-08325","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44567)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44567"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44567"},{"id":"INC-08326","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44569)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44569"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44569"},{"id":"INC-08327","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44570)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44570"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44570"},{"id":"INC-08328","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-44571)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44571"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44571"},{"id":"INC-08329","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45301)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45301"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45301"},{"id":"INC-08330","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45303)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45303"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45303"},{"id":"INC-08331","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45345)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45345"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45345"},{"id":"INC-08332","date":"2026-05","year":2026,"title":"Open WebUI — Ssrf (CVE-2026-45347)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45347"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45347"},{"id":"INC-01567","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45350)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28788","CVE-2026-45350"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45350"},{"id":"INC-08333","date":"2026-05","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-45351)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45351"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45351"},{"id":"INC-01564","date":"2026-05","year":2026,"title":"Open WebUI — Auth Bypass (CVE-2026-45365)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34222","CVE-2026-45365","CVE-2026-45666"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45365"},{"id":"INC-08334","date":"2026-05","year":2026,"title":"agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious meta...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10105"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10105"},{"id":"INC-01908","date":"2026-05","year":2026,"title":"titra — Vulnerability (CVE-2026-42092)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42092"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42092"},{"id":"INC-00830","date":"2026-05","year":2026,"title":"Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2026-34451","CVE-2026-41686"],"affected":"anthropic/claude_sdk_for_typescript","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41686"},{"id":"INC-01209","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: iommupt: Fix short gather if the unmap goes into a large mapping unmap has the odd behavior that it can unm...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31735"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31735"},{"id":"INC-01219","date":"2026-05","year":2026,"title":"In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40068"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40068"},{"id":"INC-01214","date":"2026-05","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg() Claude pointed out that there is a nfs4_file refc...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43193"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43193"},{"id":"INC-08335","date":"2026-05","year":2026,"title":"The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44467","CVE-2026-44470"],"affected":"anthropic/claude_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44467"},{"id":"INC-08336","date":"2026-05","year":2026,"title":"Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control character...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47090","CVE-2026-47091","CVE-2026-47092"],"affected":"jarrodwatts/claude_hud","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47090"},{"id":"INC-08337","date":"2026-05","year":2026,"title":"claude-code-cache-fix — Vulnerability (CVE-2026-45136)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45136"],"affected":"cnighswonger/claude-code-cache-fix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45136"},{"id":"INC-00756","date":"2026-05","year":2026,"title":"ChatGPTNextWeb NextChat — Vulnerability (CVE-2026-7643)","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-7177","CVE-2026-7178","CVE-2026-7643","CVE-2026-7644"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7643"},{"id":"INC-01185","date":"2026-05","year":2026,"title":"Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23668","CVE-2025-27307","CVE-2025-30786","CVE-2025-62985","CVE-2026-27068","CVE-2026-32207","CVE-2026-33230"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32207"},{"id":"INC-08338","date":"2026-05","year":2026,"title":"Vowpal Wabbit — Rce (CVE-2026-44723)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44723"],"affected":"vowpalwabbit/vowpal_wabbit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44723"},{"id":"INC-09720","date":"2026-05","year":2026,"title":"A vulnerability was determined in langflow-ai langflow up to 1.8.4.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7687"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7687"},{"id":"INC-09721","date":"2026-05","year":2026,"title":"langflow-ai langflow — Vulnerability (CVE-2026-7700)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7700"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7700"},{"id":"INC-09722","date":"2026-05","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7524"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7524"},{"id":"INC-09723","date":"2026-05","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7528"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7528"},{"id":"INC-09724","date":"2026-05","year":2026,"title":"SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7301","CVE-2026-7302","CVE-2026-7304"],"affected":"lmsys/sglang","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7301"},{"id":"INC-08516","date":"2026-05","year":2026,"title":"CodeWhale — Ssrf (CVE-2026-45310)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45310"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45310"},{"id":"INC-08515","date":"2026-05","year":2026,"title":"CodeWhale — Rce (CVE-2026-45311)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45311"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45311"},{"id":"INC-08514","date":"2026-05","year":2026,"title":"CodeWhale — Ssrf (CVE-2026-45373)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45373","CVE-2026-45374"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45373"},{"id":"INC-09725","date":"2026-05","year":2026,"title":"AutoGPT — Dos (CVE-2025-32425)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32393","CVE-2025-32425","CVE-2026-26006"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32425"},{"id":"INC-09726","date":"2026-05","year":2026,"title":"AutoGPT — Vulnerability (CVE-2026-30950)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30950"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30950"},{"id":"INC-09728","date":"2026-05","year":2026,"title":"AutoGPT — Vulnerability (CVE-2026-45023)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45023"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45023"},{"id":"INC-13980","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level au...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42433"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42433"},{"id":"INC-08817","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node.","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42434"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42434"},{"id":"INC-13981","date":"2026-05","year":2026,"title":"OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42435"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42435"},{"id":"INC-13982","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser ...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42436"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42436"},{"id":"INC-13983","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper vali...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42437"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42437"},{"id":"INC-08815","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file di...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42438"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42438"},{"id":"INC-13984","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42439","CVE-2026-43573"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42439"},{"id":"INC-13985","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43526"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43526"},{"id":"INC-13986","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43527"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43527"},{"id":"INC-13987","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfi...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43528"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43528"},{"id":"INC-13988","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boun...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43529"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43529"},{"id":"INC-13989","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43530"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43530"},{"id":"INC-13990","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43531"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43531"},{"id":"INC-13991","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43532"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43532"},{"id":"INC-08816","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storag...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43533"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43533"},{"id":"INC-08818","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43534"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43534"},{"id":"INC-13992","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final se...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43535"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43535"},{"id":"INC-13993","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43566"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43566"},{"id":"INC-13994","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43567"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43567"},{"id":"INC-13995","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43568"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43568"},{"id":"INC-13996","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider ...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43569"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43569"},{"id":"INC-13997","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43570"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43570"},{"id":"INC-13998","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43571"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43571"},{"id":"INC-13999","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43572"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43572"},{"id":"INC-14000","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval aut...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43574"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43574"},{"id":"INC-14001","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43575"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43575"},{"id":"INC-14002","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop ...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43576"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43576"},{"id":"INC-14003","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43577","CVE-2026-43580"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43577"},{"id":"INC-14004","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43578"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43578"},{"id":"INC-14005","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profi...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43579"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43579"},{"id":"INC-14006","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43581"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43581"},{"id":"INC-14007","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebin...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43582"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43582"},{"id":"INC-14008","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43583"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43583"},{"id":"INC-14009","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-ris...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43584"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43584"},{"id":"INC-14010","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43585"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43585"},{"id":"INC-14011","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command disp...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44109"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44109"},{"id":"INC-14012","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44110"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44110"},{"id":"INC-14013","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within the workspac...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44111"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44111"},{"id":"INC-14014","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intende...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44112","CVE-2026-44113"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44112"},{"id":"INC-14015","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtim...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44114"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44114"},{"id":"INC-14016","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44115"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44115"},{"id":"INC-14017","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSR...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44116"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44116"},{"id":"INC-14018","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44117","CVE-2026-45000"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44117"},{"id":"INC-14019","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when wildcard ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44991"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44991"},{"id":"INC-14020","date":"2026-05","year":2026,"title":"OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44992"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44992"},{"id":"INC-14021","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44993"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44993"},{"id":"INC-14022","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sensitive con...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44994"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44994"},{"id":"INC-08730","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41389","CVE-2026-44996"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44996"},{"id":"INC-08559","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, chil...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44997"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44997"},{"id":"INC-08747","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44998"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44998"},{"id":"INC-08558","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded as trusted ...","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44999"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44999"},{"id":"INC-14023","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45002"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45002"},{"id":"INC-14024","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45003"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45003"},{"id":"INC-14025","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setu...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45004"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45004"},{"id":"INC-14026","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45005"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45005"},{"id":"INC-08682","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to writ...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45006"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45006"},{"id":"INC-14027","date":"2026-05","year":2026,"title":"OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing b...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32905"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32905"},{"id":"INC-14028","date":"2026-05","year":2026,"title":"OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals through the exec ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32906"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32906"},{"id":"INC-14029","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands that allows authenticated senders to skip DM-only and allowFrom policy checks.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34507"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34507"},{"id":"INC-14030","date":"2026-05","year":2026,"title":"OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35630"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35630"},{"id":"INC-14031","date":"2026-05","year":2026,"title":"OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35673"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35673"},{"id":"INC-14032","date":"2026-05","year":2026,"title":"OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35674"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35674"},{"id":"INC-08339","date":"2026-05","year":2026,"title":"praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47416"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47416"},{"id":"INC-08340","date":"2026-05","year":2026,"title":"praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47414"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47414"},{"id":"INC-08341","date":"2026-05","year":2026,"title":"praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-47406"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47406"},{"id":"INC-08342","date":"2026-05","year":2026,"title":"praisonai-platform: JWT signing key defaults to hardcoded \"dev-secret-change-me\", allowing token forgery for any user when PLATFORM_ENV is unset","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47410"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47410"},{"id":"INC-08343","date":"2026-05","year":2026,"title":"PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47405"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47405"},{"id":"INC-08344","date":"2026-05","year":2026,"title":"PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47399"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47399"},{"id":"INC-08345","date":"2026-05","year":2026,"title":"PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47407"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47407"},{"id":"INC-08346","date":"2026-05","year":2026,"title":"praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47408"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47408"},{"id":"INC-08347","date":"2026-05","year":2026,"title":"PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-48169"],"affected":"pip/praisonai-platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48169"},{"id":"INC-08348","date":"2026-05","year":2026,"title":"PraisonAI has an Arbitrary File Write in Python API","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-47397"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47397"},{"id":"INC-08349","date":"2026-05","year":2026,"title":"PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-47391"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47391"},{"id":"INC-08350","date":"2026-05","year":2026,"title":"PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47394"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47394"},{"id":"INC-08351","date":"2026-05","year":2026,"title":"PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-47392"],"affected":"pip/PraisonAI, pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47392"},{"id":"INC-08352","date":"2026-05","year":2026,"title":"PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47395"],"affected":"pip/PraisonAI, pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47395"},{"id":"INC-08353","date":"2026-05","year":2026,"title":"PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44338","CVE-2026-47393"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47393"},{"id":"INC-08354","date":"2026-05","year":2026,"title":"PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-47396"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47396"},{"id":"INC-08355","date":"2026-05","year":2026,"title":"PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47390"],"affected":"pip/PraisonAI, pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47390"},{"id":"INC-08356","date":"2026-05","year":2026,"title":"PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-47398"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47398"},{"id":"INC-08357","date":"2026-05","year":2026,"title":"formie's unauthenticated front-end submission editing can overwrite existing submissions","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47266"],"affected":"composer/verbb/formie, composer/verbb/formie","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47266"},{"id":"INC-08358","date":"2026-05","year":2026,"title":"Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47268"],"affected":"go/github.com/naiba/nezha, go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47268"},{"id":"INC-08359","date":"2026-05","year":2026,"title":"Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47233"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47233"},{"id":"INC-08360","date":"2026-05","year":2026,"title":"Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47231"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47231"},{"id":"INC-08361","date":"2026-05","year":2026,"title":"Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47229"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47229"},{"id":"INC-08362","date":"2026-05","year":2026,"title":"Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47227"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47227"},{"id":"INC-08363","date":"2026-05","year":2026,"title":"Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32817","CVE-2026-47226"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47226"},{"id":"INC-08364","date":"2026-05","year":2026,"title":"BoxLite has a Timeout Bypass Vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47213"],"affected":"pip/boxlite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47213"},{"id":"INC-08365","date":"2026-05","year":2026,"title":"ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47211"],"affected":"pip/ouroboros-ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47211"},{"id":"INC-08366","date":"2026-05","year":2026,"title":"authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47201"],"affected":"go/goauthentik.io","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47201"},{"id":"INC-08367","date":"2026-05","year":2026,"title":"Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47260"],"affected":"composer/phanan/koel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47260"},{"id":"INC-08368","date":"2026-05","year":2026,"title":"Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47122"],"affected":"swift/github.com/sparkle-project/Sparkle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47122"},{"id":"INC-08369","date":"2026-05","year":2026,"title":"Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47121"],"affected":"swift/github.com/sparkle-project/Sparkle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47121"},{"id":"INC-08370","date":"2026-05","year":2026,"title":"russh server userauth state is not reset when authentication principal changes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46705"],"affected":"rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46705"},{"id":"INC-08371","date":"2026-05","year":2026,"title":"AgenticMail API/storage and outbound relay hardening fixes","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47255"],"affected":"npm/@agenticmail/core, npm/@agenticmail/api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47255"},{"id":"INC-08372","date":"2026-05","year":2026,"title":"CAPM3 vulnerable to Cross-Namespace resource access","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/metal3-io/cluster-api-provider-metal3, go/github.com/metal3-io/cluster-api-provider-metal3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rf84-wr5g-m3rp"},{"id":"INC-08373","date":"2026-05","year":2026,"title":"IPAM controller service account granted unnecessary full access to Secrets","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-47190"],"affected":"go/github.com/metal3-io/ip-address-manager, go/github.com/metal3-io/ip-address-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47190"},{"id":"INC-08374","date":"2026-05","year":2026,"title":"Ironic Standalone Operator's controller modifies user-owned resources without consent","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/metal3-io/ironic-standalone-operator, go/github.com/metal3-io/ironic-standalone-operator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hfc8-w5f4-3x6m"},{"id":"INC-08375","date":"2026-05","year":2026,"title":"NodeVM network builtin exclusions bypass via internal _http_client and _http_server","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47139"],"affected":"npm/vm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47139"},{"id":"INC-08376","date":"2026-05","year":2026,"title":"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40175","CVE-2026-44494"],"affected":"npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494"},{"id":"INC-08377","date":"2026-05","year":2026,"title":"HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48527"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48527"},{"id":"INC-08378","date":"2026-05","year":2026,"title":"Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5394"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5394"},{"id":"INC-08379","date":"2026-05","year":2026,"title":"Shamefile has an arbitrary file read via shamefile.yaml in shame next","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47144"],"affected":"rust/shamefile, npm/shamefile, pip/shamefile","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47144"},{"id":"INC-08380","date":"2026-05","year":2026,"title":"nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47128"],"affected":"rust/nono-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47128"},{"id":"INC-08381","date":"2026-05","year":2026,"title":"compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46345","CVE-2026-46439"],"affected":"pip/compliance-trestle, pip/compliance-trestle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46439"},{"id":"INC-08382","date":"2026-05","year":2026,"title":"compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45774"],"affected":"pip/compliance-trestle, pip/compliance-trestle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45774"},{"id":"INC-08383","date":"2026-05","year":2026,"title":"Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22872","CVE-2026-30963"],"affected":"go/github.com/projectcapsule/capsule","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22872"},{"id":"INC-08384","date":"2026-05","year":2026,"title":"Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45753"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45753"},{"id":"INC-14033","date":"2026-05","year":2026,"title":"MCP Toolbox for Databases vulnerable to DNS rebinding attacks","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9739"],"affected":"go/github.com/googleapis/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9739"},{"id":"INC-08385","date":"2026-05","year":2026,"title":"compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45725"],"affected":"pip/compliance-trestle, pip/compliance-trestle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45725"},{"id":"INC-08386","date":"2026-05","year":2026,"title":"Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44210","CVE-2026-47243"],"affected":"go/github.com/kata-containers/kata-containers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47243"},{"id":"INC-08387","date":"2026-05","year":2026,"title":"Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45703"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45703"},{"id":"INC-08388","date":"2026-05","year":2026,"title":"Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45305"],"affected":"composer/symfony/yaml, composer/symfony/yaml, composer/symfony/yaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45305"},{"id":"INC-08389","date":"2026-05","year":2026,"title":"Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion (\"Billion Laughs\")","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45304"],"affected":"composer/symfony/yaml, composer/symfony/yaml, composer/symfony/yaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45304"},{"id":"INC-08390","date":"2026-05","year":2026,"title":"Symfony hardened the parser when handling untrusted input","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45133"],"affected":"composer/symfony/yaml, composer/symfony/yaml, composer/symfony/yaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45133"},{"id":"INC-08391","date":"2026-05","year":2026,"title":"Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45075"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/security-http","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45075"},{"id":"INC-08392","date":"2026-05","year":2026,"title":"Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45074"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/security-http","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45074"},{"id":"INC-08393","date":"2026-05","year":2026,"title":"Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45072"],"affected":"composer/symfony/web-profiler-bundle, composer/symfony/web-profiler-bundle, composer/symfony/twig-bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45072"},{"id":"INC-08394","date":"2026-05","year":2026,"title":"Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45071"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45071"},{"id":"INC-08395","date":"2026-05","year":2026,"title":"Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45069"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45069"},{"id":"INC-08396","date":"2026-05","year":2026,"title":"Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45068"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45068"},{"id":"INC-08397","date":"2026-05","year":2026,"title":"Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\\Component\\Mime\\Address","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45067"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45067"},{"id":"INC-08398","date":"2026-05","year":2026,"title":"Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45066"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45066"},{"id":"INC-08399","date":"2026-05","year":2026,"title":"Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45064"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45064"},{"id":"INC-08400","date":"2026-05","year":2026,"title":"LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45617"],"affected":"npm/liquidjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45617"},{"id":"INC-08401","date":"2026-05","year":2026,"title":"Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44175","CVE-2026-45368"],"affected":"composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45368"},{"id":"INC-08402","date":"2026-05","year":2026,"title":"Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45065"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45065"},{"id":"INC-08403","date":"2026-05","year":2026,"title":"Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45063"],"affected":"composer/symfony/symfony, composer/symfony/symfony, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45063"},{"id":"INC-08404","date":"2026-05","year":2026,"title":"Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44739"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44739"},{"id":"INC-08405","date":"2026-05","year":2026,"title":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44705"],"affected":"npm/tmp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705"},{"id":"INC-08406","date":"2026-05","year":2026,"title":"LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44645"],"affected":"npm/liquidjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44645"},{"id":"INC-08407","date":"2026-05","year":2026,"title":"LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44644"],"affected":"npm/liquidjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44644"},{"id":"INC-08408","date":"2026-05","year":2026,"title":"Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42462"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42462"},{"id":"INC-08409","date":"2026-05","year":2026,"title":"yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42089"],"affected":"npm/yeoman-environment","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42089"},{"id":"INC-08410","date":"2026-05","year":2026,"title":"CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26028"],"affected":"npm/cryptpad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26028"},{"id":"INC-08411","date":"2026-05","year":2026,"title":"Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28445","CVE-2026-39964"],"affected":"npm/@typebot.io/js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39964"},{"id":"INC-14034","date":"2026-05","year":2026,"title":"Apache ECharts has a cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45249"],"affected":"npm/echarts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45249"},{"id":"INC-14035","date":"2026-05","year":2026,"title":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45361"],"affected":"pip/apache-airflow-providers-google","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45361"},{"id":"INC-14036","date":"2026-05","year":2026,"title":"hermes-agent has an Incorrect Comparison","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9369"],"affected":"pip/hermes-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9369"},{"id":"INC-14037","date":"2026-05","year":2026,"title":"hermes-agent has a sandbox issue","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9368"],"affected":"pip/hermes-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9368"},{"id":"INC-14038","date":"2026-05","year":2026,"title":"hermes-agent has an Injection issue","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9366"],"affected":"pip/hermes-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9366"},{"id":"INC-14039","date":"2026-05","year":2026,"title":"omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9299"],"affected":"go/github.com/omec-project/amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9299"},{"id":"INC-14040","date":"2026-05","year":2026,"title":"Go Net HTML parser is vulnerable to denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25680"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680"},{"id":"INC-14041","date":"2026-05","year":2026,"title":"Apache CXF's WS-Transfer module has an insecure XML parser configuration","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44618"],"affected":"maven/org.apache.cxf:cxf-rt-ws-transfer, maven/org.apache.cxf:cxf-rt-ws-transfer,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44618"},{"id":"INC-08412","date":"2026-05","year":2026,"title":"Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-47124"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47124"},{"id":"INC-08413","date":"2026-05","year":2026,"title":"Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46716"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46716"},{"id":"INC-08414","date":"2026-05","year":2026,"title":"Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47120"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47120"},{"id":"INC-08415","date":"2026-05","year":2026,"title":"Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46717"],"affected":"go/github.com/nezhahq/nezha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46717"},{"id":"INC-08416","date":"2026-05","year":2026,"title":"aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/aiosend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7m8f-hgjq-8gc9"},{"id":"INC-08417","date":"2026-05","year":2026,"title":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8723"],"affected":"npm/qs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723"},{"id":"INC-08418","date":"2026-05","year":2026,"title":"FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-48777"],"affected":"go/github.com/gtsteffaniak/filebrowser/backend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48777"},{"id":"INC-08419","date":"2026-05","year":2026,"title":"YesWiki: Unauthenticated SQL Injection","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46670"],"affected":"composer/yeswiki/yeswiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46670"},{"id":"INC-14042","date":"2026-05","year":2026,"title":"Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8245"],"affected":"composer/concrete5/concrete5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8245"},{"id":"INC-08421","date":"2026-05","year":2026,"title":"Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46695","CVE-2026-46703"],"affected":"go/github.com/boxlite-ai/boxlite/sdks/go, npm/@boxlite-ai/boxlite, rust/boxlite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46703"},{"id":"INC-08423","date":"2026-05","year":2026,"title":"ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33899","CVE-2026-33908","CVE-2026-40169"],"affected":"nuget/Magick.NET-Q8-x86, nuget/Magick.NET-Q8-x64, nuget/Magick.NET-Q8-arm64","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jqq5-8px3-9m6m"},{"id":"INC-08424","date":"2026-05","year":2026,"title":"Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46640"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46640"},{"id":"INC-08425","date":"2026-05","year":2026,"title":"Twig: Sandbox property and method bypass via object-destructuring assignment","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46639"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46639"},{"id":"INC-08426","date":"2026-05","year":2026,"title":"Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46638"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46638"},{"id":"INC-08427","date":"2026-05","year":2026,"title":"Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46637"],"affected":"composer/twig/cssinliner-extra, composer/twig/markdown-extra","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46637"},{"id":"INC-08428","date":"2026-05","year":2026,"title":"Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46635"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46635"},{"id":"INC-08429","date":"2026-05","year":2026,"title":"Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46634"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46634"},{"id":"INC-08430","date":"2026-05","year":2026,"title":"Twig: PHP code injection via `{% use %}` template name","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46633"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46633"},{"id":"INC-08431","date":"2026-05","year":2026,"title":"twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46629"],"affected":"composer/twig/intl-extra","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46629"},{"id":"INC-08432","date":"2026-05","year":2026,"title":"Twig: The `spaceless` filter implicitly marks its output as safe","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46628"],"affected":"composer/twig/twig","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46628"},{"id":"INC-08433","date":"2026-05","year":2026,"title":"Russh: Unchecked CryptoVec allocation and growth handling is reachable","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46673"],"affected":"rust/russh, rust/russh-cryptovec","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46673"},{"id":"INC-09729","date":"2026-05","year":2026,"title":"@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@hulumi/policies","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-59f3-7227-wmh4"},{"id":"INC-08434","date":"2026-05","year":2026,"title":"Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46609"],"affected":"nuget/Umbraco.Cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46609"},{"id":"INC-08435","date":"2026-05","year":2026,"title":"NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46548"],"affected":"npm/nocodb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46548"},{"id":"INC-08437","date":"2026-05","year":2026,"title":"Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46618"],"affected":"go/github.com/fission/fission","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46618"},{"id":"INC-08438","date":"2026-05","year":2026,"title":"md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46492"],"affected":"npm/md-fileserver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46492"},{"id":"INC-08439","date":"2026-05","year":2026,"title":"samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46490"],"affected":"npm/samlify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46490"},{"id":"INC-08441","date":"2026-05","year":2026,"title":"OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46481"],"affected":"maven/org.open-metadata:openmetadata-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46481"},{"id":"INC-08442","date":"2026-05","year":2026,"title":"phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35675"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35675"},{"id":"INC-08443","date":"2026-05","year":2026,"title":"phpMyFAQ: Default Empty API Token Authentication Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35672"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35672"},{"id":"INC-08444","date":"2026-05","year":2026,"title":"phpMyFAQ: IDOR Account Takeover","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35671"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35671"},{"id":"INC-08445","date":"2026-05","year":2026,"title":"wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/wger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mw8f-w6p8-xrf4"},{"id":"INC-08446","date":"2026-05","year":2026,"title":"Setup PHP: Command Injection in Repository-Derived PHP Version Resolution","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46420"],"affected":"actions/shivammathur/setup-php","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46420"},{"id":"INC-08447","date":"2026-05","year":2026,"title":"Diffusers: TOCTOU Trust Remote Code Bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45804"],"affected":"pip/diffusers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45804"},{"id":"INC-08449","date":"2026-05","year":2026,"title":"Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27173"],"affected":"pip/apache-airflow-providers-cncf-kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27173"},{"id":"INC-08450","date":"2026-05","year":2026,"title":"Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46412"],"affected":"npm/@beproduct/nestjs-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46412"},{"id":"INC-08451","date":"2026-05","year":2026,"title":"CamoFox MCP: Unauthenticated HTTP MCP browser-control surface","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/camofox-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7hgr-7h44-33w2"},{"id":"INC-08452","date":"2026-05","year":2026,"title":"Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45796","CVE-2026-46354"],"affected":"go/github.com/coder/coder, go/github.com/coder/coder/v2, go/github.com/coder/coder/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46354"},{"id":"INC-08453","date":"2026-05","year":2026,"title":"Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46342"],"affected":"npm/@nuxt/nitro-server, npm/@nuxt/nitro-server, npm/nuxt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46342"},{"id":"INC-08454","date":"2026-05","year":2026,"title":"Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46338"],"affected":"pip/pymdown-extensions","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46338"},{"id":"INC-08455","date":"2026-05","year":2026,"title":"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45805"],"affected":"npm/@penpot/mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45805"},{"id":"INC-08456","date":"2026-05","year":2026,"title":"MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin \"router-key\" / \"mcp-init-host\" path","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/Kuadrant/mcp-gateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g53w-w6mj-hrpp"},{"id":"INC-08457","date":"2026-05","year":2026,"title":"Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gx7w-56w6-g48x"},{"id":"INC-08458","date":"2026-05","year":2026,"title":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/kong/kubernetes-ingress-controller, go/github.com/kong/kubernetes-ingress-controller/v2,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m23h-6mwm-39m8"},{"id":"INC-08459","date":"2026-05","year":2026,"title":"9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46339"],"affected":"npm/9router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46339"},{"id":"INC-08460","date":"2026-05","year":2026,"title":"Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-46341"],"affected":"npm/@apify/actors-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46341"},{"id":"INC-08461","date":"2026-05","year":2026,"title":"Budibase: Unrestricted Upload of File with Dangerous Type","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46426"],"affected":"npm/budibase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46426"},{"id":"INC-08462","date":"2026-05","year":2026,"title":"Envoy AI Proxy - MCP Message Smuggling Vulnerability","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/envoyproxy/ai-gateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4gph-2hhr-5mwg"},{"id":"INC-08464","date":"2026-05","year":2026,"title":"n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2vx9-7wpg-88jq"},{"id":"INC-08465","date":"2026-05","year":2026,"title":"Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45711"],"affected":"go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45711"},{"id":"INC-08466","date":"2026-05","year":2026,"title":"Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45709"],"affected":"go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45709"},{"id":"INC-08467","date":"2026-05","year":2026,"title":"Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45692"],"affected":"go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45692"},{"id":"INC-08468","date":"2026-05","year":2026,"title":"Nuxt: Reflected XSS in `navigateTo()` external redirect","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45669"],"affected":"npm/nuxt, npm/nuxt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45669"},{"id":"INC-08469","date":"2026-05","year":2026,"title":"auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"npm/auth-fetch-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hv85-774v-26fg"},{"id":"INC-04143","date":"2026-05","year":2026,"title":"Malicious code in guardrails-ai 0.10.1 (supply chain compromise)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-45858","CVE-2024-6961","CVE-2026-31233","CVE-2026-45758"],"affected":"pip/guardrails-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45758"},{"id":"INC-08470","date":"2026-05","year":2026,"title":"go-git: Crafted repositories may modify main and submodule .git directories","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45571"],"affected":"go/github.com/go-git/go-git, go/github.com/go-git/go-git/v6, go/github.com/go-git/go-git/v5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45571"},{"id":"INC-08471","date":"2026-05","year":2026,"title":"GlassFish's gadget handler is vulnerable to RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2587"],"affected":"maven/org.glassfish.jsftemplating:jsftemplating, maven/org.glassfish.main.admingui:admingui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2587"},{"id":"INC-08472","date":"2026-05","year":2026,"title":"HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46511"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46511"},{"id":"INC-08473","date":"2026-05","year":2026,"title":"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46396"],"affected":"npm/@haxtheweb/iframe-loader, npm/@haxtheweb/video-player, npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46396"},{"id":"INC-08474","date":"2026-05","year":2026,"title":"HAXcms: Private Key Disclosure via Broken HMAC Implementation","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-46395"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46395"},{"id":"INC-08475","date":"2026-05","year":2026,"title":"HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46496"],"affected":"npm/@haxtheweb/video-player, npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46496"},{"id":"INC-08476","date":"2026-05","year":2026,"title":"Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/xyproto/algernon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9v4j-7g44-qcqw"},{"id":"INC-08477","date":"2026-05","year":2026,"title":"Algernon: Single-file mode unconditionally enables debug mode","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45728"],"affected":"go/github.com/xyproto/algernon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45728"},{"id":"INC-14043","date":"2026-05","year":2026,"title":"TYPO3 ke_search XML External Entity Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46722"],"affected":"composer/tpwd/ke_search, composer/tpwd/ke_search, composer/tpwd/ke_search","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46722"},{"id":"INC-08478","date":"2026-05","year":2026,"title":"Summarize contains a missing authorization vulnerability","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45244"],"affected":"npm/@steipete/summarize","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45244"},{"id":"INC-08479","date":"2026-05","year":2026,"title":"NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45553"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45553"},{"id":"INC-08480","date":"2026-05","year":2026,"title":"OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45676","CVE-2026-45678","CVE-2026-45680","CVE-2026-45682","CVE-2026-45683","CVE-2026-45685","CVE-2026-45686"],"affected":"go/go.opentelemetry.io/obi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45686"},{"id":"INC-08481","date":"2026-05","year":2026,"title":"Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35433"],"affected":"nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86, nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35433"},{"id":"INC-08482","date":"2026-05","year":2026,"title":"Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42899"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.osx-x64, nuget/Microsoft.AspNetCore.App.Runtime.osx-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42899"},{"id":"INC-08483","date":"2026-05","year":2026,"title":"Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32175"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32175"},{"id":"INC-08484","date":"2026-05","year":2026,"title":"AVideo: Authenticated Arbitrary File Read in view/update.php","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45731"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45731"},{"id":"INC-08485","date":"2026-05","year":2026,"title":"Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp","severity":"Low","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@mistralai/mistralai-gcp, npm/@mistralai/mistralai-gcp, npm/@mistralai/mistralai-azure","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jgg6-4rpr-wfh7"},{"id":"INC-08486","date":"2026-05","year":2026,"title":"Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3`","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32687"],"affected":"erlang/postgrex","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32687"},{"id":"INC-08487","date":"2026-05","year":2026,"title":"Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45715","CVE-2026-45716"],"affected":"npm/@budibase/worker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45716"},{"id":"INC-08488","date":"2026-05","year":2026,"title":"LibreNMS: Cross-Site Scripting in ShowConfigController","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2728"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2728"},{"id":"INC-08489","date":"2026-05","year":2026,"title":"dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/dynoxide, rust/dynoxide-rs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fvh2-gm75-j4j7"},{"id":"INC-08490","date":"2026-05","year":2026,"title":"Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45298"],"affected":"go/github.com/amir20/dozzle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45298"},{"id":"INC-08491","date":"2026-05","year":2026,"title":"CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45138","CVE-2026-45270"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45270"},{"id":"INC-08492","date":"2026-05","year":2026,"title":"Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45627"],"affected":"go/github.com/getarcaneapp/arcane/backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45627"},{"id":"INC-08493","date":"2026-05","year":2026,"title":"Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-45625"],"affected":"go/github.com/getarcaneapp/arcane/backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45625"},{"id":"INC-08494","date":"2026-05","year":2026,"title":"Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@sveltia/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-97r8-rf7q-wmjw"},{"id":"INC-08495","date":"2026-05","year":2026,"title":"form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46510"],"affected":"npm/form-data-objectizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46510"},{"id":"INC-08496","date":"2026-05","year":2026,"title":"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8769"],"affected":"npm/@ai-sdk/provider-utils","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8769"},{"id":"INC-08497","date":"2026-05","year":2026,"title":"Duplicate Advisory: phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-46366"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cqrw-j4qc-7f9w"},{"id":"INC-08498","date":"2026-05","year":2026,"title":"Duplicate Advisory: phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46364"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ch9q-c9mp-j5gq"},{"id":"INC-08499","date":"2026-05","year":2026,"title":"Duplicate Advisory: phpMyFAQ: SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46360"],"affected":"composer/thorsten/phpMyFAQ, composer/phpMyFAQ/phpMyFAQ","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wj3q-vw2v-3rj3"},{"id":"INC-08500","date":"2026-05","year":2026,"title":"AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45610"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45610"},{"id":"INC-08501","date":"2026-05","year":2026,"title":"AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45580"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45580"},{"id":"INC-08502","date":"2026-05","year":2026,"title":"AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45578"],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45578"},{"id":"INC-08503","date":"2026-05","year":2026,"title":"Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23695"],"affected":"composer/cockpit-hq/cockpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23695"},{"id":"INC-08504","date":"2026-05","year":2026,"title":"Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44692"],"affected":"composer/code16/sharp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44692"},{"id":"INC-08505","date":"2026-05","year":2026,"title":"Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45548"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45548"},{"id":"INC-08506","date":"2026-05","year":2026,"title":"Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/better-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wxw3-q3m9-c3jr"},{"id":"INC-08507","date":"2026-05","year":2026,"title":"goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/goshs.de/goshs/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mxg3-432p-mr72"},{"id":"INC-08508","date":"2026-05","year":2026,"title":"Weblate: Stored HTML injection in editor search preview","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45106"],"affected":"pip/weblate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45106"},{"id":"INC-08509","date":"2026-05","year":2026,"title":"Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44716"],"affected":"pip/pipecat-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44716"},{"id":"INC-08510","date":"2026-05","year":2026,"title":"NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41147"],"affected":"composer/nukeviet/nukeviet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41147"},{"id":"INC-08511","date":"2026-05","year":2026,"title":"python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-45370"],"affected":"pip/utcp-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45370"},{"id":"INC-08512","date":"2026-05","year":2026,"title":"@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-45366"],"affected":"npm/@utcp/http","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45366"},{"id":"INC-08513","date":"2026-05","year":2026,"title":"@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@samanhappy/mcphub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wf8q-wvv8-p8jf"},{"id":"INC-08517","date":"2026-05","year":2026,"title":"pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45348"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45348"},{"id":"INC-08518","date":"2026-05","year":2026,"title":"Svelte SSR vulnerable to cross-site scripting via spread attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27121","CVE-2026-42599"],"affected":"npm/svelte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42599"},{"id":"INC-08519","date":"2026-05","year":2026,"title":"Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/ha-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g39v-cvjh-8fpf"},{"id":"INC-08520","date":"2026-05","year":2026,"title":"ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44541"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44541"},{"id":"INC-08521","date":"2026-05","year":2026,"title":"Apostrophe has stored XSS via javascript: URL in Image Widget Link","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45011"],"affected":"npm/apostrophe","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45011"},{"id":"INC-08522","date":"2026-05","year":2026,"title":"Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44990"],"affected":"npm/sanitize-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44990"},{"id":"INC-08523","date":"2026-05","year":2026,"title":"Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@karakeep/sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7rx4-c5vx-g8w3"},{"id":"INC-08524","date":"2026-05","year":2026,"title":"dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44968","CVE-2026-44969","CVE-2026-44970"],"affected":"pip/dbt-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44970"},{"id":"INC-08525","date":"2026-05","year":2026,"title":"Mistune Image Directive CSS Injection Vulnerability","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44708","CVE-2026-44897","CVE-2026-44898","CVE-2026-44899"],"affected":"pip/mistune","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44899"},{"id":"INC-08526","date":"2026-05","year":2026,"title":"Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44848","CVE-2026-44850","CVE-2026-44881","CVE-2026-44882"],"affected":"go/github.com/portainer/portainer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44882"},{"id":"INC-08531","date":"2026-05","year":2026,"title":"wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43978"],"affected":"pip/wger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43978"},{"id":"INC-08533","date":"2026-05","year":2026,"title":"podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43644"],"affected":"go/github.com/stefanprodan/podinfo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43644"},{"id":"INC-08534","date":"2026-05","year":2026,"title":"CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41249"],"affected":"composer/coreshop/core-shop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41249"},{"id":"INC-08535","date":"2026-05","year":2026,"title":"Fleet vulnerable to OS command injection in software packages","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26191","CVE-2026-29180"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26191"},{"id":"INC-08536","date":"2026-05","year":2026,"title":"Fleet Windows MDM Azure AD JWT Authentication Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-24899"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24899"},{"id":"INC-08537","date":"2026-05","year":2026,"title":"Fleet has a Windows MDM management endpoint authentication bypass","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-23998"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23998"},{"id":"INC-08538","date":"2026-05","year":2026,"title":"Strapi Upload Plugin MIME Validation Bypass via Content API","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22707"],"affected":"npm/@strapi/upload","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22707"},{"id":"INC-08539","date":"2026-05","year":2026,"title":"Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8178"],"affected":"maven/com.amazon.redshift:redshift-jdbc42","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8178"},{"id":"INC-08540","date":"2026-05","year":2026,"title":"Apache Commons Configuration: StackOverflowError for YAML input with cycles","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45205"],"affected":"maven/org.apache.commons:commons-configuration2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45205"},{"id":"INC-08541","date":"2026-05","year":2026,"title":"Strapi: Password Reset Does Not Revoke Existing Refresh Sessions","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22706"],"affected":"npm/@strapi/plugin-users-permissions, npm/@strapi/admin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22706"},{"id":"INC-08542","date":"2026-05","year":2026,"title":"Strapi Vulnerable to SQL Injection in Content Type Builder","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22599"],"affected":"npm/@strapi/plugin-content-type-builder, npm/@strapi/content-type-builder","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22599"},{"id":"INC-08543","date":"2026-05","year":2026,"title":"SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45375"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45375"},{"id":"INC-08544","date":"2026-05","year":2026,"title":"Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45083"],"affected":"maven/io.goobi.viewer:viewer-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45083"},{"id":"INC-08545","date":"2026-05","year":2026,"title":"uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45152"],"affected":"go/gitlab.com/uniget-org/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45152"},{"id":"INC-08546","date":"2026-05","year":2026,"title":"Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/obot-platform/obot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vw82-7fv8-r6gp"},{"id":"INC-08547","date":"2026-05","year":2026,"title":"Nautobot: GitRepository.current_head field should not be writable through REST API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44794","CVE-2026-44798"],"affected":"pip/nautobot, pip/nautobot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44798"},{"id":"INC-08548","date":"2026-05","year":2026,"title":"Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44738"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44738"},{"id":"INC-08549","date":"2026-05","year":2026,"title":"Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44724"],"affected":"npm/systeminformation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44724"},{"id":"INC-08550","date":"2026-05","year":2026,"title":"Astro: Server island encrypted parameters vulnerable to cross-component replay","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45028"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45028"},{"id":"INC-08551","date":"2026-05","year":2026,"title":"mem0 server lacks authentication and authorization controls for its memory deletion API endpoint","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31240","CVE-2026-31241","CVE-2026-7597"],"affected":"pip/mem0ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31241"},{"id":"INC-08552","date":"2026-05","year":2026,"title":"protobuf.js: Prototype injection in generated message constructors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44292"],"affected":"npm/protobufjs, npm/protobufjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44292"},{"id":"INC-08553","date":"2026-05","year":2026,"title":"Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41713"],"affected":"maven/org.springframework.ai:spring-ai-client-chat, maven/org.springframework.ai:spring-ai-client-chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41713"},{"id":"INC-08554","date":"2026-05","year":2026,"title":"Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45224"],"affected":"go/github.com/openclaw/crabbox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45224"},{"id":"INC-08556","date":"2026-05","year":2026,"title":"local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43979"],"affected":"pip/local-deep-research","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43979"},{"id":"INC-08557","date":"2026-05","year":2026,"title":"Mermaid: Improper sanitization of configuration leads to CSS injection","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41149","CVE-2026-41159"],"affected":"npm/mermaid, npm/mermaid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41159"},{"id":"INC-08560","date":"2026-05","year":2026,"title":"Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31247","CVE-2026-31248"],"affected":"pip/docling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31248"},{"id":"INC-08561","date":"2026-05","year":2026,"title":"pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7814"],"affected":"pip/pgadmin4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7814"},{"id":"INC-08562","date":"2026-05","year":2026,"title":"WebdriverIO BrowserStack Service has a Command Injection issue","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25244"],"affected":"npm/@wdio/browserstack-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25244"},{"id":"INC-08563","date":"2026-05","year":2026,"title":"torrentpier has PHP Serialize Injections","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/torrentpier/torrentpier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h29g-c9cx-c73q"},{"id":"INC-08564","date":"2026-05","year":2026,"title":"Local Path Provisioner Vulnerable to HelperPod Template Injection","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44543"],"affected":"go/github.com/rancher/local-path-provisioner","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44543"},{"id":"INC-08565","date":"2026-05","year":2026,"title":"@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44483"],"affected":"npm/@rvf/set-get, npm/@rvf/set-get","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44483"},{"id":"INC-08566","date":"2026-05","year":2026,"title":"Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44580","CVE-2026-44581"],"affected":"npm/next, npm/next","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44581"},{"id":"INC-08567","date":"2026-05","year":2026,"title":"Open WebUI has a CORS misconfiguration and session validation issue","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6xcp-7mpr-m7wm"},{"id":"INC-08568","date":"2026-05","year":2026,"title":"PraisonAI's symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44340"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44340"},{"id":"INC-08569","date":"2026-05","year":2026,"title":"PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44339"],"affected":"pip/PraisonAI, pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44339"},{"id":"INC-08570","date":"2026-05","year":2026,"title":"PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44337"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44337"},{"id":"INC-08571","date":"2026-05","year":2026,"title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41018"],"affected":"pip/apache-airflow-providers-elasticsearch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41018"},{"id":"INC-08572","date":"2026-05","year":2026,"title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43826"],"affected":"pip/apache-airflow-providers-opensearch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43826"},{"id":"INC-08573","date":"2026-05","year":2026,"title":"Hono has CSS Declaration Injection via Style Object Values in JSX SSR","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44458"],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44458"},{"id":"INC-08574","date":"2026-05","year":2026,"title":"@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@profullstack/mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v6wj-c83f-v46x"},{"id":"INC-08575","date":"2026-05","year":2026,"title":"Velocity.js has a Prototype Pollution vulnerability through #set path assignment","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44966"],"affected":"npm/velocityjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44966"},{"id":"INC-08576","date":"2026-05","year":2026,"title":"SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44788"],"affected":"nuget/SharpCompress","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44788"},{"id":"INC-08577","date":"2026-05","year":2026,"title":"Mistune has XSS via unescaped figclass/figwidth in Figure directive","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44896"],"affected":"pip/mistune","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44896"},{"id":"INC-08578","date":"2026-05","year":2026,"title":"eml_parser has recursion DoS via nested message/rfc822 attachments","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44844"],"affected":"pip/eml_parser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44844"},{"id":"INC-09730","date":"2026-05","year":2026,"title":"Phpseclib needs guardrails on large binaryfield integers","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49316"],"affected":"composer/phpseclib/phpseclib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49316"},{"id":"INC-08579","date":"2026-05","year":2026,"title":"free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44329"],"affected":"go/github.com/free5gc/smf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44329"},{"id":"INC-08580","date":"2026-05","year":2026,"title":"free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44326","CVE-2026-44327"],"affected":"go/github.com/free5gc/nef","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44327"},{"id":"INC-08581","date":"2026-05","year":2026,"title":"Kimai has an arbitrary file read in its invoice PDF renderer (admin)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44298"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44298"},{"id":"INC-08582","date":"2026-05","year":2026,"title":"Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-44211"],"affected":"npm/cline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44211"},{"id":"INC-08583","date":"2026-05","year":2026,"title":"Bunsink has an SSRF bypass in `validate_webhook_url`","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44502"],"affected":"pip/bugsink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44502"},{"id":"INC-08584","date":"2026-05","year":2026,"title":"SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44588"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44588"},{"id":"INC-08585","date":"2026-05","year":2026,"title":"Electerm's full process.env exposed to renderer via window.pre.env","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43942"],"affected":"npm/electerm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43942"},{"id":"INC-08586","date":"2026-05","year":2026,"title":"absinthe_plug Has a Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42794"],"affected":"erlang/absinthe_plug","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42794"},{"id":"INC-08587","date":"2026-05","year":2026,"title":"justhtml introduces denial-of-service hardening","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r8cj-3554-33mr"},{"id":"INC-08588","date":"2026-05","year":2026,"title":"gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44310"],"affected":"go/github.com/sigstore/gitsign","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44310"},{"id":"INC-08589","date":"2026-05","year":2026,"title":"n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8g7g-hmwm-6rv2"},{"id":"INC-08590","date":"2026-05","year":2026,"title":"PrestaShop has a stored XSS executable in customer service view","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44212"],"affected":"composer/prestashop/prestashop, composer/prestashop/prestashop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44212"},{"id":"INC-08591","date":"2026-05","year":2026,"title":"SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44670"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44670"},{"id":"INC-08592","date":"2026-05","year":2026,"title":"gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/gmaps-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-52cq-7v8r-62c6"},{"id":"INC-08593","date":"2026-05","year":2026,"title":"fast-xml-builder Comment Value regex can be bypassed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41650","CVE-2026-44664"],"affected":"npm/fast-xml-builder","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44664"},{"id":"INC-08594","date":"2026-05","year":2026,"title":"OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40213"],"affected":"pip/openstack-cyborg","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40213"},{"id":"INC-08595","date":"2026-05","year":2026,"title":"utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-44661"],"affected":"pip/utcp-http","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44661"},{"id":"INC-08596","date":"2026-05","year":2026,"title":"netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/netbox-data-flows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v7qw-hx66-4w9x"},{"id":"INC-08597","date":"2026-05","year":2026,"title":"mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/mcp-ssh-tool","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j7h9-2jh7-g967"},{"id":"INC-08598","date":"2026-05","year":2026,"title":"Postorius is vulnerable to XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44742"],"affected":"pip/postorius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44742"},{"id":"INC-08599","date":"2026-05","year":2026,"title":"Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/lin-snow/Ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pj6q-4vq4-r8cg"},{"id":"INC-08600","date":"2026-05","year":2026,"title":"Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/lin-snow/Ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3v85-fqvh-7rxf"},{"id":"INC-08601","date":"2026-05","year":2026,"title":"Ech0 comment model's Email field returned on public /api/comments endpoints","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/lin-snow/Ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rj4g-rqgh-rx9h"},{"id":"INC-08602","date":"2026-05","year":2026,"title":"nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44589"],"affected":"npm/nuxt-og-image","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44589"},{"id":"INC-08603","date":"2026-05","year":2026,"title":"FacturaScripts vulnerable to stored XSS via product reference in sales/purchases","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42877"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42877"},{"id":"INC-08604","date":"2026-05","year":2026,"title":"FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27964"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27964"},{"id":"INC-08605","date":"2026-05","year":2026,"title":"FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-27892"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27892"},{"id":"INC-08606","date":"2026-05","year":2026,"title":"FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27891"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27891"},{"id":"INC-08607","date":"2026-05","year":2026,"title":"vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44007"],"affected":"npm/vm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44007"},{"id":"INC-08608","date":"2026-05","year":2026,"title":"vm2's Transformer Fast-Path Bypass Exposes Internal State Variable","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44000","CVE-2026-44003"],"affected":"npm/vm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44003"},{"id":"INC-08609","date":"2026-05","year":2026,"title":"imageproc has fragile bounds check when sampling from image","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/imageproc, rust/imageproc, rust/imageproc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5qv7-j6w5-fr4m"},{"id":"INC-08610","date":"2026-05","year":2026,"title":"hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/hickory-net, rust/hickory-proto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3v94-mw7p-v465"},{"id":"INC-08611","date":"2026-05","year":2026,"title":"CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44312"],"affected":"rubygems/css_parser, rubygems/css_parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44312"},{"id":"INC-09731","date":"2026-05","year":2026,"title":"Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44504"],"affected":"pip/aegra-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44504"},{"id":"INC-08612","date":"2026-05","year":2026,"title":"container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"swift/github.com/apple/container","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-39g5-644c-qwcg"},{"id":"INC-08613","date":"2026-05","year":2026,"title":"Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/aws/amazon-ecs-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fc67-c4hg-q653"},{"id":"INC-08614","date":"2026-05","year":2026,"title":"Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42597"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42597"},{"id":"INC-08615","date":"2026-05","year":2026,"title":"Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42596"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42596"},{"id":"INC-08616","date":"2026-05","year":2026,"title":"Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42594"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42594"},{"id":"INC-08617","date":"2026-05","year":2026,"title":"Gotenberg has a Server-Side Request Forgery (SSRF) Issue","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42591"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42591"},{"id":"INC-08618","date":"2026-05","year":2026,"title":"Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42590"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42590"},{"id":"INC-08619","date":"2026-05","year":2026,"title":"Netty Redis Codec Encoder has a CRLF Injection Issue","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42586"],"affected":"maven/io.netty:netty-codec-redis, maven/io.netty:netty-codec-redis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42586"},{"id":"INC-08620","date":"2026-05","year":2026,"title":"wasmtime has a panic when allocating a table exceeding the size of the host's address space","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44216"],"affected":"rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44216"},{"id":"INC-08621","date":"2026-05","year":2026,"title":"diesel-async may expose uninitialized padding bytes for MySQL temporal columns","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/diesel-async","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ff9q-rm55-q7qr"},{"id":"INC-08622","date":"2026-05","year":2026,"title":"gix-fs: Symlink prefix-reuse allows worktree escape during checkout","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44471"],"affected":"rust/gix-fs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44471"},{"id":"INC-08623","date":"2026-05","year":2026,"title":"hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44455"],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44455"},{"id":"INC-08624","date":"2026-05","year":2026,"title":"Kanidm has non-constant-time comparison of OAuth2 client_secret","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/kanidm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-53hj-r94p-8c8f"},{"id":"INC-08625","date":"2026-05","year":2026,"title":"Kanidm: Stored HTML injection in \"passkey-enrolment\" partial via displayname → htmx-driven authenticated request forgery","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"rust/kanidm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gpxg-fx2g-qxj2"},{"id":"INC-08626","date":"2026-05","year":2026,"title":"webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/webauthn-authenticator-rs, rust/webauthn-rs-core, rust/webauthn-authenticator-rs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-22w3-693w-x895"},{"id":"INC-14044","date":"2026-05","year":2026,"title":"@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@axonflow/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cqmh-pcgr-q42f"},{"id":"INC-08627","date":"2026-05","year":2026,"title":"Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/getaxonflow/axonflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9h64-2846-7x7f"},{"id":"INC-08628","date":"2026-05","year":2026,"title":"Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-0897"],"affected":"pip/keras, pip/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0897"},{"id":"INC-08629","date":"2026-05","year":2026,"title":"Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42845"],"affected":"composer/getgrav/grav-plugin-form","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42845"},{"id":"INC-08630","date":"2026-05","year":2026,"title":"fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44351"],"affected":"npm/fast-jwt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44351"},{"id":"INC-08631","date":"2026-05","year":2026,"title":"Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44245"],"affected":"go/github.com/kyverno/policy-reporter-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44245"},{"id":"INC-08632","date":"2026-05","year":2026,"title":"PraisonAI has unauthenticated RCE via `tool_override.py` (CVE-2026-40287 patch bypass)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40287","CVE-2026-40288","CVE-2026-40289","CVE-2026-44334"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44334"},{"id":"INC-08633","date":"2026-05","year":2026,"title":"PraisonAI has an SSRF bypass","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44335"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44335"},{"id":"INC-08634","date":"2026-05","year":2026,"title":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44244"],"affected":"pip/GitPython","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244"},{"id":"INC-08635","date":"2026-05","year":2026,"title":"kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/cloudnativelabs/kube-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v5mh-h5hx-7v92"},{"id":"INC-08636","date":"2026-05","year":2026,"title":"Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42549"],"affected":"composer/flightphp/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42549"},{"id":"INC-08637","date":"2026-05","year":2026,"title":"Low-privileged Grav API users can create super-admin accounts via blueprint-upload","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42844"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42844"},{"id":"INC-08638","date":"2026-05","year":2026,"title":"Magento LTS: Reflected XSS - Import -> Data Flow (profiles)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42458"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42458"},{"id":"INC-08639","date":"2026-05","year":2026,"title":"phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46359"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46359"},{"id":"INC-08640","date":"2026-05","year":2026,"title":"phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-46361"],"affected":"composer/thorsten/phpmyfaq, composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46361"},{"id":"INC-08641","date":"2026-05","year":2026,"title":"phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45007"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45007"},{"id":"INC-08642","date":"2026-05","year":2026,"title":"phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46363"],"affected":"composer/thorsten/phpmyfaq, composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46363"},{"id":"INC-08643","date":"2026-05","year":2026,"title":"Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-71261"],"affected":"go/github.com/harvester/harvester","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71261"},{"id":"INC-08644","date":"2026-05","year":2026,"title":"phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-46362"],"affected":"composer/thorsten/phpmyfaq, composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46362"},{"id":"INC-08645","date":"2026-05","year":2026,"title":"phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46367"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46367"},{"id":"INC-08646","date":"2026-05","year":2026,"title":"Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44242"],"affected":"maven/io.micronaut:micronaut-inject, maven/io.micronaut:micronaut-inject, maven/io.micronaut:micronaut-inject","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44242"},{"id":"INC-08647","date":"2026-05","year":2026,"title":"Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/mezo-org/mezod","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6447-269v-g68m"},{"id":"INC-08648","date":"2026-05","year":2026,"title":"wger: cross-tenant password reset and plaintext disclosure via gym=None bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43948"],"affected":"pip/wger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43948"},{"id":"INC-08649","date":"2026-05","year":2026,"title":"Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44305"],"affected":"pip/lemur","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44305"},{"id":"INC-08650","date":"2026-05","year":2026,"title":"Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vrqv-52x7-rm4v"},{"id":"INC-08651","date":"2026-05","year":2026,"title":"Kimai has Missing Voter Check that Allows Cross-Team Timesheet Manipulation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9g2q-w3w2-vf7q"},{"id":"INC-09732","date":"2026-05","year":2026,"title":"phpseclib: guardrails needed on isPrime and randomPrime","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-27354","CVE-2024-27355"],"affected":"composer/phpseclib/phpseclib, composer/phpseclib/phpseclib, composer/phpseclib/phpseclib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27354"},{"id":"INC-08652","date":"2026-05","year":2026,"title":"Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68455","CVE-2026-44011"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44011"},{"id":"INC-08653","date":"2026-05","year":2026,"title":"Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-44010"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44010"},{"id":"INC-08654","date":"2026-05","year":2026,"title":"astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/astral-tokio-tar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xx64-wwv2-hcqq"},{"id":"INC-08655","date":"2026-05","year":2026,"title":"Nginx-UI Settings API Exposes Protected Secrets","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-42220","CVE-2026-42223"],"affected":"go/github.com/0xJacky/nginx-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42223"},{"id":"INC-08656","date":"2026-05","year":2026,"title":"Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-29080"],"affected":"pip/rucio, pip/rucio, pip/rucio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29080"},{"id":"INC-08657","date":"2026-05","year":2026,"title":"AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43884"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43884"},{"id":"INC-08658","date":"2026-05","year":2026,"title":"jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/org.jdbi:jdbi3-freemarker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mggx-p7jf-jgw4"},{"id":"INC-08659","date":"2026-05","year":2026,"title":"AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43882"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43882"},{"id":"INC-08660","date":"2026-05","year":2026,"title":"AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43880"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43880"},{"id":"INC-08661","date":"2026-05","year":2026,"title":"Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44903"],"affected":"go/github.com/prometheus/prometheus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44903"},{"id":"INC-08662","date":"2026-05","year":2026,"title":"ip-address has XSS in Address6 HTML-emitting methods","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42338"],"affected":"npm/ip-address","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338"},{"id":"INC-08663","date":"2026-05","year":2026,"title":"AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43879"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43879"},{"id":"INC-08664","date":"2026-05","year":2026,"title":"Grav is Vulnerable to Stored XSS via Tag Injection","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42607","CVE-2026-42608","CVE-2026-42609","CVE-2026-42610","CVE-2026-42611","CVE-2026-42612","CVE-2026-42841","CVE-2026-42842"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42611"},{"id":"INC-08665","date":"2026-05","year":2026,"title":"Grav API Privilege Escalation to Super Admin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42843"],"affected":"composer/getgrav/grav-plugin-api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42843"},{"id":"INC-08666","date":"2026-05","year":2026,"title":"PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42315"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42315"},{"id":"INC-08667","date":"2026-05","year":2026,"title":"@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@evomap/evolver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jxh8-jh77-xh6g"},{"id":"INC-08668","date":"2026-05","year":2026,"title":"Kimai vulnerable to formula Injection via tag names in XLSX export","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41498","CVE-2026-42267"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42267"},{"id":"INC-08669","date":"2026-05","year":2026,"title":"YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43937","CVE-2026-43938","CVE-2026-43939"],"affected":"nuget/YAFNET.Core, nuget/YAFNET.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43939"},{"id":"INC-08670","date":"2026-05","year":2026,"title":"RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":[],"affected":"rust/rustfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mm2q-qcmx-gw4w"},{"id":"INC-08671","date":"2026-05","year":2026,"title":"Fiber vulnerable to XSS in AutoFormat Content Negotiation","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42554"],"affected":"go/github.com/gofiber/fiber/v2, go/github.com/gofiber/fiber/v3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42554"},{"id":"INC-08672","date":"2026-05","year":2026,"title":"Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42207"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42207"},{"id":"INC-08673","date":"2026-05","year":2026,"title":"MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42600"],"affected":"go/github.com/minio/minio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42600"},{"id":"INC-08674","date":"2026-05","year":2026,"title":"Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42155"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42155"},{"id":"INC-08675","date":"2026-05","year":2026,"title":"XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42140"],"affected":"maven/org.xwiki.contrib.plantuml:macro-plantuml-macro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42140"},{"id":"INC-08676","date":"2026-05","year":2026,"title":"gix-transport: HTTP credentials leaked to redirected host in curl backend","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/gix-transport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9857-6mw7-fq2m"},{"id":"INC-08677","date":"2026-05","year":2026,"title":"AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43877"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43877"},{"id":"INC-08678","date":"2026-05","year":2026,"title":"AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-43876"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43876"},{"id":"INC-08679","date":"2026-05","year":2026,"title":"AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-43875"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43875"},{"id":"INC-08680","date":"2026-05","year":2026,"title":"AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40911","CVE-2026-43874"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43874"},{"id":"INC-08681","date":"2026-05","year":2026,"title":"S3-Proxy has Security Issues in its Resource Path Matching Implementation","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42882"],"affected":"go/github.com/oxyno-zeta/s3-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42882"},{"id":"INC-08683","date":"2026-05","year":2026,"title":"@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@tdurieux/anonymous_github","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g485-8j3v-p6x8"},{"id":"INC-08684","date":"2026-05","year":2026,"title":"edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42860"],"affected":"pip/edx-enterprise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42860"},{"id":"INC-08685","date":"2026-05","year":2026,"title":"Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42856"],"affected":"npm/network-ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42856"},{"id":"INC-08686","date":"2026-05","year":2026,"title":"ots has a negative expire override that can bypass its secret retention policy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/Luzifer/ots","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h5fq-653g-gxrm"},{"id":"INC-08687","date":"2026-05","year":2026,"title":"Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` (from huntr)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40110"],"affected":"pip/jupyter-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40110"},{"id":"INC-08688","date":"2026-05","year":2026,"title":"Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35397"],"affected":"pip/jupyter-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35397"},{"id":"INC-08689","date":"2026-05","year":2026,"title":"VM2 Has a WASM Sandbox Escape","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26956"],"affected":"npm/vm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26956"},{"id":"INC-08690","date":"2026-05","year":2026,"title":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42037"],"affected":"npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42037"},{"id":"INC-08691","date":"2026-05","year":2026,"title":"Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7776"],"affected":"go/github.com/hashicorp/boundary, go/github.com/hashicorp/boundary, go/github.com/hashicorp/boundary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7776"},{"id":"INC-08692","date":"2026-05","year":2026,"title":"Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42033"],"affected":"npm/axios, npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42033"},{"id":"INC-08693","date":"2026-05","year":2026,"title":"Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42044"],"affected":"npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044"},{"id":"INC-08694","date":"2026-05","year":2026,"title":"Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42040"],"affected":"npm/axios, npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42040"},{"id":"INC-08695","date":"2026-05","year":2026,"title":"ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/ogham-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8pqq-224h-x875"},{"id":"INC-08696","date":"2026-05","year":2026,"title":"livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/mckenziearts/livewire-markdown-editor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gxxh-8vcj-w2mh"},{"id":"INC-08697","date":"2026-05","year":2026,"title":"pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -355","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33509","CVE-2026-35464","CVE-2026-42313"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42313"},{"id":"INC-08698","date":"2026-05","year":2026,"title":"net-imap vulnerable to command Injection via unvalidated Symbol inputs","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42258"],"affected":"rubygems/net-imap, rubygems/net-imap, rubygems/net-imap","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42258"},{"id":"INC-08699","date":"2026-05","year":2026,"title":"IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-67796"],"affected":"pip/rdiffweb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67796"},{"id":"INC-08700","date":"2026-05","year":2026,"title":"Pelican Web UI Affected by a Privilege Escalation Attack","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42571"],"affected":"go/github.com/pelicanplatform/pelican","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42571"},{"id":"INC-08701","date":"2026-05","year":2026,"title":"phpVMS has an /importer authorization bypass causing full database wipe","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42569"],"affected":"composer/nabeel/phpvms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42569"},{"id":"INC-08702","date":"2026-05","year":2026,"title":"AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"composer/azuracast/azuracast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q4ph-8x8g-95f8"},{"id":"INC-08703","date":"2026-05","year":2026,"title":"AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-42605","CVE-2026-42606"],"affected":"composer/azuracast/azuracast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42606"},{"id":"INC-08704","date":"2026-05","year":2026,"title":"quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42333"],"affected":"maven/io.quarkiverse.openapi.generator:quarkus-openapi-generator, maven/io.quarkiverse.openapi.generator:quarkus-openap…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42333"},{"id":"INC-08705","date":"2026-05","year":2026,"title":"changedetection.io project has an XXE vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41895"],"affected":"pip/changedetection.io","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41895"},{"id":"INC-08706","date":"2026-05","year":2026,"title":"Distribution's tag deletion bypasses `storage.delete.enabled` configuration","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41888"],"affected":"go/github.com/distribution/distribution, go/github.com/distribution/distribution/v3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41888"},{"id":"INC-08707","date":"2026-05","year":2026,"title":"Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42183","CVE-2026-42297"],"affected":"go/github.com/argoproj/argo-workflows/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42183"},{"id":"INC-08708","date":"2026-05","year":2026,"title":"Incus has Nil Dereferences on Restore via Malformed YAML","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41647","CVE-2026-41648","CVE-2026-41684"],"affected":"go/github.com/lxc/incus/v6/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41684"},{"id":"INC-08709","date":"2026-05","year":2026,"title":"Kata Container has CopyFile Policy Subversion via Symlinks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41326"],"affected":"go/github.com/kata-containers/kata-containers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41326"},{"id":"INC-08710","date":"2026-05","year":2026,"title":"Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-41181"],"affected":"go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41181"},{"id":"INC-08711","date":"2026-05","year":2026,"title":"Incus Vulnerable to Panic via Snapshot Bounds Check","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40251"],"affected":"go/github.com/lxc/incus/v6/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40251"},{"id":"INC-08712","date":"2026-05","year":2026,"title":"Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40682"],"affected":"maven/org.apache.opennlp:opennlp-tools, maven/org.apache.opennlp:opennlp-tools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40682"},{"id":"INC-08713","date":"2026-05","year":2026,"title":"Incus has a Nil-Pointer Dereference via Custom Volume Import","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40197"],"affected":"go/github.com/lxc/incus/v6/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40197"},{"id":"INC-08714","date":"2026-05","year":2026,"title":"Incus has a Nil-Pointer Dereference Panic via Bucket Metadata","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40195"],"affected":"go/github.com/lxc/incus/v6/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40195"},{"id":"INC-08715","date":"2026-05","year":2026,"title":"Quarkus has Authentication/Authorization bypasses","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39852"],"affected":"maven/io.quarkus:quarkus-vertx-http, maven/io.quarkus:quarkus-vertx-http, maven/io.quarkus:quarkus-vertx-http","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39852"},{"id":"INC-08716","date":"2026-05","year":2026,"title":"Incus has Blind SSRF via Image Import Preflight HEAD","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35527"],"affected":"go/github.com/lxc/incus/v6/cmd/incusd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35527"},{"id":"INC-08718","date":"2026-05","year":2026,"title":"jOpenDocument has an improper restriction of XML external entity reference vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6501"],"affected":"maven/org.jopendocument:jOpenDocument","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6501"},{"id":"INC-08719","date":"2026-05","year":2026,"title":"@puchunjie/doc-tools-mcp has a Path Traversal Issue","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7738"],"affected":"npm/@puchunjie/doc-tools-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7738"},{"id":"INC-08720","date":"2026-05","year":2026,"title":"sublinear-time-solver has a Path Traversal Issue","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7645"],"affected":"npm/sublinear-time-solver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7645"},{"id":"INC-08721","date":"2026-05","year":2026,"title":"yii2-mcp-server has a Command Injection Issue","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7600"],"affected":"npm/yii2-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7600"},{"id":"INC-08722","date":"2026-05","year":2026,"title":"OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43003"],"affected":"pip/ironic-python-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43003"},{"id":"INC-09749","date":"2026-05","year":2026,"title":"Malware in explorhub-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/explorhub-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2qjx-pmc9-2jrj"},{"id":"INC-09752","date":"2026-05","year":2026,"title":"Malware in mcp-dashboards-shared","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-dashboards-shared","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h2q9-x96j-55m7"},{"id":"INC-09764","date":"2026-05","year":2026,"title":"Malware in @antv/mcp-server-chart","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@antv/mcp-server-chart, npm/@antv/mcp-server-chart","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qgmj-c898-99rq"},{"id":"INC-14045","date":"2026-05","year":2026,"title":"Malware in @openclaw-cn/libsignal","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@openclaw-cn/libsignal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wcjp-mfw5-77g8"},{"id":"INC-14046","date":"2026-05","year":2026,"title":"Malware in @openclaw-cn/toutiao-ops","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@openclaw-cn/toutiao-ops","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-76rr-f54j-qv4x"},{"id":"INC-14047","date":"2026-05","year":2026,"title":"Malware in @openclaw-cn/cli","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@openclaw-cn/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rfwx-q579-pqpc"},{"id":"INC-14048","date":"2026-05","year":2026,"title":"Malware in @openclaw-cn/feishu","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@openclaw-cn/feishu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pmr7-7grm-gj36"},{"id":"INC-14049","date":"2026-05","year":2026,"title":"Malware in openclaw-cn","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openclaw-cn","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w2fv-p53h-wcph"},{"id":"INC-09768","date":"2026-05","year":2026,"title":"Malware in nextmove-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/nextmove-mcp, npm/nextmove-mcp, npm/nextmove-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fhg4-3pg2-pvgx"},{"id":"INC-09769","date":"2026-05","year":2026,"title":"Malware in cmux-agent-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/cmux-agent-mcp, npm/cmux-agent-mcp, npm/cmux-agent-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gx6p-62rj-cg4m"},{"id":"INC-09775","date":"2026-05","year":2026,"title":"Malware in @mistralai/mistralai-gcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mistralai/mistralai-gcp, npm/@mistralai/mistralai-gcp, npm/@mistralai/mistralai-gcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rccm-wwph-vgxc"},{"id":"INC-09776","date":"2026-05","year":2026,"title":"Malware in @mistralai/mistralai-azure","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mistralai/mistralai-azure, npm/@mistralai/mistralai-azure, npm/@mistralai/mistralai-azure","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2rm2-c4pc-xxr9"},{"id":"INC-09777","date":"2026-05","year":2026,"title":"Malware in @squawk/mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@squawk/mcp, npm/@squawk/mcp, npm/@squawk/mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vcpv-j6jh-qcc2"},{"id":"INC-09778","date":"2026-05","year":2026,"title":"Malware in @mistralai/mistralai","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@mistralai/mistralai, npm/@mistralai/mistralai, npm/@mistralai/mistralai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3q49-cfcf-g5fm"},{"id":"INC-09779","date":"2026-05","year":2026,"title":"Malware in pi-exa-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/pi-exa-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fpc5-w8c8-3mhv"},{"id":"INC-01344","date":"2026-04","year":2026,"title":"llama.cpp — Deserialization (CVE-2026-34159)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34159"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34159"},{"id":"INC-00033","date":"2026-04","year":2026,"title":"A vulnerability was found in priyankark a11y-mcp up to 1.0.5.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5323"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5323"},{"id":"INC-01296","date":"2026-04","year":2026,"title":"LangChain — Vulnerability (CVE-2026-40087)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40087"],"affected":"langchain/langchain_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40087"},{"id":"INC-01671","date":"2026-04","year":2026,"title":"PraisonAI — Vulnerability (CVE-2026-40088)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40088"],"affected":"praison/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40088"},{"id":"INC-01677","date":"2026-04","year":2026,"title":"PraisonAIAgents — Vulnerability (CVE-2026-40160)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40160"],"affected":"praison/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40160"},{"id":"INC-01375","date":"2026-04","year":2026,"title":"MaxKB — Xss (CVE-2026-39426)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39426"],"affected":"maxkb/maxkb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39426"},{"id":"INC-14910","date":"2026-04","year":2026,"title":"The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6711","CVE-2026-6712"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6711"},{"id":"INC-01595","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41349"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41349"},{"id":"INC-00629","date":"2026-04","year":2026,"title":"AnythingLLM — Prompt Injection (CVE-2026-41318)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-41318"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41318"},{"id":"INC-01208","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags Nicholas reported that his LLM found it was poss...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31554"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31554"},{"id":"INC-01202","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error blo...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31621"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31621"},{"id":"INC-01294","date":"2026-04","year":2026,"title":"LangChain — Ssrf (CVE-2026-41488)","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41488"],"affected":"langchain/langchain-openai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41488"},{"id":"INC-01274","date":"2026-04","year":2026,"title":"JoeCastrom mcp-chat-studio — Ssrf (CVE-2026-7147)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7147"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7147"},{"id":"INC-01772","date":"2026-04","year":2026,"title":"SillyTavern — Path Traversal (CVE-2026-34522)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34522","CVE-2026-34523","CVE-2026-34524","CVE-2026-34526"],"affected":"sillytavern/sillytavern","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34522"},{"id":"INC-02054","date":"2026-04","year":2026,"title":"vLLM — Vulnerability (CVE-2026-34760)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34760"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34760"},{"id":"INC-01881","date":"2026-04","year":2026,"title":"text-generation-webui — Vulnerability (CVE-2026-35050)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35050"],"affected":"oobabooga/textgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35050"},{"id":"INC-01877","date":"2026-04","year":2026,"title":"text-generation-webui — Path Traversal (CVE-2026-35483)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35483"],"affected":"oobabooga/textgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35483"},{"id":"INC-01878","date":"2026-04","year":2026,"title":"text-generation-webui — Path Traversal (CVE-2026-35484)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35484"],"affected":"oobabooga/textgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35484"},{"id":"INC-01879","date":"2026-04","year":2026,"title":"text-generation-webui — Path Traversal (CVE-2026-35485)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35485"],"affected":"oobabooga/textgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35485"},{"id":"INC-01876","date":"2026-04","year":2026,"title":"text-generation-webui — Data Exfiltration (CVE-2026-35486)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35486"],"affected":"oobabooga/text_generation_web_ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35486"},{"id":"INC-01880","date":"2026-04","year":2026,"title":"text-generation-webui — Path Traversal (CVE-2026-35487)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35487"],"affected":"oobabooga/text_generation_web_ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35487"},{"id":"INC-01351","date":"2026-04","year":2026,"title":"LMDeploy — Ssrf (CVE-2026-33626)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33626"],"affected":"internlm/lmdeploy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33626"},{"id":"INC-01204","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler Commit 31a7a0bbeb00 (\"dpaa2-swit...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23422"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23422"},{"id":"INC-01380","date":"2026-04","year":2026,"title":"MCP Java SDK — Vulnerability (CVE-2026-35568)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35568"],"affected":"lfprojects/mcp_java_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35568"},{"id":"INC-02111","date":"2026-04","year":2026,"title":"Zammad — Rce (CVE-2026-34724)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34724"],"affected":"zammad/zammad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34724"},{"id":"INC-00053","date":"2026-04","year":2026,"title":"AGiXT — Path Traversal (CVE-2026-39981)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39981"],"affected":"agixt/agixt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39981"},{"id":"INC-01676","date":"2026-04","year":2026,"title":"PraisonAIAgents — Prompt Injection (CVE-2026-40150)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-40150"],"affected":"praison/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40150"},{"id":"INC-00992","date":"2026-04","year":2026,"title":"FastGPT — Ssrf (CVE-2026-40100)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40100"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40100"},{"id":"INC-00987","date":"2026-04","year":2026,"title":"FastGPT — Auth Bypass (CVE-2026-40252)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40252"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40252"},{"id":"INC-01389","date":"2026-04","year":2026,"title":"mcp-server-kubernetes — Prompt Injection (CVE-2026-39884)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-39884"],"affected":"suyogs/mcp-server-kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39884"},{"id":"INC-00991","date":"2026-04","year":2026,"title":"FastGPT — Sql Injection (CVE-2026-40351)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34162","CVE-2026-34163","CVE-2026-40351","CVE-2026-40352"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40351"},{"id":"INC-01622","date":"2026-04","year":2026,"title":"Paperclip — Command Injection (CVE-2026-41208)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41208"],"affected":"paperclip/paperclipai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41208"},{"id":"INC-01623","date":"2026-04","year":2026,"title":"Paperclip — Rce (CVE-2026-41679)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41679"],"affected":"paperclip/paperclipai, paperclip/paperclipai\\/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41679"},{"id":"INC-01043","date":"2026-04","year":2026,"title":"Fosowl agenticSeek 0 — Vulnerability (CVE-2026-5584)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5584"],"affected":"fosowl/agenticseek","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5584"},{"id":"INC-00824","date":"2026-04","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-35603)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35603"],"affected":"anthropic/claude_code, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35603"},{"id":"INC-00816","date":"2026-04","year":2026,"title":"Claude Code — Prompt Injection (CVE-2026-39861)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-39861"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39861"},{"id":"INC-01674","date":"2026-04","year":2026,"title":"PraisonAIAgents — Prompt Injection (CVE-2026-40111)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-40111"],"affected":"praison/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40111"},{"id":"INC-01675","date":"2026-04","year":2026,"title":"PraisonAIAgents — Prompt Injection (CVE-2026-40117)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-40117"],"affected":"praison/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40117"},{"id":"INC-01601","date":"2026-04","year":2026,"title":"OpenClaw versions 2026.2.13 through 2026.3.24 contain an ANSI escape sequence injection vulnerability in approval prompts that allows attackers to spoof terminal output.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35651"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35651"},{"id":"INC-01468","date":"2026-04","year":2026,"title":"MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40505"],"affected":"artifex/mupdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40505"},{"id":"INC-01000","date":"2026-04","year":2026,"title":"FastMCP — Ssrf (CVE-2026-32871)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32871"],"affected":"jlowin/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32871"},{"id":"INC-01888","date":"2026-04","year":2026,"title":"The Go MCP SDK used Go's standard encoding/json.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33252","CVE-2026-34742"],"affected":"lfprojects/mcp_go_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34742"},{"id":"INC-01452","date":"2026-04","year":2026,"title":"Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32211"],"affected":"microsoft/azure_web_apps","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32211"},{"id":"INC-00999","date":"2026-04","year":2026,"title":"FastMCP — Command Injection (CVE-2025-64340)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64340"],"affected":"jlowin/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64340"},{"id":"INC-01002","date":"2026-04","year":2026,"title":"FastMCP — Vulnerability (CVE-2026-27124)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27124"],"affected":"jlowin/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27124"},{"id":"INC-01670","date":"2026-04","year":2026,"title":"PraisonAI — Vulnerability (CVE-2026-34953)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34953"],"affected":"praison/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34953"},{"id":"INC-00018","date":"2026-04","year":2026,"title":"A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5607"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5607"},{"id":"INC-01461","date":"2026-04","year":2026,"title":"Mobile Next — Vulnerability (CVE-2026-35394)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35394"],"affected":"mobilenexthq/mobile_mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35394"},{"id":"INC-01055","date":"2026-04","year":2026,"title":"FrontMCP — Ssrf (CVE-2026-39885)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39885"],"affected":"agentfront/\\@frontmcp\\/adapters, agentfront/\\@frontmcp\\/sdk, agentfront/frontmcp, frontmcp/mcp-from-openapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39885"},{"id":"INC-00637","date":"2026-04","year":2026,"title":"Apollo MCP Server — Auth Bypass (CVE-2026-35577)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35577"],"affected":"apollographql/apollo_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35577"},{"id":"INC-00670","date":"2026-04","year":2026,"title":"aws-mcp-server Command Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5058"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5058"},{"id":"INC-00669","date":"2026-04","year":2026,"title":"aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5059"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5059"},{"id":"INC-01199","date":"2026-04","year":2026,"title":"In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` c...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-20205"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-20205"},{"id":"INC-01385","date":"2026-04","year":2026,"title":"mcp-framework — Dos (CVE-2026-39313)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39313"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39313"},{"id":"INC-01388","date":"2026-04","year":2026,"title":"mcp-neo4j-cypher — Ssrf (CVE-2026-35402)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35402"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35402"},{"id":"INC-00635","date":"2026-04","year":2026,"title":"Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statemen...","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66335"],"affected":"apache/doris_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66335"},{"id":"INC-00972","date":"2026-04","year":2026,"title":"excel-mcp-server — Path Traversal (CVE-2026-40576)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40576"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40576"},{"id":"INC-01528","date":"2026-04","year":2026,"title":"Next AI Draw.io — Vulnerability (CVE-2026-40608)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40608"],"affected":"dayuanjiang/next_ai_draw.io","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40608"},{"id":"INC-00031","date":"2026-04","year":2026,"title":"A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7150"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7150"},{"id":"INC-00034","date":"2026-04","year":2026,"title":"A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7221"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7221"},{"id":"INC-00029","date":"2026-04","year":2026,"title":"A vulnerability was found in Algovate xhs-mcp 0.8.11.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7417"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7417"},{"id":"INC-00019","date":"2026-04","year":2026,"title":"A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5470"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5470"},{"id":"INC-01510","date":"2026-04","year":2026,"title":"n8n-MCP — Ssrf (CVE-2026-39974)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39974"],"affected":"n8n-mcp/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39974"},{"id":"INC-00028","date":"2026-04","year":2026,"title":"A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6108"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6108"},{"id":"INC-00741","date":"2026-04","year":2026,"title":"chatboxai chatbox — Command Injection (CVE-2026-6130)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6130"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6130"},{"id":"INC-01308","date":"2026-04","year":2026,"title":"langflow-ai langflow — Vulnerability (CVE-2026-6599)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6599"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6599"},{"id":"INC-00035","date":"2026-04","year":2026,"title":"A vulnerability was found in vllm up to 0.19.0.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7141"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7141"},{"id":"INC-01457","date":"2026-04","year":2026,"title":"MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33865","CVE-2026-33866"],"affected":"lfprojects/mlflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33865"},{"id":"INC-01726","date":"2026-04","year":2026,"title":"Rembg — Path Traversal (CVE-2026-40086)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40086"],"affected":"danielgatis/rembg","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40086"},{"id":"INC-01200","date":"2026-04","year":2026,"title":"In Spring AI, having access to a shared environment can expose the ONNX model used by the application.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40979"],"affected":"vmware/spring_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40979"},{"id":"INC-01555","date":"2026-04","year":2026,"title":"Ollama — Ssrf (CVE-2026-5530)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5530"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5530"},{"id":"INC-01286","date":"2026-04","year":2026,"title":"KubeAI — Vulnerability (CVE-2026-34940)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34940"],"affected":"kubeai/kubeai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34940"},{"id":"INC-01203","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the end of this function...","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31436"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31436"},{"id":"INC-01212","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31507"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31507"},{"id":"INC-00032","date":"2026-04","year":2026,"title":"A vulnerability was found in ericc-ch copilot-api up to 0.7.0.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6662"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6662"},{"id":"INC-00027","date":"2026-04","year":2026,"title":"A vulnerability was determined in ericc-ch copilot-api up to 0.7.0.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6874"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6874"},{"id":"INC-01980","date":"2026-04","year":2026,"title":"Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33102"],"affected":"microsoft/365_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33102"},{"id":"INC-01311","date":"2026-04","year":2026,"title":"langgenius dify — Ssrf (CVE-2026-6617)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6617"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6617"},{"id":"INC-01312","date":"2026-04","year":2026,"title":"langgenius dify — Ssrf (CVE-2026-6618)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6618"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6618"},{"id":"INC-01313","date":"2026-04","year":2026,"title":"langgenius dify — Xss (CVE-2026-6619)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6619"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6619"},{"id":"INC-01350","date":"2026-04","year":2026,"title":"lm-sys fastchat — Vulnerability (CVE-2026-6608)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6608"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6608"},{"id":"INC-01894","date":"2026-04","year":2026,"title":"The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39378"],"affected":"jupyter/nbconvert","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39378"},{"id":"INC-00016","date":"2026-04","year":2026,"title":"A security vulnerability has been detected in ComfyUI up to 0.13.0.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6589"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6589"},{"id":"INC-00843","date":"2026-04","year":2026,"title":"ComfyUI — Path Traversal (CVE-2026-6590)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6590"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6590"},{"id":"INC-00844","date":"2026-04","year":2026,"title":"ComfyUI — Path Traversal (CVE-2026-6591)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6591"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6591"},{"id":"INC-00845","date":"2026-04","year":2026,"title":"ComfyUI — Xss (CVE-2026-6592)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6592"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6592"},{"id":"INC-00030","date":"2026-04","year":2026,"title":"A vulnerability was found in ComfyUI up to 0.13.0.","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6593"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6593"},{"id":"INC-01715","date":"2026-04","year":2026,"title":"pyLoad — Vulnerability (CVE-2026-40071)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40071"],"affected":"pyload/pyload","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40071"},{"id":"INC-01566","date":"2026-04","year":2026,"title":"Open WebUI — Ssrf (CVE-2026-34225)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34225"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34225"},{"id":"INC-01911","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI — Auth Bypass (CVE-2026-6582)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6582"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6582"},{"id":"INC-02061","date":"2026-04","year":2026,"title":"Vulnerability in the XML Database component of Oracle Database Server.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30694","CVE-2026-21999"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21999"},{"id":"INC-01585","date":"2026-04","year":2026,"title":"OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30077","CVE-2026-30078"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30078"},{"id":"INC-01198","date":"2026-04","year":2026,"title":"In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30079"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30079"},{"id":"INC-01586","date":"2026-04","year":2026,"title":"OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response containing a NAS PDU with oversize respons...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30075"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30075"},{"id":"INC-01584","date":"2026-04","year":2026,"title":"OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30080"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30080"},{"id":"INC-00692","date":"2026-04","year":2026,"title":"bigsk1 openai-realtime-ui — Ssrf (CVE-2026-5803)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5803"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5803"},{"id":"INC-14610","date":"2026-04","year":2026,"title":"The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6393"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6393"},{"id":"INC-14050","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34511"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34511"},{"id":"INC-01217","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e7566...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31552"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31552"},{"id":"INC-01213","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETD...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31504"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31504"},{"id":"INC-01205","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fix error path ordering in edac_mc_alloc() When the mci->pvt_info allocation in edac_mc_alloc() fa...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31689"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31689"},{"id":"INC-00017","date":"2026-04","year":2026,"title":"A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca1747bf.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7235"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7235"},{"id":"INC-01331","date":"2026-04","year":2026,"title":"LibreChat — Path Traversal (CVE-2026-34371)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34371"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34371"},{"id":"INC-02120","date":"2026-04","year":2026,"title":"zhayujie chatgpt-on-wechat CowAgent — Path Traversal (CVE-2026-5998)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5998"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5998"},{"id":"INC-02118","date":"2026-04","year":2026,"title":"zhayujie chatgpt-on-wechat CowAgent 2 — Auth Bypass (CVE-2026-6126)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6126"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6126"},{"id":"INC-02119","date":"2026-04","year":2026,"title":"zhayujie chatgpt-on-wechat CowAgent — Auth Bypass (CVE-2026-6129)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6129"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6129"},{"id":"INC-01910","date":"2026-04","year":2026,"title":"Toowiredd chatgpt-mcp-server — Command Injection (CVE-2026-7061)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7061"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7061"},{"id":"INC-00021","date":"2026-04","year":2026,"title":"A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Sa...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-69893"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69893"},{"id":"INC-09780","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits ...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3357"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3357"},{"id":"INC-08803","date":"2026-04","year":2026,"title":"langflow-ai langflow — Vulnerability (CVE-2026-6596)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6596"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6596"},{"id":"INC-08804","date":"2026-04","year":2026,"title":"langflow-ai langflow — Vulnerability (CVE-2026-6597)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6597"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6597"},{"id":"INC-08802","date":"2026-04","year":2026,"title":"A security vulnerability has been detected in langflow-ai langflow up to 1.8.3.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6598"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6598"},{"id":"INC-09781","date":"2026-04","year":2026,"title":"langflow-ai langflow — Xss (CVE-2026-6600)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6600"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6600"},{"id":"INC-09782","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF).","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3340"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3340"},{"id":"INC-09783","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-3346"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3346"},{"id":"INC-09784","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4502"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4502"},{"id":"INC-09785","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4503"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4503"},{"id":"INC-09786","date":"2026-04","year":2026,"title":"IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-3345"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3345"},{"id":"INC-09787","date":"2026-04","year":2026,"title":"IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted ve...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6542"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6542"},{"id":"INC-09788","date":"2026-04","year":2026,"title":"IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-6543"],"affected":"langflow/langflow_desktop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6543"},{"id":"INC-08994","date":"2026-04","year":2026,"title":"PraisonAI — Vulnerability (CVE-2026-34936)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34936"],"affected":"praison/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34936"},{"id":"INC-09789","date":"2026-04","year":2026,"title":"SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templ...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5760"],"affected":"lmsys/sglang","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5760"},{"id":"INC-09790","date":"2026-04","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: bcache: fix cached_dev.sb_bio use-after-free and crash In our production environment, we have received mult...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31580"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31580"},{"id":"INC-08911","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32002","CVE-2026-34426","CVE-2026-34510","CVE-2026-35618","CVE-2026-35620","CVE-2026-35622","CVE-2026-35624","CVE-2026-35626","CVE-2026-35627","CVE-2026-35631","CVE-2026-35633","CVE-2026-35634","CVE-2026-35635","CVE-2026-35637","CVE-2026-35638","CVE-2026-35639","CVE-2026-35643","CVE-2026-35644","CVE-2026-35648","CVE-2026-35649","CVE-2026-35650","CVE-2026-35652","CVE-2026-35655","CVE-2026-35656","CVE-2026-35658","CVE-2026-35659","CVE-2026-35660","CVE-2026-35662","CVE-2026-35666","CVE-2026-35670","CVE-2026-41387"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34510"},{"id":"INC-14051","date":"2026-04","year":2026,"title":"OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content b...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34425"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34425"},{"id":"INC-14052","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-or...","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40037","CVE-2026-41910","CVE-2026-41911","CVE-2026-41912","CVE-2026-41913","CVE-2026-41914","CVE-2026-41915","CVE-2026-41916","CVE-2026-42420","CVE-2026-42421","CVE-2026-42422","CVE-2026-42423","CVE-2026-42424","CVE-2026-42426","CVE-2026-42427","CVE-2026-42428","CVE-2026-42429","CVE-2026-42430","CVE-2026-42431","CVE-2026-42432"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40037"},{"id":"INC-14053","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admi...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34512"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34512"},{"id":"INC-14054","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35617"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35617"},{"id":"INC-14055","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35623"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35623"},{"id":"INC-14056","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device per...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35625"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35625"},{"id":"INC-14057","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35628"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35628"},{"id":"INC-08909","date":"2026-04","year":2026,"title":"OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containme...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32013","CVE-2026-35632"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35632"},{"id":"INC-14058","date":"2026-04","year":2026,"title":"OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35636"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35636"},{"id":"INC-14059","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35640"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35640"},{"id":"INC-09054","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35642"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35642"},{"id":"INC-08910","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runti...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35645"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35645"},{"id":"INC-14060","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35646"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35646"},{"id":"INC-09038","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35619"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35619"},{"id":"INC-14061","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, allowing op...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35621"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35621"},{"id":"INC-09037","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a ...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35641"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35641"},{"id":"INC-14062","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35647"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35647"},{"id":"INC-09036","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to b...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35653"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35653"},{"id":"INC-14063","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows unauthorized senders to record session feedback.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35654"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35654"},{"id":"INC-14064","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35657"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35657"},{"id":"INC-14065","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying nor...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35661"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35661"},{"id":"INC-14066","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35663"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35663"},{"id":"INC-14067","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payloads.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35664"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35664"},{"id":"INC-09811","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeo...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32011","CVE-2026-35665"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35665"},{"id":"INC-09039","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unno...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35668"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35668"},{"id":"INC-14068","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35669"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35669"},{"id":"INC-09330","date":"2026-04","year":2026,"title":"OpenClaw Canvas Path Traversal Information Disclosure Vulnerability.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-3689"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3689"},{"id":"INC-09284","date":"2026-04","year":2026,"title":"OpenClaw Canvas Authentication Bypass Vulnerability.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-3690"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3690"},{"id":"INC-09324","date":"2026-04","year":2026,"title":"OpenClaw Client PKCE Verifier Information Disclosure Vulnerability.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-3691"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3691"},{"id":"INC-14069","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40045"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40045"},{"id":"INC-14070","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during built-in channel setup and login.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41295"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41295"},{"id":"INC-14071","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resource...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41297"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41297"},{"id":"INC-08943","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41298"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41298"},{"id":"INC-14072","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metad...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41299","CVE-2026-41375"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41299"},{"id":"INC-14073","date":"2026-04","year":2026,"title":"OpenClaw versions 2026.3.22 before 2026.3.31 contain a signature verification bypass vulnerability in the Nostr DM ingress path that allows pairing challenges to be issued befor...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41301"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41301"},{"id":"INC-14074","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41303"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41303"},{"id":"INC-14075","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41908"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41908"},{"id":"INC-14076","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate and act on pairing...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41909"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41909"},{"id":"INC-14077","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41332"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41332"},{"id":"INC-14078","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41339"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41339"},{"id":"INC-14079","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit t...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41342"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41342"},{"id":"INC-14080","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel ses...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41344"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41344"},{"id":"INC-14081","date":"2026-04","year":2026,"title":"OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41346"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41346"},{"id":"INC-08947","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility restrictions...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41350"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41350"},{"id":"INC-14082","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persisten...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41353"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41353"},{"id":"INC-14083","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41354"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41354"},{"id":"INC-08766","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41296","CVE-2026-41300","CVE-2026-41302","CVE-2026-41329","CVE-2026-41330","CVE-2026-41331","CVE-2026-41333","CVE-2026-41334","CVE-2026-41335","CVE-2026-41336","CVE-2026-41337","CVE-2026-41338","CVE-2026-41340","CVE-2026-41341","CVE-2026-41343","CVE-2026-41345","CVE-2026-41347","CVE-2026-41348","CVE-2026-41351","CVE-2026-41352","CVE-2026-41355","CVE-2026-41356","CVE-2026-41357","CVE-2026-41362","CVE-2026-41364","CVE-2026-41365","CVE-2026-41369","CVE-2026-41370","CVE-2026-41373","CVE-2026-41374","CVE-2026-41376","CVE-2026-41378","CVE-2026-41381","CVE-2026-41382","CVE-2026-41385","CVE-2026-41388","CVE-2026-41391","CVE-2026-41393","CVE-2026-41396","CVE-2026-41397","CVE-2026-41400","CVE-2026-41402","CVE-2026-41403","CVE-2026-41404","CVE-2026-41405","CVE-2026-41406"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41357"},{"id":"INC-08717","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41358"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41358"},{"id":"INC-08765","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and ...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41359","CVE-2026-41379"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41359"},{"id":"INC-14084","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41360"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41360"},{"id":"INC-14085","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41361"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41361"},{"id":"INC-14086","date":"2026-04","year":2026,"title":"OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandbox restric...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41363"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41363"},{"id":"INC-14087","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read.","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41366"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41366"},{"id":"INC-09015","date":"2026-04","year":2026,"title":"OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33579","CVE-2026-33580","CVE-2026-34504","CVE-2026-41294","CVE-2026-41367","CVE-2026-41371","CVE-2026-41380","CVE-2026-41390"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41367"},{"id":"INC-14088","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41368"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41368"},{"id":"INC-14089","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41372"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41372"},{"id":"INC-14090","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41377"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41377"},{"id":"INC-08946","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceD...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41383"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41383"},{"id":"INC-14091","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables thro...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41384"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41384"},{"id":"INC-14092","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41386"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41386"},{"id":"INC-14093","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41392"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41392"},{"id":"INC-14094","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41394"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41394"},{"id":"INC-14095","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for rep...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41395"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41395"},{"id":"INC-08944","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41398"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41398"},{"id":"INC-14096","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41399"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41399"},{"id":"INC-14097","date":"2026-04","year":2026,"title":"OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-length compar...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41407"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41407"},{"id":"INC-14098","date":"2026-04","year":2026,"title":"OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41408"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41408"},{"id":"INC-08723","date":"2026-04","year":2026,"title":"Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42461"],"affected":"go/github.com/getarcaneapp/arcane/backend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42461"},{"id":"INC-08724","date":"2026-04","year":2026,"title":"Sentry's improper authentication on SAML SSO process allows user identity linking","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42354"],"affected":"pip/sentry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42354"},{"id":"INC-08725","date":"2026-04","year":2026,"title":"Shopizer is vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-36766"],"affected":"maven/com.shopizer:shopizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-36766"},{"id":"INC-08726","date":"2026-04","year":2026,"title":"Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/hickory-recursor, rust/hickory-recursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-83hf-93m4-rgwq"},{"id":"INC-08727","date":"2026-04","year":2026,"title":"Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27018","CVE-2026-40280","CVE-2026-40281"],"affected":"go/github.com/gotenberg/gotenberg/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40281"},{"id":"INC-08728","date":"2026-04","year":2026,"title":"mcp-server-semgrep has a Command Injection issue","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7446"],"affected":"npm/mcp-server-semgrep","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7446"},{"id":"INC-08729","date":"2026-04","year":2026,"title":"Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41656","CVE-2026-41657","CVE-2026-41658","CVE-2026-41661","CVE-2026-41669","CVE-2026-41670"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41670"},{"id":"INC-08731","date":"2026-04","year":2026,"title":"mcpo-simple-server has a Path Traversal issue","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7404"],"affected":"pip/mcpo-simple-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7404"},{"id":"INC-08732","date":"2026-04","year":2026,"title":"GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41643"],"affected":"go/github.com/osrg/gobgp/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41643"},{"id":"INC-08733","date":"2026-04","year":2026,"title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40902"],"affected":"composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40902"},{"id":"INC-08734","date":"2026-04","year":2026,"title":"PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40863"],"affected":"composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40863"},{"id":"INC-08735","date":"2026-04","year":2026,"title":"beets has a Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42052"],"affected":"pip/beets","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42052"},{"id":"INC-08736","date":"2026-04","year":2026,"title":"Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42524"],"affected":"maven/org.jenkins-ci.plugins:htmlpublisher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42524"},{"id":"INC-08737","date":"2026-04","year":2026,"title":"PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40296"],"affected":"composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40296"},{"id":"INC-08738","date":"2026-04","year":2026,"title":"PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35453"],"affected":"composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35453"},{"id":"INC-08739","date":"2026-04","year":2026,"title":"Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40978"],"affected":"maven/org.springframework.ai:spring-ai-azure-cosmos-db-store, maven/org.springframework.ai:spring-ai-azure-cosmos-db-st…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40978"},{"id":"INC-08740","date":"2026-04","year":2026,"title":"Spring AI Vulnerable to OOM by attacker-controlled PDF","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40980"],"affected":"maven/org.springframework.ai:spring-ai-pdf-document-reader, maven/org.springframework.ai:spring-ai-pdf-document-reader","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40980"},{"id":"INC-08741","date":"2026-04","year":2026,"title":"Spring AI has a VectorStore FilterExpression Converter injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40967"],"affected":"maven/org.springframework.ai:spring-ai-vector-store, maven/org.springframework.ai:spring-ai-vector-store","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40967"},{"id":"INC-08742","date":"2026-04","year":2026,"title":"BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7223"],"affected":"npm/@dadigua/hyperchat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7223"},{"id":"INC-08743","date":"2026-04","year":2026,"title":"sqlite-mcp has an Injection issue","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7206"],"affected":"pip/sqlite-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7206"},{"id":"INC-08744","date":"2026-04","year":2026,"title":"notes-mcp has a Path Traversal issue","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7212"],"affected":"pip/notes-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7212"},{"id":"INC-08745","date":"2026-04","year":2026,"title":"kaggle-mcp has a Path Traversal issue","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7149"],"affected":"pip/kaggle-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7149"},{"id":"INC-08746","date":"2026-04","year":2026,"title":"Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40557"],"affected":"maven/org.apache.storm:storm-metrics-prometheus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40557"},{"id":"INC-08748","date":"2026-04","year":2026,"title":"Cillium exposes sensitive information included in the cilium-bugtool debug archive","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41520"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41520"},{"id":"INC-08749","date":"2026-04","year":2026,"title":"wlc: print_html outputs API data without HTML escaping","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42150"],"affected":"pip/wlc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42150"},{"id":"INC-08750","date":"2026-04","year":2026,"title":"Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-39858","CVE-2026-41174"],"affected":"go/github.com/traefik/traefik, go/github.com/traefik/traefik/v2, go/github.com/traefik/traefik/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41174"},{"id":"INC-08751","date":"2026-04","year":2026,"title":"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"actions/google-github-actions/run-gemini-cli, npm/@google/gemini-cli, npm/@google/gemini-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wpqr-6v78-jr5g"},{"id":"INC-08752","date":"2026-04","year":2026,"title":"k8sGPT has Prompt Injection through its k8sGPT-Operator","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/k8sgpt-ai/k8sgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rp7v-4384-hfrp"},{"id":"INC-08753","date":"2026-04","year":2026,"title":"rustls-webpki: Denial of service via panic on malformed CRL BIT STRING","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/rustls-webpki, rust/rustls-webpki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-82j2-j2ch-gfr8"},{"id":"INC-08754","date":"2026-04","year":2026,"title":"nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-42202"],"affected":"composer/almirhodzic/nova-toggle-5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42202"},{"id":"INC-08755","date":"2026-04","year":2026,"title":"New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41432"],"affected":"go/github.com/QuantumNous/new-api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41432"},{"id":"INC-08756","date":"2026-04","year":2026,"title":"Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41328"],"affected":"go/github.com/dgraph-io/dgraph, go/github.com/dgraph-io/dgraph/v24, go/github.com/dgraph-io/dgraph/v25","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41328"},{"id":"INC-08757","date":"2026-04","year":2026,"title":"Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41327"],"affected":"go/github.com/dgraph-io/dgraph, go/github.com/dgraph-io/dgraph/v24, go/github.com/dgraph-io/dgraph/v25","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41327"},{"id":"INC-08758","date":"2026-04","year":2026,"title":"russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42189"],"affected":"rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42189"},{"id":"INC-08759","date":"2026-04","year":2026,"title":"Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-38743"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-38743"},{"id":"INC-08760","date":"2026-04","year":2026,"title":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41305"],"affected":"npm/postcss","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305"},{"id":"INC-08761","date":"2026-04","year":2026,"title":"Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42181"],"affected":"rust/lemmy_api_common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42181"},{"id":"INC-08762","date":"2026-04","year":2026,"title":"Contour has Lua code injection via Cookie Path Rewrite Policy","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41246"],"affected":"go/github.com/projectcontour/contour, go/github.com/projectcontour/contour, go/github.com/projectcontour/contour","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41246"},{"id":"INC-08763","date":"2026-04","year":2026,"title":"Apache ActiveMQ Vulnerable to Code Injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41044"],"affected":"maven/org.apache.activemq:activemq-broker, maven/org.apache.activemq:activemq-all,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41044"},{"id":"INC-08764","date":"2026-04","year":2026,"title":"Apache ActiveMQ Vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41043"],"affected":"maven/org.apache.activemq:activemq-broker, maven/org.apache.activemq:activemq-all,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41043"},{"id":"INC-08767","date":"2026-04","year":2026,"title":"Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33318"],"affected":"npm/@actual-app/sync-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33318"},{"id":"INC-08768","date":"2026-04","year":2026,"title":"Kirby has XML injection in its XML creator toolkit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32870"],"affected":"composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32870"},{"id":"INC-08769","date":"2026-04","year":2026,"title":"Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-62373"],"affected":"pip/pipecat-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62373"},{"id":"INC-08770","date":"2026-04","year":2026,"title":"Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41322"],"affected":"npm/@astrojs/node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41322"},{"id":"INC-08771","date":"2026-04","year":2026,"title":"OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rubygems/openc3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2wvh-87g2-89hr"},{"id":"INC-08772","date":"2026-04","year":2026,"title":"OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42086"],"affected":"pip/openc3, rubygems/openc3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42086"},{"id":"INC-08773","date":"2026-04","year":2026,"title":"OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42085"],"affected":"rubygems/openc3, rubygems/openc3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42085"},{"id":"INC-08774","date":"2026-04","year":2026,"title":"justhtml has sanitization bypass in custom policies and programmatic DOM","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vrx2-77f2-ww34"},{"id":"INC-08775","date":"2026-04","year":2026,"title":"Gitea has insecure default SSH settings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3m6q-h5gj-7mrw"},{"id":"INC-08776","date":"2026-04","year":2026,"title":"i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41683"],"affected":"npm/i18next-http-middleware","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41683"},{"id":"INC-08777","date":"2026-04","year":2026,"title":"xmldom: Uncontrolled recursion in XML serialization leads to DoS","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41673"],"affected":"npm/xmldom, npm/@xmldom/xmldom, npm/@xmldom/xmldom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41673"},{"id":"INC-08778","date":"2026-04","year":2026,"title":"xmldom has XML injection through unvalidated DocumentType serialization","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41674","CVE-2026-41675"],"affected":"npm/xmldom, npm/@xmldom/xmldom, npm/@xmldom/xmldom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41674"},{"id":"INC-08779","date":"2026-04","year":2026,"title":"xmldom has XML node injection through unvalidated comment serialization","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41672"],"affected":"npm/xmldom, npm/@xmldom/xmldom, npm/@xmldom/xmldom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41672"},{"id":"INC-08780","date":"2026-04","year":2026,"title":"monetr: Server-side request forgery in Lunch Flow link creation and refresh","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41644"],"affected":"go/github.com/monetr/monetr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41644"},{"id":"INC-08781","date":"2026-04","year":2026,"title":"Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41591"],"affected":"npm/@marko/runtime-tags, npm/marko","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41591"},{"id":"INC-08782","date":"2026-04","year":2026,"title":"DDEV has ZipSlip path traversal in tar and zip archive extraction","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32885"],"affected":"go/github.com/ddev/ddev","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32885"},{"id":"INC-08783","date":"2026-04","year":2026,"title":"Inspektor Gadget: Command Injection via malicious buildOptions manipulation","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24905"],"affected":"go/github.com/inspektor-gadget/inspektor-gadget","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24905"},{"id":"INC-08784","date":"2026-04","year":2026,"title":"i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41692"],"affected":"npm/i18nextify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41692"},{"id":"INC-08785","date":"2026-04","year":2026,"title":"DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41238","CVE-2026-41239"],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41239"},{"id":"INC-08786","date":"2026-04","year":2026,"title":"PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41570"],"affected":"composer/phpunit/phpunit, composer/phpunit/phpunit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mh6w-vxff-9wqp"},{"id":"INC-08787","date":"2026-04","year":2026,"title":"engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"npm/engramx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2r2p-4cgf-hv7h"},{"id":"INC-08788","date":"2026-04","year":2026,"title":"Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22754"],"affected":"maven/org.springframework.security:spring-security-config","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22754"},{"id":"INC-08789","date":"2026-04","year":2026,"title":"Astro: XSS in define:vars via incomplete </script> tag sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41067"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41067"},{"id":"INC-08790","date":"2026-04","year":2026,"title":"lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41066"],"affected":"pip/lxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41066"},{"id":"INC-08791","date":"2026-04","year":2026,"title":"Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40923","CVE-2026-40924"],"affected":"go/github.com/tektoncd/pipeline, go/github.com/tektoncd/pipeline, go/github.com/tektoncd/pipeline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40924"},{"id":"INC-08792","date":"2026-04","year":2026,"title":"OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40488"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40488"},{"id":"INC-08793","date":"2026-04","year":2026,"title":"Glances has SSRF in IP Plugin via public_api leading to credential leakage","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35587"],"affected":"pip/glances","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35587"},{"id":"INC-08794","date":"2026-04","year":2026,"title":"OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35570"],"affected":"npm/@gitlawb/openclaude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35570"},{"id":"INC-08795","date":"2026-04","year":2026,"title":"Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-34839"],"affected":"pip/Glances","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34839"},{"id":"INC-08796","date":"2026-04","year":2026,"title":"Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34403"],"affected":"go/github.com/0xJacky/Nginx-UI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34403"},{"id":"INC-08797","date":"2026-04","year":2026,"title":"Nginx-UI: Disabled users retain full API access through previously issued bearer tokens","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33026","CVE-2026-33030","CVE-2026-33031"],"affected":"go/github.com/0xJacky/Nginx-UI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33031"},{"id":"INC-08798","date":"2026-04","year":2026,"title":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-28684"],"affected":"pip/python-dotenv","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"id":"INC-08799","date":"2026-04","year":2026,"title":"OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25524","CVE-2026-25525"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25525"},{"id":"INC-08800","date":"2026-04","year":2026,"title":"AgentScope vulnerable to Server-Side Request Forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6604","CVE-2026-6605","CVE-2026-6606"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6606"},{"id":"INC-08801","date":"2026-04","year":2026,"title":"AgentScope Vulnerable to Remote Code Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6603"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6603"},{"id":"INC-08805","date":"2026-04","year":2026,"title":"RAGAS has SSRF via Multi-Modal Faithfulness Collections Module","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-45691","CVE-2026-6587"],"affected":"pip/ragas","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6587"},{"id":"INC-08806","date":"2026-04","year":2026,"title":"pretalx vulnerable to stored cross-site scripting in organizer search typeahead","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41241"],"affected":"pip/pretalx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41241"},{"id":"INC-08807","date":"2026-04","year":2026,"title":"pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41426"],"affected":"pip/pretalx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41426"},{"id":"INC-08808","date":"2026-04","year":2026,"title":"Wish has SCP Path Traversal that allows arbitrary file read/write","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41589"],"affected":"go/github.com/charmbracelet/wish, go/charm.land/wish/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41589"},{"id":"INC-08809","date":"2026-04","year":2026,"title":"Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41490"],"affected":"pip/dagster-snowflake-polars, pip/dagster-deltalake, pip/dagster","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41490"},{"id":"INC-08810","date":"2026-04","year":2026,"title":"Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6437"],"affected":"go/github.com/kubernetes-sigs/aws-efs-csi-driver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6437"},{"id":"INC-08811","date":"2026-04","year":2026,"title":"Kimai: Username enumeration via timing on X-AUTH-USER","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jrc6-fmhw-fpq2"},{"id":"INC-08812","date":"2026-04","year":2026,"title":"PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41496"],"affected":"pip/praisonaiagents, pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41496"},{"id":"INC-08813","date":"2026-04","year":2026,"title":"PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34935","CVE-2026-41497"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41497"},{"id":"INC-08814","date":"2026-04","year":2026,"title":"OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41433"],"affected":"go/go.opentelemetry.io/obi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41433"},{"id":"INC-08819","date":"2026-04","year":2026,"title":"OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40525"],"affected":"pip/openviking","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40525"},{"id":"INC-08820","date":"2026-04","year":2026,"title":"Sentry: Improper authentication on SAML SSO process allows user identity linking","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27197"],"affected":"pip/sentry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27197"},{"id":"INC-08821","date":"2026-04","year":2026,"title":"Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-23500"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23500"},{"id":"INC-08822","date":"2026-04","year":2026,"title":"goldmark vulnerable to Cross-site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5160"],"affected":"go/github.com/yuin/goldmark/renderer/html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5160"},{"id":"INC-08823","date":"2026-04","year":2026,"title":"Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42259"],"affected":"npm/@saltcorn/server, npm/@saltcorn/server, npm/@saltcorn/server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42259"},{"id":"INC-08824","date":"2026-04","year":2026,"title":"Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/p3-symmetric","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3g92-f9ch-qjcm"},{"id":"INC-08825","date":"2026-04","year":2026,"title":"Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3xx2-mqjm-hg9x"},{"id":"INC-08826","date":"2026-04","year":2026,"title":"Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@paperclipai/ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fpw4-p57j-hqmq"},{"id":"INC-08827","date":"2026-04","year":2026,"title":"Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p7mm-r948-4q3q"},{"id":"INC-08828","date":"2026-04","year":2026,"title":"Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-47wq-cj9q-wpmp"},{"id":"INC-08829","date":"2026-04","year":2026,"title":"Paperclip: OS Command Injection via Execution Workspace cleanupCommand","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vr7g-88fq-vhq3"},{"id":"INC-08830","date":"2026-04","year":2026,"title":"Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/paperclipai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gqqj-85qm-8qhf"},{"id":"INC-08831","date":"2026-04","year":2026,"title":"Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xfqj-r5qw-8g4j"},{"id":"INC-08832","date":"2026-04","year":2026,"title":"Paperclip: Malicious skills able to exfiltrate and destroy all user data","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@paperclipai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w8hx-hqjv-vjcq"},{"id":"INC-08833","date":"2026-04","year":2026,"title":"Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@paperclipai/shared","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3pw3-v88x-xj24"},{"id":"INC-08834","date":"2026-04","year":2026,"title":"Kyverno: ServiceAccount token leaked to external servers via apiCall service URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41323"],"affected":"go/github.com/kyverno/kyverno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41323"},{"id":"INC-08835","date":"2026-04","year":2026,"title":"ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40611"],"affected":"go/github.com/go-acme/lego, go/github.com/go-acme/lego/v3, go/github.com/go-acme/lego/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40611"},{"id":"INC-08836","date":"2026-04","year":2026,"title":"WWBN AVideo: RCE cause by clonesite plugin","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41304"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41304"},{"id":"INC-08837","date":"2026-04","year":2026,"title":"zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40302"],"affected":"go/github.com/openziti/zrok/v2, go/github.com/openziti/zrok","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40302"},{"id":"INC-08838","date":"2026-04","year":2026,"title":"sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40186"],"affected":"npm/sanitize-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40186"},{"id":"INC-08839","date":"2026-04","year":2026,"title":"Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35569"],"affected":"npm/apostrophe","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35569"},{"id":"INC-08840","date":"2026-04","year":2026,"title":"ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33889"],"affected":"npm/apostrophe","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33889"},{"id":"INC-08841","date":"2026-04","year":2026,"title":"Apache Airflow: RCE by race condition in example_xcom dag","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54550"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54550"},{"id":"INC-08842","date":"2026-04","year":2026,"title":"wger has Stored XSS via Unescaped License Attribution Fields","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40353","CVE-2026-40474"],"affected":"pip/wger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40353"},{"id":"INC-08843","date":"2026-04","year":2026,"title":"pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40594"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40594"},{"id":"INC-14099","date":"2026-04","year":2026,"title":"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56761"],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56761"},{"id":"INC-08845","date":"2026-04","year":2026,"title":"Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41228"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41228"},{"id":"INC-09791","date":"2026-04","year":2026,"title":"Grafana Loki Path Traversal - CVE-2021-36156 Bypass","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21726"],"affected":"go/github.com/grafana/loki/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21726"},{"id":"INC-08846","date":"2026-04","year":2026,"title":"Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40479","CVE-2026-40486"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40486"},{"id":"INC-08847","date":"2026-04","year":2026,"title":"NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40346"],"affected":"npm/@nocobase/plugin-workflow-request","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40346"},{"id":"INC-08848","date":"2026-04","year":2026,"title":"OpenRemote has XXE in Velbus Asset Import","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40882"],"affected":"maven/io.openremote:openremote-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40882"},{"id":"INC-08849","date":"2026-04","year":2026,"title":"Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41146"],"affected":"rubygems/iodine","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41146"},{"id":"INC-08850","date":"2026-04","year":2026,"title":"pyLoad's Session Not Invalidated After Permission Changes","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fj52-5g4h-gmq8"},{"id":"INC-08851","date":"2026-04","year":2026,"title":"DotNetNuke.Core security code analysis rules triggered","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/DotNetNuke.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fcpv-w245-r2q7"},{"id":"INC-08852","date":"2026-04","year":2026,"title":"Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26171"],"affected":"nuget/System.Security.Cryptography.Xml, nuget/System.Security.Cryptography.Xml, nuget/System.Security.Cryptography.Xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26171"},{"id":"INC-08853","date":"2026-04","year":2026,"title":"Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33116"],"affected":"nuget/System.Security.Cryptography.Xml, nuget/System.Security.Cryptography.Xml, nuget/System.Security.Cryptography.Xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33116"},{"id":"INC-08854","date":"2026-04","year":2026,"title":"Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32178"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32178"},{"id":"INC-08855","date":"2026-04","year":2026,"title":"WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33500","CVE-2026-41063"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41063"},{"id":"INC-08856","date":"2026-04","year":2026,"title":"Novu has a XSS sanitization bypass","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/novu/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-26wg-9xf2-q495"},{"id":"INC-08857","date":"2026-04","year":2026,"title":"WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-41061"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41061"},{"id":"INC-08858","date":"2026-04","year":2026,"title":"WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-41057"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41057"},{"id":"INC-08859","date":"2026-04","year":2026,"title":"WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-41056"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41056"},{"id":"INC-08860","date":"2026-04","year":2026,"title":"Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40319","CVE-2026-40320"],"affected":"pip/giskard-checks","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40320"},{"id":"INC-08861","date":"2026-04","year":2026,"title":"CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40935"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40935"},{"id":"INC-08862","date":"2026-04","year":2026,"title":"WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40929"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40929"},{"id":"INC-08863","date":"2026-04","year":2026,"title":"WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40928"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40928"},{"id":"INC-08864","date":"2026-04","year":2026,"title":"WWBN AVideo has Multiple CSRF Vulnerabilities in Admin JSON Endpoints (Category CRUD, Plugin Update Script)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40926"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40926"},{"id":"INC-08865","date":"2026-04","year":2026,"title":"WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40925"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40925"},{"id":"INC-08866","date":"2026-04","year":2026,"title":"SiYuan has incomplete fix for CVE-2026-33066: XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33066","CVE-2026-40922"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40922"},{"id":"INC-08867","date":"2026-04","year":2026,"title":"WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40909"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40909"},{"id":"INC-08868","date":"2026-04","year":2026,"title":"Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40090"],"affected":"go/github.com/zarf-dev/zarf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40090"},{"id":"INC-08869","date":"2026-04","year":2026,"title":"Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39971"],"affected":"composer/s9y/serendipity","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39971"},{"id":"INC-08870","date":"2026-04","year":2026,"title":"Expression Injection in OpenRemote","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-39842"],"affected":"maven/io.openremote:openremote-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39842"},{"id":"INC-08871","date":"2026-04","year":2026,"title":"OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34457"],"affected":"go/github.com/oauth2-proxy/oauth2-proxy, go/github.com/oauth2-proxy/oauth2-proxy/v7","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34457"},{"id":"INC-08872","date":"2026-04","year":2026,"title":"goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40883"],"affected":"go/github.com/patrickhener/goshs/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40883"},{"id":"INC-08873","date":"2026-04","year":2026,"title":"goshs has an empty-username SFTP password authentication bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40884"],"affected":"go/github.com/patrickhener/goshs/v2, go/github.com/patrickhener/goshs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40884"},{"id":"INC-08874","date":"2026-04","year":2026,"title":"SFTP root escape via prefix-based path validation in goshs","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40876"],"affected":"go/github.com/patrickhener/goshs/v2, go/github.com/patrickhener/goshs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40876"},{"id":"INC-08875","date":"2026-04","year":2026,"title":"Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/kyverno/kyverno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fmqp-4wfc-w3v7"},{"id":"INC-08876","date":"2026-04","year":2026,"title":"Multiple security fixes in justhtml","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4p64-v8f5-r2gx"},{"id":"INC-08877","date":"2026-04","year":2026,"title":"October CMS has Stored XSS in Event Log Mail Preview","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24907"],"affected":"composer/october/system, composer/october/system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24907"},{"id":"INC-08878","date":"2026-04","year":2026,"title":"free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40248"],"affected":"go/github.com/free5gc/udr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40248"},{"id":"INC-08879","date":"2026-04","year":2026,"title":"Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-38530","CVE-2026-38532"],"affected":"composer/krayin/laravel-crm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-38530"},{"id":"INC-08880","date":"2026-04","year":2026,"title":"Kimai leaks API Token Hash via Invoice Twig Template","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rh42-6rj2-xwmc"},{"id":"INC-08881","date":"2026-04","year":2026,"title":"SP1 V6 Recursion Circuit Row-Count Binding Gap","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40323"],"affected":"rust/sp1_prover, rust/sp1_recursion_circuit, rust/sp1_sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40323"},{"id":"INC-08882","date":"2026-04","year":2026,"title":"SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"npm/@aiondadotcom/mcp-ssh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p4h8-56qp-hpgv"},{"id":"INC-08883","date":"2026-04","year":2026,"title":"Note Mark has Stored XSS via Unrestricted Asset Upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40262"],"affected":"go/github.com/enchant97/note-mark/backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40262"},{"id":"INC-08884","date":"2026-04","year":2026,"title":"Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35582"],"affected":"maven/gov.nsa.emissary:emissary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35582"},{"id":"INC-08885","date":"2026-04","year":2026,"title":"Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34476"],"affected":"go/github.com/apache/skywalking-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34476"},{"id":"INC-08886","date":"2026-04","year":2026,"title":"Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35565"],"affected":"maven/org.apache.storm:storm-webapp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35565"},{"id":"INC-08887","date":"2026-04","year":2026,"title":"Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-4810"],"affected":"pip/google-adk, pip/google-adk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4810"},{"id":"INC-08889","date":"2026-04","year":2026,"title":"unhead: Streaming SSR `streamKey` injected into inline script without identifier validation","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/unhead","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x7mm-9vvv-64w8"},{"id":"INC-08890","date":"2026-04","year":2026,"title":"Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5774"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5774"},{"id":"INC-08891","date":"2026-04","year":2026,"title":"n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/n8n-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-75hx-xj24-mqrw"},{"id":"INC-08892","date":"2026-04","year":2026,"title":"LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40190"],"affected":"npm/langsmith","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40190"},{"id":"INC-08893","date":"2026-04","year":2026,"title":"Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/lin-snow/ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-69hx-63pv-f8f4"},{"id":"INC-08894","date":"2026-04","year":2026,"title":"REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/redaxo/source","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xq4j-g85q-wf97"},{"id":"INC-08895","date":"2026-04","year":2026,"title":"uv vulnerable to arbitrary file deletion through RECORD entries","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/uv","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pjjw-68hj-v9mw"},{"id":"INC-08896","date":"2026-04","year":2026,"title":"PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-40315"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40315"},{"id":"INC-08897","date":"2026-04","year":2026,"title":"Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40163"],"affected":"npm/@saltcorn/server, npm/@saltcorn/server, npm/@saltcorn/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40163"},{"id":"INC-08898","date":"2026-04","year":2026,"title":"PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-40152"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40152"},{"id":"INC-08899","date":"2026-04","year":2026,"title":"PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-40153"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40153"},{"id":"INC-08900","date":"2026-04","year":2026,"title":"PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-40151"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40151"},{"id":"INC-08901","date":"2026-04","year":2026,"title":"SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40107"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40107"},{"id":"INC-08902","date":"2026-04","year":2026,"title":"LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34177"],"affected":"go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34177"},{"id":"INC-08903","date":"2026-04","year":2026,"title":"LXD: Importing a crafted backup leads to project restriction bypass","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34178"],"affected":"go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34178"},{"id":"INC-08904","date":"2026-04","year":2026,"title":"justhtml includes multiple security fixes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c9vm-hv86-f23r"},{"id":"INC-08905","date":"2026-04","year":2026,"title":"Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34479","CVE-2026-34480","CVE-2026-40021"],"affected":"nuget/log4net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40021"},{"id":"INC-08906","date":"2026-04","year":2026,"title":"Beszel has an IDOR in hub API endpoints that read system ID from URL parameter","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-40077"],"affected":"go/github.com/henrygd/beszel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40077"},{"id":"INC-08907","date":"2026-04","year":2026,"title":"Vikunja has HTML Injection via Task Titles in Overdue Email Notifications","severity":"High","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34727","CVE-2026-35600"],"affected":"go/code.vikunja.io/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35600"},{"id":"INC-08908","date":"2026-04","year":2026,"title":"parisneo/lollms vulnerable to stored XSS in the social feature","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-1115"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1115"},{"id":"INC-08912","date":"2026-04","year":2026,"title":"Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-39315"],"affected":"npm/unhead","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39315"},{"id":"INC-08913","date":"2026-04","year":2026,"title":"Wasmtime has out-of-bounds write or crash when transcoding component model strings","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35195"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35195"},{"id":"INC-08914","date":"2026-04","year":2026,"title":"Wasmtime has data leakage between pooling allocator instances","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-34988"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34988"},{"id":"INC-08915","date":"2026-04","year":2026,"title":"Wasmtime has use-after-free bug after cloning `wasmtime::Linker`","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-34983"],"affected":"rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34983"},{"id":"INC-08916","date":"2026-04","year":2026,"title":"Wasmtime has host panic when Winch compiler executes `table.fill`","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34946"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34946"},{"id":"INC-14100","date":"2026-04","year":2026,"title":"OpenClaw Host-Exec Environment Variable Injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22177"],"affected":"npm/openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w9j9-w4cp-6wgr"},{"id":"INC-08917","date":"2026-04","year":2026,"title":"OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jf56-mccx-5f3f"},{"id":"INC-08918","date":"2026-04","year":2026,"title":"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gfmx-pph7-g46x"},{"id":"INC-08919","date":"2026-04","year":2026,"title":"awwaiid mcp-server-taskwarrior vulnerable to command injection","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5833"],"affected":"npm/mcp-server-taskwarrior","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5833"},{"id":"INC-08920","date":"2026-04","year":2026,"title":"api-lab-mcp vulnerable to SSRF","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5832"],"affected":"npm/api-lab-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5832"},{"id":"INC-08921","date":"2026-04","year":2026,"title":"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5831"],"affected":"npm/taskflow-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5831"},{"id":"INC-08922","date":"2026-04","year":2026,"title":"OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40293"],"affected":"go/github.com/openfga/openfga","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40293"},{"id":"INC-08924","date":"2026-04","year":2026,"title":"CI4MS Vulnerable to .env CRLF Injection via Unvalidated `host` Parameter in Install Controller","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-39390","CVE-2026-39391","CVE-2026-39392","CVE-2026-39394"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39394"},{"id":"INC-08925","date":"2026-04","year":2026,"title":"quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40180"],"affected":"maven/io.quarkiverse.openapi.generator:quarkus-openapi-generator","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40180"},{"id":"INC-08926","date":"2026-04","year":2026,"title":"stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31040"],"affected":"pip/stata-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31040"},{"id":"INC-08927","date":"2026-04","year":2026,"title":"Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27806"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27806"},{"id":"INC-08928","date":"2026-04","year":2026,"title":"Axios HTTP/2 Session Cleanup State Corruption Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-39865"],"affected":"npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39865"},{"id":"INC-08929","date":"2026-04","year":2026,"title":"LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-39411"],"affected":"npm/@lobehub/lobehub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39411"},{"id":"INC-08930","date":"2026-04","year":2026,"title":"SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39846"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39846"},{"id":"INC-08931","date":"2026-04","year":2026,"title":"parisneo/lollms has an insufficient session expiration vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1163"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1163"},{"id":"INC-08932","date":"2026-04","year":2026,"title":"lightrag-hku: JWT Algorithm Confusion Vulnerability","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-39413"],"affected":"pip/lightrag-hku","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39413"},{"id":"INC-08933","date":"2026-04","year":2026,"title":"JWCrypto: JWE ZIP decompression bomb","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39373"],"affected":"pip/jwcrypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39373"},{"id":"INC-08935","date":"2026-04","year":2026,"title":"@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-39397"],"affected":"npm/@delmaredigital/payload-puck","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39397"},{"id":"INC-08936","date":"2026-04","year":2026,"title":"RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-39360"],"affected":"rust/rustfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39360"},{"id":"INC-08937","date":"2026-04","year":2026,"title":"FastFeedParser has an infinite redirect loop DoS via meta-refresh chain","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39376"],"affected":"pip/fastfeedparser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39376"},{"id":"INC-08938","date":"2026-04","year":2026,"title":"WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39367"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39367"},{"id":"INC-08939","date":"2026-04","year":2026,"title":"kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/cloudnativelabs/kube-router/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fcmh-qfxc-w685"},{"id":"INC-08940","date":"2026-04","year":2026,"title":"justhtml: Mutation XSS with custom foreign-namespace sanitization policies","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r758-8hxw-4845"},{"id":"INC-08941","date":"2026-04","year":2026,"title":"Emissary has Stored XSS via Navigation Template Link Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35571"],"affected":"maven/gov.nsa.emissary:emissary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35571"},{"id":"INC-08942","date":"2026-04","year":2026,"title":"Local settings bypass config trust checks","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35533"],"affected":"rust/mise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35533"},{"id":"INC-08945","date":"2026-04","year":2026,"title":"OpenClaw: QQ Bot structured payloads could read arbitrary local files","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-846p-hgpv-vphc"},{"id":"INC-08948","date":"2026-04","year":2026,"title":"Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34148"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34148"},{"id":"INC-08949","date":"2026-04","year":2026,"title":"OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33439"],"affected":"maven/org.openidentityplatform.openam:openam","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33439"},{"id":"INC-09471","date":"2026-04","year":2026,"title":"Django vulnerable to privilege abuse in GenericInlineModelAdmin","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53907","CVE-2025-32873","CVE-2025-64460","CVE-2026-1285","CVE-2026-4277"],"affected":"pip/Django, pip/Django, pip/Django","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4277"},{"id":"INC-08950","date":"2026-04","year":2026,"title":"PraisonAI Has Path Traversal in FileTools","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35615","CVE-2026-39305","CVE-2026-39306","CVE-2026-39307","CVE-2026-39308"],"affected":"pip/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35615"},{"id":"INC-08951","date":"2026-04","year":2026,"title":"Feehi CMS has an authenticated stored cross-site scripting (XSS) vulnerability via the creation/editing module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31313","CVE-2026-31350","CVE-2026-31351","CVE-2026-31352","CVE-2026-31353","CVE-2026-31354"],"affected":"composer/feehi/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31313"},{"id":"INC-08952","date":"2026-04","year":2026,"title":"@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35515"],"affected":"npm/@nestjs/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35515"},{"id":"INC-08953","date":"2026-04","year":2026,"title":"@nor2/heim-mcp vulnerable to command injection","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5602"],"affected":"npm/@nor2/heim-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5602"},{"id":"INC-08954","date":"2026-04","year":2026,"title":"@elgentos/magento2-dev-mcp vulnerable to command injection","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5603"],"affected":"npm/@elgentos/magento2-dev-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5603"},{"id":"INC-08955","date":"2026-04","year":2026,"title":"Nodcms contains a cross-site request forgery vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-20054"],"affected":"composer/khodakhah/nodcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-20054"},{"id":"INC-09792","date":"2026-04","year":2026,"title":"web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-40072"],"affected":"pip/web3, pip/web3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40072"},{"id":"INC-08956","date":"2026-04","year":2026,"title":"libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35405"],"affected":"rust/libp2p-rendezvous","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35405"},{"id":"INC-08957","date":"2026-04","year":2026,"title":"AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-35449"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35449"},{"id":"INC-08958","date":"2026-04","year":2026,"title":"LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-30762"],"affected":"pip/lightrag-hku","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30762"},{"id":"INC-08959","date":"2026-04","year":2026,"title":"Directus: Sensitive fields exposed in revision history","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-39943"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39943"},{"id":"INC-08960","date":"2026-04","year":2026,"title":"Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35410"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35410"},{"id":"INC-08961","date":"2026-04","year":2026,"title":"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-31818","CVE-2026-35216"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35216"},{"id":"INC-08962","date":"2026-04","year":2026,"title":"AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35181"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35181"},{"id":"INC-08963","date":"2026-04","year":2026,"title":"Hugo: Certain markdown links are not properly escaped","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35166"],"affected":"go/github.com/gohugoio/hugo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35166"},{"id":"INC-08964","date":"2026-04","year":2026,"title":"AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-35179"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35179"},{"id":"INC-08965","date":"2026-04","year":2026,"title":"Budibase: Command Injection in Bash Automation Step","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25044"],"affected":"npm/@budibase/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25044"},{"id":"INC-08966","date":"2026-04","year":2026,"title":"Electron: Use-after-free in offscreen shared texture release() callback","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34764"],"affected":"npm/electron, npm/electron, npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34764"},{"id":"INC-08967","date":"2026-04","year":2026,"title":"SandboxJS: Sandbox Escape via Prop Object Leak in New Handler","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34217"],"affected":"npm/@nyariv/sandboxjs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34217"},{"id":"INC-08968","date":"2026-04","year":2026,"title":"Signal K Server: Unauthenticated Source Priorities Manipulation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33951"],"affected":"npm/signalk-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33951"},{"id":"INC-08969","date":"2026-04","year":2026,"title":"Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33950"],"affected":"npm/signalk-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33950"},{"id":"INC-08970","date":"2026-04","year":2026,"title":"Juju has a resource poisoning vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-68153"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68153"},{"id":"INC-08971","date":"2026-04","year":2026,"title":"Juju: Read All Controller Logs From Compromised Workload","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-0928","CVE-2025-68152"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68152"},{"id":"INC-08972","date":"2026-04","year":2026,"title":"Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5468"],"affected":"go/github.com/casdoor/casdoor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5468"},{"id":"INC-08973","date":"2026-04","year":2026,"title":"Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35539","CVE-2026-35544"],"affected":"composer/roundcube/roundcubemail","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35539"},{"id":"INC-08974","date":"2026-04","year":2026,"title":"Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35540"],"affected":"composer/roundcube/roundcubemail","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35540"},{"id":"INC-08975","date":"2026-04","year":2026,"title":"Signal K Server: Arbitrary Prototype Read via `from` Field Bypass","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35038"],"affected":"npm/signalk-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35038"},{"id":"INC-08976","date":"2026-04","year":2026,"title":"CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34989"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34989"},{"id":"INC-08977","date":"2026-04","year":2026,"title":"Kedro has Arbitrary Code Execution via Malicious Logging Configuration","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35171"],"affected":"pip/kedro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35171"},{"id":"INC-08978","date":"2026-04","year":2026,"title":"OpenSTAManager: SQL Injection via Aggiornamenti Module","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28805","CVE-2026-29782","CVE-2026-35168"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35168"},{"id":"INC-08979","date":"2026-04","year":2026,"title":"Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-35037"],"affected":"go/github.com/lin-snow/ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35037"},{"id":"INC-08980","date":"2026-04","year":2026,"title":"Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35036"],"affected":"go/github.com/lin-snow/ech0","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35036"},{"id":"INC-14101","date":"2026-04","year":2026,"title":"OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32846"],"affected":"npm/openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f6pf-4gjx-c94r"},{"id":"INC-08981","date":"2026-04","year":2026,"title":"Electron: AppleScript injection in app.moveToApplicationsFolder on macOS","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34779"],"affected":"npm/electron, npm/electron, npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34779"},{"id":"INC-08982","date":"2026-04","year":2026,"title":"Electron: HTTP Response Header Injection in custom protocol handlers and webRequest","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34767"],"affected":"npm/electron, npm/electron, npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34767"},{"id":"INC-08983","date":"2026-04","year":2026,"title":"fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-48223","CVE-2026-34950"],"affected":"npm/fast-jwt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34950"},{"id":"INC-08984","date":"2026-04","year":2026,"title":"Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34763"],"affected":"rubygems/rack, rubygems/rack, rubygems/rack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34763"},{"id":"INC-08985","date":"2026-04","year":2026,"title":"Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34827"],"affected":"rubygems/rack, rubygems/rack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34827"},{"id":"INC-08986","date":"2026-04","year":2026,"title":"fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67364","CVE-2026-5327"],"affected":"npm/fast-filesystem-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5327"},{"id":"INC-08987","date":"2026-04","year":2026,"title":"Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4370"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4370"},{"id":"INC-00617","date":"2026-04","year":2026,"title":"mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')","severity":"High","attack_vector":"dos","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-0621","CVE-2026-25536"],"affected":"npm/mcp-handler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w2fm-25vw-vh7f"},{"id":"INC-08988","date":"2026-04","year":2026,"title":"NocoBase Has SQL Injection via template variable substitution in workflow SQL node","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34825"],"affected":"npm/@nocobase/plugin-workflow-sql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34825"},{"id":"INC-08989","date":"2026-04","year":2026,"title":"phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding Leads to Stored XSS and Privilege Escalation","severity":"High","attack_vector":"xss","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32629","CVE-2026-34728","CVE-2026-34729","CVE-2026-34973","CVE-2026-34974"],"affected":"composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34974"},{"id":"INC-08990","date":"2026-04","year":2026,"title":"PraisonAI Has Missing Authentication in WebSocket Gateway","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34952"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34952"},{"id":"INC-08991","date":"2026-04","year":2026,"title":"PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-34954"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34954"},{"id":"INC-08992","date":"2026-04","year":2026,"title":"PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-34955"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34955"},{"id":"INC-08993","date":"2026-04","year":2026,"title":"AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gmpc-fxg2-vcmq"},{"id":"INC-08995","date":"2026-04","year":2026,"title":"PraisonAI Has ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34939"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34939"},{"id":"INC-08996","date":"2026-04","year":2026,"title":"PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34934"],"affected":"pip/praisonai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34934"},{"id":"INC-08997","date":"2026-04","year":2026,"title":"PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-34937"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34937"},{"id":"INC-08998","date":"2026-04","year":2026,"title":"PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-34938"],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34938"},{"id":"INC-08999","date":"2026-04","year":2026,"title":"Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34762"],"affected":"go/github.com/ellanetworks/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34762"},{"id":"INC-09000","date":"2026-04","year":2026,"title":"Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34730"],"affected":"pip/copier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34730"},{"id":"INC-09001","date":"2026-04","year":2026,"title":"dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34725"],"affected":"npm/dbgate-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34725"},{"id":"INC-09003","date":"2026-04","year":2026,"title":"Payload has an SQL Injection via Query Handling","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34747"],"affected":"npm/payload","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34747"},{"id":"INC-09004","date":"2026-04","year":2026,"title":"AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34739"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34739"},{"id":"INC-09005","date":"2026-04","year":2026,"title":"AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34732"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34732"},{"id":"INC-09006","date":"2026-04","year":2026,"title":"NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/netbirdio/netbird","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rxmp-8h9v-56cx"},{"id":"INC-09007","date":"2026-04","year":2026,"title":"AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34716"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34716"},{"id":"INC-09008","date":"2026-04","year":2026,"title":"AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34613"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34613"},{"id":"INC-09009","date":"2026-04","year":2026,"title":"AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34611"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34611"},{"id":"INC-09010","date":"2026-04","year":2026,"title":"SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34448","CVE-2026-34585","CVE-2026-34605"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34605"},{"id":"INC-09011","date":"2026-04","year":2026,"title":"xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34601"],"affected":"npm/@xmldom/xmldom, npm/@xmldom/xmldom, npm/xmldom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34601"},{"id":"INC-09012","date":"2026-04","year":2026,"title":"CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34557"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34557"},{"id":"INC-09013","date":"2026-04","year":2026,"title":"CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34558"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34558"},{"id":"INC-09014","date":"2026-04","year":2026,"title":"TorchGeo Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49048"],"affected":"pip/torchgeo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49048"},{"id":"INC-09801","date":"2026-04","year":2026,"title":"Malware in claudcode-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/claudcode-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5v3x-g9r5-vvhg"},{"id":"INC-09806","date":"2026-04","year":2026,"title":"Malware in mcp-server-todo","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-server-todo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hppm-xxp9-54h7"},{"id":"INC-00895","date":"2026-03","year":2026,"title":"Dify — Xss (CVE-2026-21866)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21866"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21866"},{"id":"INC-01289","date":"2026-03","year":2026,"title":"LangBot — Xss (CVE-2026-28509)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28509"],"affected":"langbot/langbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28509"},{"id":"INC-02091","date":"2026-03","year":2026,"title":"WeKnora — Ssrf (CVE-2026-30247)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30247"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30247"},{"id":"INC-02083","date":"2026-03","year":2026,"title":"WeKnora — Auth Bypass (CVE-2026-30855)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30855"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30855"},{"id":"INC-02089","date":"2026-03","year":2026,"title":"WeKnora — Prompt Injection (CVE-2026-30856)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-30856"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30856"},{"id":"INC-02084","date":"2026-03","year":2026,"title":"WeKnora — Auth Bypass (CVE-2026-30857)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30857"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30857"},{"id":"INC-02087","date":"2026-03","year":2026,"title":"WeKnora — Data Exfiltration (CVE-2026-30858)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30858"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30858"},{"id":"INC-02085","date":"2026-03","year":2026,"title":"WeKnora — Auth Bypass (CVE-2026-30859)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-30859"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30859"},{"id":"INC-02090","date":"2026-03","year":2026,"title":"WeKnora — Sql Injection (CVE-2026-30860)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30860"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30860"},{"id":"INC-02086","date":"2026-03","year":2026,"title":"WeKnora — Command Injection (CVE-2026-30861)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30861"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30861"},{"id":"INC-01377","date":"2026-03","year":2026,"title":"MCP Atlassian — Vulnerability (CVE-2026-27826)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27826"],"affected":"sooperset/mcp_atlassian","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27826"},{"id":"INC-01347","date":"2026-03","year":2026,"title":"llama.cpp — Vulnerability (CVE-2026-27940)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27940"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27940"},{"id":"INC-01172","date":"2026-03","year":2026,"title":"Hyperterse — Vulnerability (CVE-2026-31841)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31841"],"affected":"hyperterse/hyperterse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31841"},{"id":"INC-01139","date":"2026-03","year":2026,"title":"Graphiti — Prompt Injection (CVE-2026-32247)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-32247"],"affected":"getzep/graphiti","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32247"},{"id":"INC-00630","date":"2026-03","year":2026,"title":"AnythingLLM — Sql Injection (CVE-2026-32628)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32628"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32628"},{"id":"INC-00632","date":"2026-03","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-32715)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32715"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32715"},{"id":"INC-00633","date":"2026-03","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-32717)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32717"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32717"},{"id":"INC-01804","date":"2026-03","year":2026,"title":"SQLBot — Prompt Injection (CVE-2026-32622)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-32622"],"affected":"fit2cloud/sqlbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32622"},{"id":"INC-00899","date":"2026-03","year":2026,"title":"Discourse — Vulnerability (CVE-2026-32114)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32114"],"affected":"discourse/discourse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32114"},{"id":"INC-01346","date":"2026-03","year":2026,"title":"llama.cpp — Rce (CVE-2026-33298)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33298"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33298"},{"id":"INC-01515","date":"2026-03","year":2026,"title":"nanobot — Prompt Injection (CVE-2026-33654)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-33654"],"affected":"nanobot/nanobot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33654"},{"id":"INC-01306","date":"2026-03","year":2026,"title":"Langflow — Vulnerability (CVE-2026-33873)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33873"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33873"},{"id":"INC-01683","date":"2026-03","year":2026,"title":"PromtEngineer localGPT — Vulnerability (CVE-2026-5002)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5002"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5002"},{"id":"INC-00008","date":"2026-03","year":2026,"title":"A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19).","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-29872"],"affected":"theunwindai/awesome_llm_apps","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29872"},{"id":"INC-01680","date":"2026-03","year":2026,"title":"Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions using Boolean prompt injection techniques (formulating a ...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-4399"],"affected":"1millionbot/millie_chatbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4399"},{"id":"INC-01587","date":"2026-03","year":2026,"title":"OpenChatBI — Path Traversal (CVE-2026-28795)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28795"],"affected":"zhongyu09/openchatbi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28795"},{"id":"INC-01648","date":"2026-03","year":2026,"title":"PingPong — Vulnerability (CVE-2026-32097)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32097"],"affected":"harvard/pingpong","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32097"},{"id":"INC-00898","date":"2026-03","year":2026,"title":"Discourse — Prompt Injection (CVE-2026-27740)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-27740"],"affected":"discourse/discourse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27740"},{"id":"INC-01806","date":"2026-03","year":2026,"title":"SQLBot — Ssrf (CVE-2026-32949)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32949","CVE-2026-32950"],"affected":"fit2cloud/sqlbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32949"},{"id":"INC-00673","date":"2026-03","year":2026,"title":"Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases t...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33980"],"affected":"pab1it0/azure_data_explorer_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33980"},{"id":"INC-01912","date":"2026-03","year":2026,"title":"Trivy Vulnerability Scanner — Info Disclosure (CVE-2026-28353)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-28353"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28353"},{"id":"INC-00050","date":"2026-03","year":2026,"title":"Agentgateway — Vulnerability (CVE-2026-29791)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29791"],"affected":"lfprojects/agentgateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29791"},{"id":"INC-01645","date":"2026-03","year":2026,"title":"PinchTab — Ssrf (CVE-2026-30834)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30834"],"affected":"pinchtab/pinchtab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30834"},{"id":"INC-00996","date":"2026-03","year":2026,"title":"FastGPT — Vulnerability (CVE-2026-32128)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32128"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32128"},{"id":"INC-01303","date":"2026-03","year":2026,"title":"Langflow — Vulnerability (CVE-2026-33053)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33053"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33053"},{"id":"INC-00989","date":"2026-03","year":2026,"title":"FastGPT — Rce (CVE-2026-33075)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33075"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33075"},{"id":"INC-01646","date":"2026-03","year":2026,"title":"PinchTab — Ssrf (CVE-2026-33081)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33081"],"affected":"pinchtab/pinchtab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33081"},{"id":"INC-01301","date":"2026-03","year":2026,"title":"Langflow — Path Traversal (CVE-2026-33309)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33309"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33309"},{"id":"INC-01300","date":"2026-03","year":2026,"title":"Langflow — Command Injection (CVE-2026-33475)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33475"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33475"},{"id":"INC-01304","date":"2026-03","year":2026,"title":"Langflow — Vulnerability (CVE-2026-33484)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33484"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33484"},{"id":"INC-01305","date":"2026-03","year":2026,"title":"Langflow — Vulnerability (CVE-2026-33497)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33497"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33497"},{"id":"INC-01647","date":"2026-03","year":2026,"title":"PinchTab — Ssrf (CVE-2026-33619)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33619","CVE-2026-33620","CVE-2026-33621"],"affected":"pinchtab/pinchtab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33619"},{"id":"INC-01643","date":"2026-03","year":2026,"title":"PinchTab — Auth Bypass (CVE-2026-33622)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33622"],"affected":"pinchtab/pinchtab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33622"},{"id":"INC-01644","date":"2026-03","year":2026,"title":"PinchTab — Command Injection (CVE-2026-33623)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33623"],"affected":"pinchtab/pinchtab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33623"},{"id":"INC-01608","date":"2026-03","year":2026,"title":"OpenHands is software for AI-driven development.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33718"],"affected":"openhands/openhands","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33718"},{"id":"INC-00012","date":"2026-03","year":2026,"title":"A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent ba...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-29871"],"affected":"theunwindai/awesome_llm_apps","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29871"},{"id":"INC-01307","date":"2026-03","year":2026,"title":"Langflow — Vulnerability (CVE-2026-34046)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34046"],"affected":"langflow/langflow, langflow/langflow-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34046"},{"id":"INC-00823","date":"2026-03","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-33068)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33068"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33068"},{"id":"INC-00009","date":"2026-03","year":2026,"title":"A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29870"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29870"},{"id":"INC-01088","date":"2026-03","year":2026,"title":"Giskard — Rce (CVE-2026-34172)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34172"],"affected":"giskard/giskard-agent, giskard/giskard-agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34172"},{"id":"INC-00007","date":"2026-03","year":2026,"title":"A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through cra...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2256"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2256"},{"id":"INC-01896","date":"2026-03","year":2026,"title":"The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-29783"],"affected":"github/copilot_command_line_interface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29783"},{"id":"INC-00870","date":"2026-03","year":2026,"title":"Cursor — Prompt Injection (CVE-2026-31854)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-31854"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31854"},{"id":"INC-00804","date":"2026-03","year":2026,"title":"CKAN MCP Server — Prompt Injection (CVE-2026-33060)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-33060"],"affected":"ondata/ckan_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33060"},{"id":"INC-01192","date":"2026-03","year":2026,"title":"In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands.","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-30304"],"affected":"tianguaduizhang/ai_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30304"},{"id":"INC-14611","date":"2026-03","year":2026,"title":"In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands.","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-30306"],"affected":"rahmanazhar/sakadev","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30306"},{"id":"INC-01193","date":"2026-03","year":2026,"title":"In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands.","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-30308"],"affected":"presidio/hai_build","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30308"},{"id":"INC-01194","date":"2026-03","year":2026,"title":"In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands.","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-30310"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30310"},{"id":"INC-01386","date":"2026-03","year":2026,"title":"mcp-memory-service — Vulnerability (CVE-2026-29787)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-29787"],"affected":"doobidoo/mcp-memory-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29787"},{"id":"INC-01376","date":"2026-03","year":2026,"title":"MCP Atlassian — Rce (CVE-2026-27825)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27825"],"affected":"mcp-atlassian/mcp_atlassian","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27825"},{"id":"INC-01153","date":"2026-03","year":2026,"title":"ha-mcp — Vulnerability (CVE-2026-32111)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32111"],"affected":"homeassistant-ai/home_assistant_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32111"},{"id":"INC-01154","date":"2026-03","year":2026,"title":"ha-mcp — Vulnerability (CVE-2026-32112)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32112"],"affected":"homeassistant-ai/home_assistant_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32112"},{"id":"INC-01189","date":"2026-03","year":2026,"title":"Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4270"],"affected":"amazon/aws_api_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4270"},{"id":"INC-01387","date":"2026-03","year":2026,"title":"mcp-memory-service — Vulnerability (CVE-2026-33010)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33010"],"affected":"doobidoo/mcp-memory-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33010"},{"id":"INC-00696","date":"2026-03","year":2026,"title":"Blinko — Rce (CVE-2026-23882)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23882"],"affected":"blinko/blinko","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23882"},{"id":"INC-01333","date":"2026-03","year":2026,"title":"LibreChat — Ssrf (CVE-2026-31945)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31945"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31945"},{"id":"INC-01382","date":"2026-03","year":2026,"title":"MCP Ruby SDK — Vulnerability (CVE-2026-33946)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33946"],"affected":"lfprojects/mcp_ruby_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33946"},{"id":"INC-01460","date":"2026-03","year":2026,"title":"Mobile Next — Path Traversal (CVE-2026-33989)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33989"],"affected":"mobilenexthq/mobile_mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33989"},{"id":"INC-01529","date":"2026-03","year":2026,"title":"Nginx UI — Vulnerability (CVE-2026-33032)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33032"],"affected":"nginxui/nginx_ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33032"},{"id":"INC-01530","date":"2026-03","year":2026,"title":"Nhost — Vulnerability (CVE-2026-34200)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34200"],"affected":"nhost/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34200"},{"id":"INC-01379","date":"2026-03","year":2026,"title":"MCP Java SDK — Vulnerability (CVE-2026-34237)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34237"],"affected":"lfprojects/mcp_java_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34237"},{"id":"INC-01724","date":"2026-03","year":2026,"title":"Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-69236","CVE-2025-69237","CVE-2025-69241"],"affected":"raytha/raytha","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69236"},{"id":"INC-02062","date":"2026-03","year":2026,"title":"Wallos — Ssrf (CVE-2026-33401)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33401"],"affected":"wallosapp/wallos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33401"},{"id":"INC-02082","date":"2026-03","year":2026,"title":"Wekan — Vulnerability (CVE-2026-30847)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-30847"],"affected":"wekan_project/wekan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30847"},{"id":"INC-00835","date":"2026-03","year":2026,"title":"Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31861","CVE-2026-31862","CVE-2026-31975"],"affected":"cloudcli/cloud_cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31861"},{"id":"INC-02107","date":"2026-03","year":2026,"title":"yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31988"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31988"},{"id":"INC-01218","date":"2026-03","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free space and inode btree repair functions...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23249"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23249"},{"id":"INC-01282","date":"2026-03","year":2026,"title":"Keystone — Auth Bypass (CVE-2026-33326)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33326"],"affected":"keystonejs/keystone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33326"},{"id":"INC-01481","date":"2026-03","year":2026,"title":"n8n — Info Disclosure (CVE-2026-27496)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-56265","CVE-2025-58177","CVE-2026-27493","CVE-2026-27494","CVE-2026-27495","CVE-2026-27496","CVE-2026-27497"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27496"},{"id":"INC-01486","date":"2026-03","year":2026,"title":"n8n — Rce (CVE-2026-33660)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33660"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33660"},{"id":"INC-01496","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33663)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33663"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33663"},{"id":"INC-01497","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33665)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33665"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33665"},{"id":"INC-01487","date":"2026-03","year":2026,"title":"n8n — Rce (CVE-2026-33696)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33696"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33696"},{"id":"INC-01491","date":"2026-03","year":2026,"title":"n8n — Sql Injection (CVE-2026-33713)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33713"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33713"},{"id":"INC-01498","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33720)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33720"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33720"},{"id":"INC-01499","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33722)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33722"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33722"},{"id":"INC-01500","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33724)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33724"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33724"},{"id":"INC-01477","date":"2026-03","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-33749)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33749"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33749"},{"id":"INC-01501","date":"2026-03","year":2026,"title":"n8n — Vulnerability (CVE-2026-33751)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33751"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33751"},{"id":"INC-01091","date":"2026-03","year":2026,"title":"Glances — Vulnerability (CVE-2026-32632)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32609","CVE-2026-32610","CVE-2026-32611","CVE-2026-32632","CVE-2026-32633"],"affected":"nicolargo/glances","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32632"},{"id":"INC-01565","date":"2026-03","year":2026,"title":"Open WebUI — Info Disclosure (CVE-2026-28786)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-28786"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28786"},{"id":"INC-01563","date":"2026-03","year":2026,"title":"Open WebUI — Auth Bypass (CVE-2026-29070)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-29070"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29070"},{"id":"INC-01568","date":"2026-03","year":2026,"title":"Open WebUI — Vulnerability (CVE-2026-29071)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29071"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29071"},{"id":"INC-01889","date":"2026-03","year":2026,"title":"The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 12.8.3 via the auto...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-2589"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2589"},{"id":"INC-01152","date":"2026-03","year":2026,"title":"GROWI OpenAI thread/message API endpoints do not perform authorization.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25083"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25083"},{"id":"INC-01521","date":"2026-03","year":2026,"title":"New API — Auth Bypass (CVE-2026-30886)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-30886"],"affected":"newapi/new_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30886"},{"id":"INC-01976","date":"2026-03","year":2026,"title":"Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order h...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22561"],"affected":"anthropic/claude, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22561"},{"id":"INC-01886","date":"2026-03","year":2026,"title":"The Claude SDK for Python provides access to the Claude API from Python applications.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34450","CVE-2026-34452"],"affected":"anthropic/claude_sdk_for_python","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34450"},{"id":"INC-01216","date":"2026-03","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, even...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23309"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23309"},{"id":"INC-00831","date":"2026-03","year":2026,"title":"claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15060"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15060"},{"id":"INC-01883","date":"2026-03","year":2026,"title":"The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on t...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-13378","CVE-2025-13381","CVE-2026-1336"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1336"},{"id":"INC-01334","date":"2026-03","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-31944)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31944"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31944"},{"id":"INC-01330","date":"2026-03","year":2026,"title":"LibreChat — Dos (CVE-2026-31949)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31949"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31949"},{"id":"INC-01332","date":"2026-03","year":2026,"title":"LibreChat — Ssrf (CVE-2026-31943)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31943"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31943"},{"id":"INC-01335","date":"2026-03","year":2026,"title":"LibreChat — Vulnerability (CVE-2026-31950)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31950"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31950"},{"id":"INC-09262","date":"2026-03","year":2026,"title":"LangGraph SQLite Checkpoint — Deserialization (CVE-2026-28277)","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28277"],"affected":"langchain/langgraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28277"},{"id":"INC-09807","date":"2026-03","year":2026,"title":"LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4276"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4276"},{"id":"INC-09808","date":"2026-03","year":2026,"title":"LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-41258","CVE-2026-33265"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-41258"},{"id":"INC-09412","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to ...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28391","CVE-2026-28446","CVE-2026-28467","CVE-2026-28470","CVE-2026-28471","CVE-2026-28472"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28391"},{"id":"INC-01605","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion...","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27001","CVE-2026-27002","CVE-2026-27007","CVE-2026-27008","CVE-2026-27009","CVE-2026-28394","CVE-2026-28479"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28394"},{"id":"INC-01602","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26317","CVE-2026-26319","CVE-2026-26320","CVE-2026-26321","CVE-2026-26322","CVE-2026-26323","CVE-2026-26324","CVE-2026-26325","CVE-2026-26326","CVE-2026-26327","CVE-2026-26328","CVE-2026-26329","CVE-2026-27486","CVE-2026-27487","CVE-2026-28392","CVE-2026-28393","CVE-2026-28451","CVE-2026-28452","CVE-2026-28453","CVE-2026-28456","CVE-2026-28463","CVE-2026-28469","CVE-2026-28476","CVE-2026-28477","CVE-2026-28480","CVE-2026-28486","CVE-2026-29606","CVE-2026-29610","CVE-2026-29611","CVE-2026-29612","CVE-2026-32060","CVE-2026-35629","CVE-2026-35667"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28453"},{"id":"INC-14102","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitiz...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28457"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28457"},{"id":"INC-01604","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.","severity":"High","attack_vector":"other","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25474","CVE-2026-26316","CVE-2026-26972","CVE-2026-28395","CVE-2026-28447","CVE-2026-28448","CVE-2026-28450","CVE-2026-28454","CVE-2026-28458","CVE-2026-28459","CVE-2026-28462","CVE-2026-28464","CVE-2026-28475","CVE-2026-28478","CVE-2026-28481","CVE-2026-28482","CVE-2026-29613"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28464"},{"id":"INC-01588","date":"2026-03","year":2026,"title":"OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verificatio...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24764","CVE-2026-28465","CVE-2026-28474"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28465"},{"id":"INC-14103","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authentica...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28466"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28466"},{"id":"INC-09408","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authent...","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28468"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28468"},{"id":"INC-14104","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending t...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28473"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28473"},{"id":"INC-14105","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invok...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28485"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28485"},{"id":"INC-14106","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29609"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29609"},{"id":"INC-09119","date":"2026-03","year":2026,"title":"OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to b...","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28363","CVE-2026-32059","CVE-2026-32898"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32059"},{"id":"INC-09313","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the config dir...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32061"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32061"},{"id":"INC-14107","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32062"],"affected":"openclaw/openclaw, openclaw/openclaw\\/voice-call","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32062"},{"id":"INC-14108","date":"2026-03","year":2026,"title":"OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not v...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32063"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32063"},{"id":"INC-14109","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing argumen...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22168"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22168"},{"id":"INC-09296","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that allows attackers to invoke external helpers through the compres...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22169","CVE-2026-27566","CVE-2026-28460","CVE-2026-32010"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22169"},{"id":"INC-09282","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pair...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22170"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22170"},{"id":"INC-14110","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22171","CVE-2026-32030"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22171"},{"id":"INC-14111","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gatew...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22174"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22174"},{"id":"INC-14112","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through unrecognized multipl...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22175"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22175"},{"id":"INC-14113","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in the stripBotMention function, allowing regex injection and denia...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22178"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22178"},{"id":"INC-14114","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by ...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22179"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22179"},{"id":"INC-14115","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain a path-confinement bypass vulnerability in browser output handling that allows writes outside intended root directories.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22180"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22180"},{"id":"INC-09306","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy v...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22181"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22181"},{"id":"INC-14116","date":"2026-03","year":2026,"title":"OpenClaw version 2026.2.22 prior to 2026.2.23 contains an arbitrary code execution vulnerability in shell-env that allows attackers to execute attacker-controlled binaries by ex...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22217"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22217"},{"id":"INC-14117","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGroupIcon message actions when sandboxRoot is unset.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27522"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27522"},{"id":"INC-14118","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain a sandbox bind validation vulnerability allowing attackers to bypass allowed-root and blocked-path checks via symlinked parent direc...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27523"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27523"},{"id":"INC-14119","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 accept prototype-reserved keys in runtime /debug set override object values, allowing prototype pollution attacks.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27524"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27524"},{"id":"INC-09327","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute commands from unintended filesystem locati...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27545"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27545"},{"id":"INC-14120","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22176"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22176"},{"id":"INC-14121","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27670","CVE-2026-28483"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27670"},{"id":"INC-14122","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28449"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28449"},{"id":"INC-14123","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28461","CVE-2026-32066"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28461"},{"id":"INC-14124","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persist...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29607","CVE-2026-32021","CVE-2026-32039"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29607"},{"id":"INC-14125","date":"2026-03","year":2026,"title":"OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29608"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29608"},{"id":"INC-14126","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31989"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31989"},{"id":"INC-14127","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing w...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31990"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31990"},{"id":"INC-14128","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-stor...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31991","CVE-2026-32006","CVE-2026-32027","CVE-2026-32067"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31991"},{"id":"INC-09297","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31992"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31992"},{"id":"INC-14129","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval c...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31993"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31993"},{"id":"INC-14130","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31994"],"affected":"openclaw/openclaw, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31994"},{"id":"INC-14131","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to inj...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31995","CVE-2026-32000"],"affected":"openclaw/openclaw, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31995"},{"id":"INC-14132","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations thro...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31996"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31996"},{"id":"INC-09157","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31997"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31997"},{"id":"INC-09156","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUse...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31998"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31998"},{"id":"INC-14133","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that allows attack...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31999"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31999"},{"id":"INC-09291","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=node without...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32001"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32001"},{"id":"INC-09323","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run function that allows attackers to bypass command allowlist restric...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32003"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32003"},{"id":"INC-14134","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32004"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32004"},{"id":"INC-14135","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in shared wor...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32005"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32005"},{"id":"INC-09301","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outsid...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32007"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32007"},{"id":"INC-14136","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users wit...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32008"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32008"},{"id":"INC-14137","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32009"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32009"},{"id":"INC-14138","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32014"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32014"},{"id":"INC-14139","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling proc...","severity":"High","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32015"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32015"},{"id":"INC-14140","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute unauthori...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32016"],"affected":"openclaw/openclaw, apple/macos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32016"},{"id":"INC-09290","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32018"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32018"},{"id":"INC-14141","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSR...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32019"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32019"},{"id":"INC-14142","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads.","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32020"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32020"},{"id":"INC-14143","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files b...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32022"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32022"},{"id":"INC-09315","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-w...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32023"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32023"},{"id":"INC-09285","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace ...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32024"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32024"},{"id":"INC-14144","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttlin...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32025"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32025"},{"id":"INC-09812","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory ou...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32026"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32026"},{"id":"INC-14145","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32028","CVE-2026-32899"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32028"},{"id":"INC-14146","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to s...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32029"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32029"},{"id":"INC-14147","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path canonicalizat...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32031"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32031"},{"id":"INC-14148","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host enviro...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32032"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32032"},{"id":"INC-14149","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due to canonica...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32033"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32033"},{"id":"INC-14150","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed ove...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32034"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32034"},{"id":"INC-09303","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32035"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32035"},{"id":"INC-14151","date":"2026-03","year":2026,"title":"OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /ap...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32036"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32036"},{"id":"INC-14152","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32037","CVE-2026-32049"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32037"},{"id":"INC-09326","date":"2026-03","year":2026,"title":"OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network namespace.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32038"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32038"},{"id":"INC-09318","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.23 contain an html injection vulnerability in the HTML session exporter that allows attackers to execute arbitrary javascript by injecting mali...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32040"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32040"},{"id":"INC-14153","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authenti...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32041"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32041"},{"id":"INC-14154","date":"2026-03","year":2026,"title":"OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32042"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32042"},{"id":"INC-14155","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval ti...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32043"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32043"},{"id":"INC-09302","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32044"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32044"},{"id":"INC-14156","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32045"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32045"},{"id":"INC-14157","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerab...","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32046"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32046"},{"id":"INC-09120","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32048"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32048"},{"id":"INC-09293","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events b...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32050"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32050"},{"id":"INC-09331","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surface...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32051"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32051"},{"id":"INC-14158","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting posi...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32052"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32052"},{"id":"INC-14159","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32053"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32053"},{"id":"INC-09300","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the manag...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32054"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32054"},{"id":"INC-14160","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through i...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32055"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32055"},{"id":"INC-14161","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allow...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32056"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32056"},{"id":"INC-14162","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without p...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32057"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32057"},{"id":"INC-09329","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests ...","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32058"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32058"},{"id":"INC-09314","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC in...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32064"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32064"},{"id":"INC-14163","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming arg...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32065"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32065"},{"id":"INC-14164","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32895"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32895"},{"id":"INC-14165","date":"2026-03","year":2026,"title":"The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certai...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32896"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32896"},{"id":"INC-09118","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ow...","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32897"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32897"},{"id":"INC-09248","date":"2026-03","year":2026,"title":"OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper appr...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27183","CVE-2026-27646","CVE-2026-32913"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27183"},{"id":"INC-09028","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32302","CVE-2026-32915","CVE-2026-32916","CVE-2026-32918","CVE-2026-32919","CVE-2026-32922","CVE-2026-32923","CVE-2026-32970","CVE-2026-32971","CVE-2026-32972","CVE-2026-32973","CVE-2026-32976","CVE-2026-32977","CVE-2026-32978","CVE-2026-32979","CVE-2026-32988","CVE-2026-33573"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32922"},{"id":"INC-09202","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22172","CVE-2026-32914","CVE-2026-32920","CVE-2026-32924","CVE-2026-32974","CVE-2026-32975","CVE-2026-33575","CVE-2026-34505","CVE-2026-34508"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32975"},{"id":"INC-14166","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to e...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32980"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32980"},{"id":"INC-14167","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32987"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32987"},{"id":"INC-14168","date":"2026-03","year":2026,"title":"OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-33572"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33572"},{"id":"INC-14169","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during arch...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33574"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33574"},{"id":"INC-14170","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on config...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32917"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32917"},{"id":"INC-09029","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32921"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32921"},{"id":"INC-14171","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-32982"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32982"},{"id":"INC-14172","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34506"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34506"},{"id":"INC-14173","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33576"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33576"},{"id":"INC-14174","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with bro...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33577"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33577"},{"id":"INC-14175","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33578"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33578"},{"id":"INC-14176","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias par...","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33581"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33581"},{"id":"INC-14177","date":"2026-03","year":2026,"title":"OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34503"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34503"},{"id":"INC-09016","date":"2026-03","year":2026,"title":"File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34529","CVE-2026-34530"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34530"},{"id":"INC-09017","date":"2026-03","year":2026,"title":"openssl-encrypt has visible password in process list via --password CLI argument","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/openssl-encrypt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h3m5-p59h-x88p"},{"id":"INC-09018","date":"2026-03","year":2026,"title":"Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34405"],"affected":"npm/nuxt-og-image","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34405"},{"id":"INC-09019","date":"2026-03","year":2026,"title":"alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34400"],"affected":"pip/alerta-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34400"},{"id":"INC-09020","date":"2026-03","year":2026,"title":"AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34396"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34396"},{"id":"INC-09021","date":"2026-03","year":2026,"title":"AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34394"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34394"},{"id":"INC-09022","date":"2026-03","year":2026,"title":"Admidio has CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34383"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34383"},{"id":"INC-09023","date":"2026-03","year":2026,"title":"jose vulnerable to untrusted JWK header key acceptance during signature verification","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34240"],"affected":"pub/jose","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34240"},{"id":"INC-09024","date":"2026-03","year":2026,"title":"Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34227"],"affected":"go/github.com/bishopfox/sliver","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34227"},{"id":"INC-09025","date":"2026-03","year":2026,"title":"Nautobot: Management of users via REST API does not apply configured password validators","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34203"],"affected":"pip/nautobot, pip/nautobot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34203"},{"id":"INC-09026","date":"2026-03","year":2026,"title":"SciTokens is vulnerable to SQL Injection in KeyCache","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32714"],"affected":"pip/scitokens","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32714"},{"id":"INC-09027","date":"2026-03","year":2026,"title":"baserCMS Path Traversal Leads to Arbitrary File Write and RCE via Theme File API","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-21861","CVE-2026-27697","CVE-2026-30879","CVE-2026-30940"],"affected":"composer/baserproject/basercms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30940"},{"id":"INC-09031","date":"2026-03","year":2026,"title":"Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34388"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34388"},{"id":"INC-09032","date":"2026-03","year":2026,"title":"Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34386"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34386"},{"id":"INC-09033","date":"2026-03","year":2026,"title":"Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34385"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34385"},{"id":"INC-09034","date":"2026-03","year":2026,"title":"Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/telnyx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-955r-262c-33jc"},{"id":"INC-09040","date":"2026-03","year":2026,"title":"AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34375"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34375"},{"id":"INC-09041","date":"2026-03","year":2026,"title":"AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34369"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34369"},{"id":"INC-09042","date":"2026-03","year":2026,"title":"FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34360"],"affected":"maven/ca.uhn.hapi.fhir:org.hl7.fhir.core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34360"},{"id":"INC-09043","date":"2026-03","year":2026,"title":"Slippers Vulnerable to Cross-Site Scripting (XSS) in `attrs` Template Tag","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-34231"],"affected":"pip/slippers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34231"},{"id":"INC-09044","date":"2026-03","year":2026,"title":"HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34359"],"affected":"maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities, maven/ca.uhn.hapi.fhir:org.hl7.fhir.core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34359"},{"id":"INC-09045","date":"2026-03","year":2026,"title":"@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33949"],"affected":"npm/@tinacms/graphql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33949"},{"id":"INC-09046","date":"2026-03","year":2026,"title":"go-git missing validation decoding Index v4 files leads to panic","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33762"],"affected":"go/github.com/go-git/go-git/v5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33762"},{"id":"INC-09047","date":"2026-03","year":2026,"title":"Glances Vulnerable to Command Injection via Dynamic Configuration Values","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33533","CVE-2026-33641"],"affected":"pip/Glances","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33641"},{"id":"INC-09048","date":"2026-03","year":2026,"title":"ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27599"],"affected":"composer/ci4-cms-erp/ci4ms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27599"},{"id":"INC-09049","date":"2026-03","year":2026,"title":"MikroORM has Prototype Pollution in Utils.merge","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34221"],"affected":"npm/@mikro-orm/core, npm/@mikro-orm/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34221"},{"id":"INC-09050","date":"2026-03","year":2026,"title":"AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34245"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34245"},{"id":"INC-09051","date":"2026-03","year":2026,"title":"AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33761"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wprj-9cvc-5w37"},{"id":"INC-09053","date":"2026-03","year":2026,"title":"Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/action_text-trix, npm/trix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-53p3-c7vp-4mcc"},{"id":"INC-09055","date":"2026-03","year":2026,"title":"MinIO is Vulnerable to SSE Metadata Injection via Replication Headers","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-34204"],"affected":"go/github.com/minio/minio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34204"},{"id":"INC-09056","date":"2026-03","year":2026,"title":"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h8r8-wccr-v5f2"},{"id":"INC-09057","date":"2026-03","year":2026,"title":"Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32305","CVE-2026-33433"],"affected":"go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v3, go/github.com/traefik/traefik/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33433"},{"id":"INC-09058","date":"2026-03","year":2026,"title":"act: Unrestricted set-env and add-path command processing enables environment injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34041"],"affected":"go/github.com/nektos/act","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34041"},{"id":"INC-09059","date":"2026-03","year":2026,"title":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-34043"],"affected":"npm/serialize-javascript","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34043"},{"id":"INC-09060","date":"2026-03","year":2026,"title":"n8n has XSS in its Credential Management Flow","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-364x-8g5j-x2pr"},{"id":"INC-09062","date":"2026-03","year":2026,"title":"n8n: Authenticated XSS and Open Redirect via Form Node","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/n8n, npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w673-8fjw-457c"},{"id":"INC-09064","date":"2026-03","year":2026,"title":"Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34036"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34036"},{"id":"INC-09065","date":"2026-03","year":2026,"title":"Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33979"],"affected":"npm/express-xss-sanitizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33979"},{"id":"INC-09066","date":"2026-03","year":2026,"title":"Moby has AuthZ plugin bypass when provided oversized request bodies","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-34040"],"affected":"go/github.com/docker/docker, go/github.com/moby/moby, go/github.com/moby/moby/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040"},{"id":"INC-09067","date":"2026-03","year":2026,"title":"Moby has an Off-by-one error in its plugin privilege validation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33997"],"affected":"go/github.com/moby/moby/v2, go/github.com/moby/moby, go/github.com/docker/docker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997"},{"id":"INC-09068","date":"2026-03","year":2026,"title":"Incus vulnerable to denial of source through crafted bucket backup file","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33711","CVE-2026-33743"],"affected":"go/github.com/lxc/incus, go/github.com/lxc/incus/v6","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33743"},{"id":"INC-09069","date":"2026-03","year":2026,"title":"Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/postiz","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-89v5-38xr-9m4j"},{"id":"INC-09070","date":"2026-03","year":2026,"title":"Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22743","CVE-2026-22744"],"affected":"maven/org.springframework.ai:spring-ai-redis-store, maven/org.springframework.ai:spring-ai-redis-store","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22744"},{"id":"INC-09071","date":"2026-03","year":2026,"title":"Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33943"],"affected":"npm/happy-dom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33943"},{"id":"INC-09072","date":"2026-03","year":2026,"title":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33916"],"affected":"npm/handlebars","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33916"},{"id":"INC-09073","date":"2026-03","year":2026,"title":"Loofah has improper detection of disallowed URIs via `allowed_uri?`","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/loofah","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2j22-pr5w-6gq8"},{"id":"INC-09074","date":"2026-03","year":2026,"title":"Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/apollo-router, rust/apollo-router, rust/apollo-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hff2-gcpx-8f4p"},{"id":"INC-09075","date":"2026-03","year":2026,"title":"Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33891"],"affected":"npm/node-forge","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33891"},{"id":"INC-09076","date":"2026-03","year":2026,"title":"Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21724"],"affected":"go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21724"},{"id":"INC-09077","date":"2026-03","year":2026,"title":"Contrast BadAML injection allows arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/edgelesssys/contrast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g9ww-x58f-9g6m"},{"id":"INC-09079","date":"2026-03","year":2026,"title":"Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33883"],"affected":"composer/statamic/cms, composer/statamic/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33883"},{"id":"INC-09081","date":"2026-03","year":2026,"title":"OpenBao lacks user confirmation for OIDC direct callback mode","severity":"Critical","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33757"],"affected":"go/github.com/openbao/openbao","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33757"},{"id":"INC-09082","date":"2026-03","year":2026,"title":"AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33764"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33764"},{"id":"INC-09083","date":"2026-03","year":2026,"title":"LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6204"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6204"},{"id":"INC-09084","date":"2026-03","year":2026,"title":"splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33701"],"affected":"maven/com.splunk:splunk-otel-javaagent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h8w2-rv57-vc6f"},{"id":"INC-09085","date":"2026-03","year":2026,"title":"Craft CMS: Authorized asset \"preview file\" requests bypass allows users without asset access to retrieve private preview metadata","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-44px-qjjc-xrhq"},{"id":"INC-09086","date":"2026-03","year":2026,"title":"dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33728"],"affected":"maven/com.datadoghq:dd-java-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33728"},{"id":"INC-09087","date":"2026-03","year":2026,"title":"AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33719"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33719"},{"id":"INC-09089","date":"2026-03","year":2026,"title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33672"],"affected":"npm/picomatch, npm/picomatch, npm/picomatch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672"},{"id":"INC-09090","date":"2026-03","year":2026,"title":"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/smol-toml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v3rj-xjv7-4jmq"},{"id":"INC-09091","date":"2026-03","year":2026,"title":"yaml is vulnerable to Stack Overflow via deeply nested YAML collections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33532"],"affected":"npm/yaml, npm/yaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33532"},{"id":"INC-09092","date":"2026-03","year":2026,"title":"Zoraxy: Authenticated Path Traversal in Config Import leads to RCE","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33529"],"affected":"go/github.com/tobychui/zoraxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33529"},{"id":"INC-09093","date":"2026-03","year":2026,"title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33686"],"affected":"composer/code16/sharp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33686"},{"id":"INC-09094","date":"2026-03","year":2026,"title":"AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wxjx-r2j2-96fx"},{"id":"INC-09095","date":"2026-03","year":2026,"title":"AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33685"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33685"},{"id":"INC-09096","date":"2026-03","year":2026,"title":"AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33683"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33683"},{"id":"INC-09097","date":"2026-03","year":2026,"title":"AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33681"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33681"},{"id":"INC-09098","date":"2026-03","year":2026,"title":"AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33650"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33650"},{"id":"INC-09099","date":"2026-03","year":2026,"title":"AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33649"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33649"},{"id":"INC-09100","date":"2026-03","year":2026,"title":"AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33648"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33648"},{"id":"INC-09101","date":"2026-03","year":2026,"title":"AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33647"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33647"},{"id":"INC-09102","date":"2026-03","year":2026,"title":"@grackle-ai/powerline Runs Without Authentication by Default","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@grackle-ai/powerline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xq7h-vwjp-5vrh"},{"id":"INC-09103","date":"2026-03","year":2026,"title":"@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@grackle-ai/mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-647h-p824-99w7"},{"id":"INC-09104","date":"2026-03","year":2026,"title":"@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@grackle-ai/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7q9x-8g6p-3x75"},{"id":"INC-09105","date":"2026-03","year":2026,"title":"Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/Scriban","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xw6w-9jjh-p9cr"},{"id":"INC-09106","date":"2026-03","year":2026,"title":"Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/Scriban","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xcx6-vp38-8hr5"},{"id":"INC-09107","date":"2026-03","year":2026,"title":"NATS Server panic via malicious compression on leafnode port","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29785"],"affected":"go/github.com/nats-io/nats-server, go/github.com/nats-io/nats-server/v2, go/github.com/nats-io/nats-server/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29785"},{"id":"INC-09108","date":"2026-03","year":2026,"title":"MobSF has SQL Injection in its SQLite Database Viewer Utils","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33545"],"affected":"pip/mobsf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33545"},{"id":"INC-09109","date":"2026-03","year":2026,"title":"JustHTML is vulnerable to XSS via code fence breakout in <pre> content","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5vp3-3cg6-2rq3"},{"id":"INC-09110","date":"2026-03","year":2026,"title":"GoDoxy has a Path Traversal Vulnerability in its File API","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33528"],"affected":"go/github.com/yusing/godoxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33528"},{"id":"INC-09111","date":"2026-03","year":2026,"title":"Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33525"],"affected":"go/github.com/authelia/authelia/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33525"},{"id":"INC-09112","date":"2026-03","year":2026,"title":"Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33486"],"affected":"composer/roadiz/documents, composer/roadiz/documents, composer/roadiz/documents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33486"},{"id":"INC-09113","date":"2026-03","year":2026,"title":"Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33430"],"affected":"pip/briefcase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33430"},{"id":"INC-09114","date":"2026-03","year":2026,"title":"Rails has a possible XSS vulnerability in its Action View tag helpers","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33168"],"affected":"rubygems/actionview, rubygems/actionview, rubygems/actionview","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33168"},{"id":"INC-09115","date":"2026-03","year":2026,"title":"Rails has a possible XSS vulnerability in its Action Pack debug exceptions","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33167"],"affected":"rubygems/actionpack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33167"},{"id":"INC-09116","date":"2026-03","year":2026,"title":"DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24516"],"affected":"go/github.com/digitalocean/droplet-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24516"},{"id":"INC-09117","date":"2026-03","year":2026,"title":"esaml XXE vulnerability allows local file disclosure and SSRF via crafted SAML messages","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28809"],"affected":"erlang/esaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28809"},{"id":"INC-09121","date":"2026-03","year":2026,"title":"Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"actions/SHAdd0WTAka/Zen-Ai-Pentest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f67f-hcr6-94mf"},{"id":"INC-09122","date":"2026-03","year":2026,"title":"AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33499"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33499"},{"id":"INC-09123","date":"2026-03","year":2026,"title":"h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/h3, npm/h3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4hxc-9384-m385"},{"id":"INC-09124","date":"2026-03","year":2026,"title":"h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33490"],"affected":"npm/h3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33490"},{"id":"INC-09125","date":"2026-03","year":2026,"title":"AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33493"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33493"},{"id":"INC-09126","date":"2026-03","year":2026,"title":"AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33492"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33492"},{"id":"INC-09127","date":"2026-03","year":2026,"title":"Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33468"],"affected":"npm/kysely","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33468"},{"id":"INC-09128","date":"2026-03","year":2026,"title":"Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33442"],"affected":"npm/kysely","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33442"},{"id":"INC-09129","date":"2026-03","year":2026,"title":"PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@pdfme/schemas","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xgx4-2wgv-4jhm"},{"id":"INC-09130","date":"2026-03","year":2026,"title":"AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33479"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33479"},{"id":"INC-09131","date":"2026-03","year":2026,"title":"SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33418"],"affected":"npm/@dicebear/converter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33418"},{"id":"INC-09132","date":"2026-03","year":2026,"title":"oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33331"],"affected":"npm/@orpc/openapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33331"},{"id":"INC-09133","date":"2026-03","year":2026,"title":"Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-29794","CVE-2026-33315","CVE-2026-33316"],"affected":"go/code.vikunja.io/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33316"},{"id":"INC-09134","date":"2026-03","year":2026,"title":"tar-rs `unpack_in` can chmod arbitrary directories by following symlinks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33056"],"affected":"rust/tar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056"},{"id":"INC-09135","date":"2026-03","year":2026,"title":"pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32711"],"affected":"pip/pydicom, pip/pydicom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32711"},{"id":"INC-09136","date":"2026-03","year":2026,"title":"The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4267"],"affected":"composer/johnbillion/query-monitor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4267"},{"id":"INC-09137","date":"2026-03","year":2026,"title":"AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33352"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33352"},{"id":"INC-09138","date":"2026-03","year":2026,"title":"Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33344"],"affected":"go/github.com/dagu-org/dagu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33344"},{"id":"INC-09139","date":"2026-03","year":2026,"title":"Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33349"],"affected":"npm/fast-xml-parser, npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33349"},{"id":"INC-09140","date":"2026-03","year":2026,"title":"league/commonmark has an embed extension allowed_domains bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33347"],"affected":"composer/league/commonmark","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33347"},{"id":"INC-09141","date":"2026-03","year":2026,"title":"MinIO has JWT Algorithm Confusion in OIDC Authentication","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33322"],"affected":"go/github.com/minio/minio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33322"},{"id":"INC-09142","date":"2026-03","year":2026,"title":"SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33311"],"affected":"npm/@dicebear/initials, npm/@dicebear/initials, npm/@dicebear/initials","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33311"},{"id":"INC-09143","date":"2026-03","year":2026,"title":"Intake has a Command Injection via shell() Expansion in Parameter Defaults","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33310"],"affected":"pip/intake","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33310"},{"id":"INC-09144","date":"2026-03","year":2026,"title":"Juju has unauthorized access to out-of-scope Kubernetes secrets","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32692","CVE-2026-32693"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32693"},{"id":"INC-09145","date":"2026-03","year":2026,"title":"AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33296"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33296"},{"id":"INC-09146","date":"2026-03","year":2026,"title":"AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33295"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33295"},{"id":"INC-09147","date":"2026-03","year":2026,"title":"AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33294"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33294"},{"id":"INC-09148","date":"2026-03","year":2026,"title":"AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33292"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33292"},{"id":"INC-09809","date":"2026-03","year":2026,"title":"step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30836"],"affected":"go/github.com/smallstep/certificates","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30836"},{"id":"INC-09149","date":"2026-03","year":2026,"title":"MCP Connect has unauthenticated remote OS command execution via /bridge endpoint","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/mcp-bridge","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wvr4-3wq4-gpc5"},{"id":"INC-09150","date":"2026-03","year":2026,"title":"Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33320"],"affected":"go/github.com/tomwright/dasel/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33320"},{"id":"INC-09151","date":"2026-03","year":2026,"title":"AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33319"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33319"},{"id":"INC-09152","date":"2026-03","year":2026,"title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/modelcontextprotocol/go-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q382-vc8q-7jhj"},{"id":"INC-09153","date":"2026-03","year":2026,"title":"Juju affected by timing ownership claim attack on new external back-end secrets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32691"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32691"},{"id":"INC-09154","date":"2026-03","year":2026,"title":"NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33236"],"affected":"pip/nltk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33236"},{"id":"INC-09155","date":"2026-03","year":2026,"title":"Unauthenticated remote shutdown in nltk.app.wordnet_app","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33231"],"affected":"pip/nltk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33231"},{"id":"INC-09158","date":"2026-03","year":2026,"title":"Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33226"],"affected":"npm/budibase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33226"},{"id":"INC-09159","date":"2026-03","year":2026,"title":"JustHTML has a Sanitizer Bypass (in Markdown)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3rcm-vjrc-p45j"},{"id":"INC-09160","date":"2026-03","year":2026,"title":"JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qvc2-mg72-jjhx"},{"id":"INC-09161","date":"2026-03","year":2026,"title":"Unsigned SAML LogoutRequest Acceptance in gosaml2","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/russellhaering/gosaml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pcgw-qcv5-h8ch"},{"id":"INC-09162","date":"2026-03","year":2026,"title":"gosaml2 CBC Padding Panic — Unauthenticated Process Crash","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/russellhaering/gosaml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hwqm-qvj9-4jr2"},{"id":"INC-09163","date":"2026-03","year":2026,"title":"mo has a XSS via inline SVG script tags in Markdown rendering","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/k1LoW/mo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vccx-p757-pv6h"},{"id":"INC-09164","date":"2026-03","year":2026,"title":"gRPC-Go has an authorization bypass via missing leading slash in :path","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33186"],"affected":"go/google.golang.org/grpc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186"},{"id":"INC-09165","date":"2026-03","year":2026,"title":"Filament Unvalidated Range and Values summarizer values can be used for XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33080"],"affected":"composer/filament/tables, composer/filament/tables","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33080"},{"id":"INC-09166","date":"2026-03","year":2026,"title":"Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33057"],"affected":"pip/mesop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33057"},{"id":"INC-09167","date":"2026-03","year":2026,"title":"ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32731"],"affected":"npm/@apostrophecms/import-export","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32731"},{"id":"INC-09168","date":"2026-03","year":2026,"title":"Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33001","CVE-2026-33003"],"affected":"maven/org.jenkins-ci.plugins:loadninja","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33003"},{"id":"INC-09169","date":"2026-03","year":2026,"title":"OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33142"],"affected":"npm/oneuptime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33142"},{"id":"INC-09170","date":"2026-03","year":2026,"title":"Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33140"],"affected":"pip/pyspector","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33140"},{"id":"INC-09171","date":"2026-03","year":2026,"title":"h3 has a middleware bypass with one gadget","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33131"],"affected":"npm/h3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33131"},{"id":"INC-09172","date":"2026-03","year":2026,"title":"h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33128"],"affected":"npm/h3, npm/h3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33128"},{"id":"INC-09173","date":"2026-03","year":2026,"title":"Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@pdfme/schemas","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-87v3-4cfp-cm76"},{"id":"INC-09174","date":"2026-03","year":2026,"title":"Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@pdfme/schemas","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qq9g-96v4-m3cj"},{"id":"INC-09175","date":"2026-03","year":2026,"title":"SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33067"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33067"},{"id":"INC-09176","date":"2026-03","year":2026,"title":"Heimdall: Path received via Envoy gRPC corrupted when containing query string","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32811"],"affected":"go/github.com/dadrus/heimdall","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32811"},{"id":"INC-09177","date":"2026-03","year":2026,"title":"Craft CMS Vulnerable to Stored XSS in Revision Context Menu","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33051"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33051"},{"id":"INC-09178","date":"2026-03","year":2026,"title":"SQL Injection in Spring AI MariaDBFilterExpressionConverter","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22729","CVE-2026-22730"],"affected":"maven/org.springframework.ai:spring-ai-mariadb-store, maven/org.springframework.ai:spring-ai-mariadb-store","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22730"},{"id":"INC-09179","date":"2026-03","year":2026,"title":"Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4269"],"affected":"pip/bedrock-agentcore-starter-toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4269"},{"id":"INC-09180","date":"2026-03","year":2026,"title":"AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-33039"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33039"},{"id":"INC-09181","date":"2026-03","year":2026,"title":"Unauthenticated Reflected XSS via innerHTML in AVideo","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33035"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33035"},{"id":"INC-09182","date":"2026-03","year":2026,"title":"fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33036"],"affected":"npm/fast-xml-parser, npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33036"},{"id":"INC-09183","date":"2026-03","year":2026,"title":"Tillitis TKey Client has an Error in Protocol Implementation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32953"],"affected":"go/github.com/tillitis/tkeyclient","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32953"},{"id":"INC-09184","date":"2026-03","year":2026,"title":"Micronaut Framework vulnerable to a Denial of Service in HTML error response caching","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33012"],"affected":"maven/io.micronaut:micronaut-http-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33012"},{"id":"INC-09185","date":"2026-03","year":2026,"title":"Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-32254"],"affected":"go/github.com/cloudnativelabs/kube-router/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32254"},{"id":"INC-09186","date":"2026-03","year":2026,"title":"jsPDF has HTML Injection in New Window paths","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31938"],"affected":"npm/jspdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31938"},{"id":"INC-09187","date":"2026-03","year":2026,"title":"SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-29183","CVE-2026-32747","CVE-2026-32751","CVE-2026-32767","CVE-2026-32815","CVE-2026-32938","CVE-2026-32940"],"affected":"go/github.com/siyuan-note/siyuan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32940"},{"id":"INC-09188","date":"2026-03","year":2026,"title":"Uncontrolled recursion DoS in JustHTML() via deeply nested HTML","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/justhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v7cf-c9rm-wm3j"},{"id":"INC-09189","date":"2026-03","year":2026,"title":"Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32813"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32813"},{"id":"INC-09190","date":"2026-03","year":2026,"title":"Admidio has an HTMLPurifier Bypass in eCard Message Allows HTML Email Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32755","CVE-2026-32757","CVE-2026-32812","CVE-2026-32816"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32757"},{"id":"INC-09191","date":"2026-03","year":2026,"title":"File Browser Signup Grants Admin When Default Permissions Include Admin","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32760"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32760"},{"id":"INC-09192","date":"2026-03","year":2026,"title":"SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/siyuan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v3mg-9v85-fcm7"},{"id":"INC-09193","date":"2026-03","year":2026,"title":"File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32759"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32759"},{"id":"INC-09194","date":"2026-03","year":2026,"title":"Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32728"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32728"},{"id":"INC-09195","date":"2026-03","year":2026,"title":"Stored XSS in Memray-generated HTML reports via unescaped command-line metadata","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32722"],"affected":"pip/memray","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32722"},{"id":"INC-09196","date":"2026-03","year":2026,"title":"XSS in @leanprover/unicode-input-component","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32732"],"affected":"npm/@leanprover/unicode-input-component","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32732"},{"id":"INC-09197","date":"2026-03","year":2026,"title":"IncusOS has a LUKS encryption bypass due to insufficient TPM policy","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32606"],"affected":"go/github.com/lxc/incus-os/incus-osd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32606"},{"id":"INC-09198","date":"2026-03","year":2026,"title":"LeafKit's HTML escaping may be skipped for Collection values, enabling XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28499"],"affected":"swift/github.com/vapor/leaf-kit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28499"},{"id":"INC-09199","date":"2026-03","year":2026,"title":"Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28490","CVE-2026-28498"],"affected":"pip/authlib","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28498"},{"id":"INC-09200","date":"2026-03","year":2026,"title":"@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4092"],"affected":"npm/@google/clasp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4092"},{"id":"INC-09201","date":"2026-03","year":2026,"title":"file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32630"],"affected":"npm/file-type","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32630"},{"id":"INC-09203","date":"2026-03","year":2026,"title":"Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/centrifugal/centrifugo/v5, go/github.com/centrifugal/centrifugo/v4,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q926-c743-49qj"},{"id":"INC-09204","date":"2026-03","year":2026,"title":"simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32600"],"affected":"composer/simplesamlphp/xml-security, composer/simplesamlphp/xml-security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32600"},{"id":"INC-09205","date":"2026-03","year":2026,"title":"xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32313"],"affected":"composer/robrichards/xmlseclibs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32313"},{"id":"INC-09206","date":"2026-03","year":2026,"title":"Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-32301"],"affected":"go/github.com/centrifugal/centrifugo/v5, go/github.com/centrifugal/centrifugo/v4,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32301"},{"id":"INC-09207","date":"2026-03","year":2026,"title":"OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: \"loose\")","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32308"],"affected":"npm/oneuptime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32308"},{"id":"INC-09208","date":"2026-03","year":2026,"title":"CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31899"],"affected":"pip/CairoSVG","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31899"},{"id":"INC-09209","date":"2026-03","year":2026,"title":"Dagu: Path Traversal via `dagRunId` in Inline DAG Execution","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-31886"],"affected":"go/github.com/dagu-org/dagu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31886"},{"id":"INC-09210","date":"2026-03","year":2026,"title":"Dagu: SSE Authentication Bypass in Basic Auth Mode","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31882"],"affected":"npm/dagu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31882"},{"id":"INC-09211","date":"2026-03","year":2026,"title":"TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28792"],"affected":"npm/@tinacms/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28792"},{"id":"INC-09212","date":"2026-03","year":2026,"title":"Tina: Path Traversal in Media Upload Handle","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28791"],"affected":"npm/tinacms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28791"},{"id":"INC-09213","date":"2026-03","year":2026,"title":"Trix has a Stored XSS vulnerability through serialized attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/trix, rubygems/action_text-trix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qmpg-8xg6-ph5q"},{"id":"INC-09214","date":"2026-03","year":2026,"title":"ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32231"],"affected":"rust/zeptoclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4cm8-xpfv-jv6f"},{"id":"INC-09215","date":"2026-03","year":2026,"title":"@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32236"],"affected":"npm/@backstage/plugin-auth-backend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32236"},{"id":"INC-09216","date":"2026-03","year":2026,"title":"StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32104"],"affected":"npm/studiocms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32104"},{"id":"INC-09217","date":"2026-03","year":2026,"title":"AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32136"],"affected":"go/github.com/AdguardTeam/AdGuardHome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32136"},{"id":"INC-09218","date":"2026-03","year":2026,"title":"Copyparty has unexpected JavaScript execution via crafted URL to folder with `.prologue.html`","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32109"],"affected":"pip/copyparty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32109"},{"id":"INC-14178","date":"2026-03","year":2026,"title":"OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qcc4-p59m-p54m"},{"id":"INC-09219","date":"2026-03","year":2026,"title":"Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31860"],"affected":"npm/unhead","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31860"},{"id":"INC-09220","date":"2026-03","year":2026,"title":"Winter vulnerable to privilege escalation by authenticated backend users","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27591"],"affected":"composer/winter/wn-backend-module, composer/winter/wn-backend-module, composer/winter/wn-backend-module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27591"},{"id":"INC-09221","date":"2026-03","year":2026,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26127"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-arm64, nuget/Microsoft.NetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26127"},{"id":"INC-09222","date":"2026-03","year":2026,"title":".NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26131"],"affected":"nuget/Microsoft.NetCore.App.Runtime.linux-x64, nuget/Microsoft.NetCore.App.Runtime.linux-musl-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26131"},{"id":"INC-09223","date":"2026-03","year":2026,"title":"Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25495"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g3hp-vvqf-8vw6"},{"id":"INC-09224","date":"2026-03","year":2026,"title":"Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31834"],"affected":"nuget/Umbraco.Cms, nuget/Umbraco.Cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31834"},{"id":"INC-09225","date":"2026-03","year":2026,"title":"Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31833"],"affected":"nuget/Umbraco.Cms, nuget/Umbraco.Cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31833"},{"id":"INC-09226","date":"2026-03","year":2026,"title":"Quill has DoS via unbounded read of HTTP response body during notarization","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-31959","CVE-2026-31960"],"affected":"go/github.com/anchore/quill","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31960"},{"id":"INC-09227","date":"2026-03","year":2026,"title":"Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31868"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31868"},{"id":"INC-09228","date":"2026-03","year":2026,"title":"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v8w9-8mx6-g223"},{"id":"INC-09229","date":"2026-03","year":2026,"title":"CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31859"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31859"},{"id":"INC-09230","date":"2026-03","year":2026,"title":"Umbraco Backoffice API Allows Unauthorized Modification of Domain Data","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31832"],"affected":"nuget/Umbraco.Cms, nuget/Umbraco.Cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31832"},{"id":"INC-09231","date":"2026-03","year":2026,"title":"Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31800"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31800"},{"id":"INC-09232","date":"2026-03","year":2026,"title":"Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30948"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30948"},{"id":"INC-09233","date":"2026-03","year":2026,"title":"Sylius Vulnerable to Authenticated Stored XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31823"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31823"},{"id":"INC-09234","date":"2026-03","year":2026,"title":"Sylius has a XSS vulnerability in checkout login form","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-31822"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31822"},{"id":"INC-09235","date":"2026-03","year":2026,"title":"Sylius is Missing Authorization in API v2 Add Item Endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31821"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31821"},{"id":"INC-09236","date":"2026-03","year":2026,"title":"Sylius has an Open Redirect via Referer Header","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31819"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31819"},{"id":"INC-09237","date":"2026-03","year":2026,"title":"django-unicorn affected by component state manipulation via unvalidated attribute access","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-31815"],"affected":"pip/django-unicorn","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31815"},{"id":"INC-09238","date":"2026-03","year":2026,"title":"SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-31807","CVE-2026-31809"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31809"},{"id":"INC-09239","date":"2026-03","year":2026,"title":"simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28292"],"affected":"npm/simple-git","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28292"},{"id":"INC-09240","date":"2026-03","year":2026,"title":"Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26308"],"affected":"go/github.com/envoyproxy/envoy, go/github.com/envoyproxy/envoy, go/github.com/envoyproxy/envoy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26308"},{"id":"INC-09241","date":"2026-03","year":2026,"title":"Craft Commerce: Potential IDOR in Commerce carts","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31867"],"affected":"composer/craftcms/commerce, composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31867"},{"id":"INC-09242","date":"2026-03","year":2026,"title":"Craft Commerce has stored XSS in Inventory Location Name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29176"],"affected":"composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29176"},{"id":"INC-09243","date":"2026-03","year":2026,"title":"Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29175"],"affected":"composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29175"},{"id":"INC-09244","date":"2026-03","year":2026,"title":"Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29174"],"affected":"composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29174"},{"id":"INC-09245","date":"2026-03","year":2026,"title":"Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29172"],"affected":"composer/craftcms/commerce, composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29172"},{"id":"INC-09246","date":"2026-03","year":2026,"title":"StudioCMS has Privilege Escalation via Insecure API Token Generation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30944"],"affected":"npm/studiocms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30944"},{"id":"INC-09247","date":"2026-03","year":2026,"title":"copyparty: volflag `nohtml` did not block javascript in svg files","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30974"],"affected":"pip/copyparty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30974"},{"id":"INC-09249","date":"2026-03","year":2026,"title":"FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30934"],"affected":"go/github.com/gtsteffaniak/filebrowser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30934"},{"id":"INC-09250","date":"2026-03","year":2026,"title":"SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-30926"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30926"},{"id":"INC-09251","date":"2026-03","year":2026,"title":"Netmaker has Insufficient Authorization in Host Token Verification","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29194"],"affected":"go/github.com/gravitl/netmaker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29194"},{"id":"INC-09252","date":"2026-03","year":2026,"title":"Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25604"],"affected":"pip/apache-airflow-providers-amazon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25604"},{"id":"INC-09253","date":"2026-03","year":2026,"title":"Black's vulnerable version parsing leads to RCE in GitHub Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-31900"],"affected":"actions/psf/black","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31900"},{"id":"INC-09254","date":"2026-03","year":2026,"title":"Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/grumpydictator/firefly-iii","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5q8v-j673-m5v4"},{"id":"INC-09255","date":"2026-03","year":2026,"title":"Caddy's vars_regexp double-expands user input, leaking env vars and files","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-30852"],"affected":"go/github.com/caddyserver/caddy/v2/modules/caddyhttp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30852"},{"id":"INC-09256","date":"2026-03","year":2026,"title":"Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-30851"],"affected":"go/github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30851"},{"id":"INC-09257","date":"2026-03","year":2026,"title":"CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30838"],"affected":"composer/league/commonmark","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30838"},{"id":"INC-09258","date":"2026-03","year":2026,"title":"defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30830"],"affected":"npm/defuddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30830"},{"id":"INC-09259","date":"2026-03","year":2026,"title":"Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-15602"],"affected":"composer/snipe/snipe-it","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15602"},{"id":"INC-09810","date":"2026-03","year":2026,"title":"SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/sagemaker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5r2p-pjr8-7fh7"},{"id":"INC-09260","date":"2026-03","year":2026,"title":"MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30227"],"affected":"nuget/MimeKit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30227"},{"id":"INC-09261","date":"2026-03","year":2026,"title":"EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/ec-cube/ec-cube","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7rhv-h82h-vpjh"},{"id":"INC-09263","date":"2026-03","year":2026,"title":"Gogs: Stored XSS in branch and wiki views through author and committer names","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25921","CVE-2026-26022","CVE-2026-26195"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26195"},{"id":"INC-09264","date":"2026-03","year":2026,"title":"Gokapi has privilege escalation with auth token","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-29060"],"affected":"go/github.com/forceu/gokapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29060"},{"id":"INC-09265","date":"2026-03","year":2026,"title":"xgrammar vulnerable to DoS via multi-layer nesting","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25048"],"affected":"pip/xgrammar","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25048"},{"id":"INC-09266","date":"2026-03","year":2026,"title":"Leantime has HTML injection through firstname and lastname fields","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/leantime/leantime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qrfh-cc86-vc8c"},{"id":"INC-09267","date":"2026-03","year":2026,"title":"django-allauth has an open redirect vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27982"],"affected":"pip/django-allauth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27982"},{"id":"INC-09268","date":"2026-03","year":2026,"title":"AVideo: Unauthenticated PHP session store exposed to host network via published memcached port","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-29093"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29093"},{"id":"INC-09269","date":"2026-03","year":2026,"title":"Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29182"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29182"},{"id":"INC-09270","date":"2026-03","year":2026,"title":"pyLoad has an Arbitrary File Write via Path Traversal in edit_package()","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29778"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29778"},{"id":"INC-09271","date":"2026-03","year":2026,"title":"eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29780"],"affected":"pip/eml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29780"},{"id":"INC-09272","date":"2026-03","year":2026,"title":"TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29186"],"affected":"npm/@backstage/plugin-techdocs-node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29186"},{"id":"INC-09273","date":"2026-03","year":2026,"title":"SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-29074"],"affected":"npm/svgo, npm/svgo, npm/svgo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29074"},{"id":"INC-09274","date":"2026-03","year":2026,"title":"ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-29191"],"affected":"go/github.com/zitadel/zitadel/v2, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29191"},{"id":"INC-09275","date":"2026-03","year":2026,"title":"Fickling missing RCE-capable modules in UNSAFE_IMPORTS","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/fickling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5hwf-rc88-82xm"},{"id":"INC-09276","date":"2026-03","year":2026,"title":"changedetection.io has Zip Slip vulnerability in the backup restore functionality","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27645","CVE-2026-29038","CVE-2026-29065"],"affected":"pip/changedetection.io","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29065"},{"id":"INC-09277","date":"2026-03","year":2026,"title":"Nuclio Shell Runtime Command Injection Leading to Privilege Escalation","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-29042"],"affected":"go/github.com/nuclio/nuclio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-29042"},{"id":"INC-09278","date":"2026-03","year":2026,"title":"Kimai's API invoice endpoint missing customer-level access control (IDOR)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-28685"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28685"},{"id":"INC-09279","date":"2026-03","year":2026,"title":"IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28681"],"affected":"pip/irrd, pip/irrd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28681"},{"id":"INC-09280","date":"2026-03","year":2026,"title":"Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27802"],"affected":"rust/vaultwarden","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27802"},{"id":"INC-09281","date":"2026-03","year":2026,"title":"Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27801"],"affected":"rust/vaultwarden","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27801"},{"id":"INC-09283","date":"2026-03","year":2026,"title":"OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-46986"],"affected":"npm/openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jjgj-cpp9-cvpv"},{"id":"INC-14179","date":"2026-03","year":2026,"title":"OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3jx4-q2m7-r496"},{"id":"INC-14180","date":"2026-03","year":2026,"title":"OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f6h3-846h-2r8w"},{"id":"INC-09286","date":"2026-03","year":2026,"title":"OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8cp7-rp8r-mg77"},{"id":"INC-09287","date":"2026-03","year":2026,"title":"CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28343"],"affected":"npm/ckeditor5, npm/@ckeditor/ckeditor5-html-support","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28343"},{"id":"INC-09288","date":"2026-03","year":2026,"title":"XWiki Blog Application home page vulnerable to Stored XSS via Post Title","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66024"],"affected":"maven/org.xwiki.contrib.blog:application-blog-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66024"},{"id":"INC-09289","date":"2026-03","year":2026,"title":"Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3244"],"affected":"composer/concrete5/concrete5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3244"},{"id":"INC-14181","date":"2026-03","year":2026,"title":"OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2ch6-x3g4-7759"},{"id":"INC-09292","date":"2026-03","year":2026,"title":"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-534w-2vm4-89xr"},{"id":"INC-14182","date":"2026-03","year":2026,"title":"OpenClaw: Zip extraction symlink traversal could write outside destination","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jxrq-8fm4-9p58"},{"id":"INC-09294","date":"2026-03","year":2026,"title":"OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8mf7-vv8w-hjr2"},{"id":"INC-09295","date":"2026-03","year":2026,"title":"OpenClaw hook transform path containment missed symlink-resolved escapes","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-659f-22xc-98f2"},{"id":"INC-14183","date":"2026-03","year":2026,"title":"OpenClaw has multiple E2E/test Dockerfiles that run all processes as root","severity":"High","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w7j5-j98m-w679"},{"id":"INC-14184","date":"2026-03","year":2026,"title":"OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7qf6-h84j-8fq4"},{"id":"INC-09298","date":"2026-03","year":2026,"title":"OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7ff8-xjh3-mgh6"},{"id":"INC-09299","date":"2026-03","year":2026,"title":"OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r294-2894-92j3"},{"id":"INC-14185","date":"2026-03","year":2026,"title":"OpenClaw has a Discord `allowFrom` slug-collision authorization bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4cqv-h74h-93j4"},{"id":"INC-14186","date":"2026-03","year":2026,"title":"OpenClaw has a IPv6 multicast SSRF classifier bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h97f-6pqj-q452"},{"id":"INC-14187","date":"2026-03","year":2026,"title":"OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pfv7-rr5m-qmv6"},{"id":"INC-14188","date":"2026-03","year":2026,"title":"OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5h2c-8v84-qpvr"},{"id":"INC-14189","date":"2026-03","year":2026,"title":"OpenClaw plugin runtime command execution is part of trusted plugin boundary","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ff98-w8hj-qrxf"},{"id":"INC-14190","date":"2026-03","year":2026,"title":"OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j26j-7qc4-3mrf"},{"id":"INC-14191","date":"2026-03","year":2026,"title":"OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2hm8-rqrm-xfjq"},{"id":"INC-14192","date":"2026-03","year":2026,"title":"OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2mc2-g238-722j"},{"id":"INC-09304","date":"2026-03","year":2026,"title":"OpenClaw: Sandboxed sessions_spawn(runtime=\"acp\") bypassed sandbox inheritance and allowed host ACP initialization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-474h-prjg-mmw3"},{"id":"INC-09305","date":"2026-03","year":2026,"title":"MCP NMAP Server has an Injection vulnerability","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3484"],"affected":"npm/mcp-nmap-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3484"},{"id":"INC-09307","date":"2026-03","year":2026,"title":"OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2858-xg23-26fp"},{"id":"INC-09308","date":"2026-03","year":2026,"title":"Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28782"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28782"},{"id":"INC-09309","date":"2026-03","year":2026,"title":"NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28357","CVE-2026-28359","CVE-2026-28361","CVE-2026-28397","CVE-2026-28401"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28401"},{"id":"INC-09310","date":"2026-03","year":2026,"title":"Craft CMS has IDOR via GraphQL @parseRefs","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-28696"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28696"},{"id":"INC-09311","date":"2026-03","year":2026,"title":"PickleScan has multiple stdlib modules with direct RCE not in blocklist","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g38g-8gr9-h9xp"},{"id":"INC-14193","date":"2026-03","year":2026,"title":"PickleScan's pkgutil.resolve_name has a universal blocklist bypass","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3490"],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3490"},{"id":"INC-14194","date":"2026-03","year":2026,"title":"OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qhrr-grqp-6x2g"},{"id":"INC-14195","date":"2026-03","year":2026,"title":"OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h656-5vcf-cm23"},{"id":"INC-09316","date":"2026-03","year":2026,"title":"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9f72-qcpw-2hxc"},{"id":"INC-09317","date":"2026-03","year":2026,"title":"DOMPurify contains a Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15599"],"affected":"npm/dompurify, npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15599"},{"id":"INC-14196","date":"2026-03","year":2026,"title":"OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qj22-xqjr-v83v"},{"id":"INC-09319","date":"2026-03","year":2026,"title":"OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27012"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27012"},{"id":"INC-09320","date":"2026-03","year":2026,"title":"Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26279"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26279"},{"id":"INC-09321","date":"2026-03","year":2026,"title":"OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24415"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24415"},{"id":"INC-09322","date":"2026-03","year":2026,"title":"Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/rancher/rancher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hwm2-4ph6-w6m5"},{"id":"INC-09325","date":"2026-03","year":2026,"title":"OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5847-rm3g-23mw"},{"id":"INC-09328","date":"2026-03","year":2026,"title":"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-943q-mwmv-hhvh"},{"id":"INC-14197","date":"2026-03","year":2026,"title":"OpenClaw: Node exec approvals could be replayed across nodes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6x2m-hqfw-hvpj"},{"id":"INC-14198","date":"2026-03","year":2026,"title":"OpenClaw: Sandbox media TOCTOU could read files outside sandbox root","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7xmq-g46g-f8pv"},{"id":"INC-14199","date":"2026-03","year":2026,"title":"OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x82f-27x3-q89c"},{"id":"INC-14200","date":"2026-03","year":2026,"title":"OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8m9v-xpgf-g99m"},{"id":"INC-14201","date":"2026-03","year":2026,"title":"OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-392f-ggf5-fp3c"},{"id":"INC-09332","date":"2026-03","year":2026,"title":"OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-28790"],"affected":"go/github.com/OliveTin/OliveTin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28790"},{"id":"INC-09333","date":"2026-03","year":2026,"title":"Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28507"],"affected":"composer/idno/known","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28507"},{"id":"INC-09334","date":"2026-03","year":2026,"title":"lxml-html-clean has <base> tag injection through default Cleaner configuration","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28350"],"affected":"pip/lxml-html-clean","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28350"},{"id":"INC-09335","date":"2026-03","year":2026,"title":"lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28348"],"affected":"pip/lxml-html-clean","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28348"},{"id":"INC-09336","date":"2026-03","year":2026,"title":"Indico has a missing access check in the event series management API","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28352"],"affected":"pip/indico","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28352"},{"id":"INC-09337","date":"2026-03","year":2026,"title":"INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/romitou/insatutorat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xfx2-prg5-jq3g"},{"id":"INC-09825","date":"2026-03","year":2026,"title":"Malware in @iflow-mcp/watercrawl-watercrawl-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@iflow-mcp/watercrawl-watercrawl-mcp, npm/@iflow-mcp/watercrawl-watercrawl-mcp,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rg84-r52h-2rgw"},{"id":"INC-13427","date":"2026-03","year":2026,"title":"Malware in @openclaw-ai/openclawai","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@openclaw-ai/openclawai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-73px-wj4g-wgwp"},{"id":"INC-14202","date":"2026-03","year":2026,"title":"Malware in openclaw-droid","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openclaw-droid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q7p3-59wr-r6f3"},{"id":"INC-01609","date":"2026-02","year":2026,"title":"OrcaStatLLM Researcher — Xss (CVE-2026-24903)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24903"],"affected":"algonet/orcastatllm_researcher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24903"},{"id":"INC-01292","date":"2026-02","year":2026,"title":"LangChain — Ssrf (CVE-2026-26013)","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26013"],"affected":"langchain/langchain_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26013"},{"id":"INC-00896","date":"2026-02","year":2026,"title":"Dify — Xss (CVE-2026-26023)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26023"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26023"},{"id":"INC-01823","date":"2026-02","year":2026,"title":"Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-1721"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1721"},{"id":"INC-02113","date":"2026-02","year":2026,"title":"Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `edit_file`).","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27967"],"affected":"zed/zed","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27967"},{"id":"INC-00048","date":"2026-02","year":2026,"title":"Agenta — Sandbox Escape (CVE-2026-27952)","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27952"],"affected":"agentatech/agenta","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27952"},{"id":"INC-00049","date":"2026-02","year":2026,"title":"Agenta — Vulnerability (CVE-2026-27961)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27961"],"affected":"agentatech/agenta","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27961"},{"id":"INC-00894","date":"2026-02","year":2026,"title":"Dify — Vulnerability (CVE-2026-28288)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28288"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28288"},{"id":"INC-01773","date":"2026-02","year":2026,"title":"SillyTavern — Ssrf (CVE-2026-26286)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26286"],"affected":"sillytavern/sillytavern","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26286"},{"id":"INC-01523","date":"2026-02","year":2026,"title":"New API — Xss (CVE-2026-25802)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25802"],"affected":"newapi/new_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25802"},{"id":"INC-01603","date":"2026-02","year":2026,"title":"OpenClaw — Path Traversal (CVE-2026-25475)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25475"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25475"},{"id":"INC-00659","date":"2026-02","year":2026,"title":"AutoGPT — Ssrf (CVE-2025-62616)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62616"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62616"},{"id":"INC-01762","date":"2026-02","year":2026,"title":"Semantic Kernel — Path Traversal (CVE-2026-25592)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25592"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25592"},{"id":"INC-00936","date":"2026-02","year":2026,"title":"Enclave — Rce (CVE-2026-25533)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25533"],"affected":"agentfront/enclave","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25533"},{"id":"INC-01090","date":"2026-02","year":2026,"title":"GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, ...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-1868"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1868"},{"id":"INC-00994","date":"2026-02","year":2026,"title":"FastGPT — Vulnerability (CVE-2026-26003)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26003"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26003"},{"id":"INC-00995","date":"2026-02","year":2026,"title":"FastGPT — Vulnerability (CVE-2026-26075)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26075"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26075"},{"id":"INC-00869","date":"2026-02","year":2026,"title":"Cursor — Prompt Injection (CVE-2026-26268)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-26268"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26268"},{"id":"INC-01777","date":"2026-02","year":2026,"title":"Skill Scanner — Prompt Injection (CVE-2026-26057)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-26057"],"affected":"cisco/skill_scanner","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26057"},{"id":"INC-01625","date":"2026-02","year":2026,"title":"Parse Dashboard — Vulnerability (CVE-2026-27595)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27595","CVE-2026-27608","CVE-2026-27609","CVE-2026-27610"],"affected":"parseplatform/parse_dashboard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27595"},{"id":"INC-00937","date":"2026-02","year":2026,"title":"Enclave — Rce (CVE-2026-27597)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27597"],"affected":"agentfront/enclave","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27597"},{"id":"INC-00815","date":"2026-02","year":2026,"title":"Claude Code — Data Exfiltration (CVE-2026-24052)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24052"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24052"},{"id":"INC-00817","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-24053)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24053"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24053"},{"id":"INC-00818","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-24887)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24887"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24887"},{"id":"INC-00819","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-25722)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25722"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25722"},{"id":"INC-00820","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-25723)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25723"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25723"},{"id":"INC-00821","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-25724)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25724"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25724"},{"id":"INC-00822","date":"2026-02","year":2026,"title":"Claude Code — Vulnerability (CVE-2026-25725)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25725"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25725"},{"id":"INC-01337","date":"2026-02","year":2026,"title":"Liquid Prompt — Command Injection (CVE-2026-27113)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27113"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27113"},{"id":"INC-01100","date":"2026-02","year":2026,"title":"Godot MCP — Command Injection (CVE-2026-25546)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25546"],"affected":"coding-solo/godot_mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25546"},{"id":"INC-01383","date":"2026-02","year":2026,"title":"MCP Salesforce Connector — Vulnerability (CVE-2026-25650)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25650"],"affected":"smn2gnt/mcp_salesforce_connector","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25650"},{"id":"INC-01895","date":"2026-02","year":2026,"title":"The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS envi...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25905"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25905"},{"id":"INC-01767","date":"2026-02","year":2026,"title":"sf-mcp-server — Command Injection (CVE-2026-26029)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26029"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26029"},{"id":"INC-00923","date":"2026-02","year":2026,"title":"eBay API MCP Server — Rce (CVE-2026-27203)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27203"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27203"},{"id":"INC-01462","date":"2026-02","year":2026,"title":"Model Context Protocol Servers — Vulnerability (CVE-2026-27735)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27735"],"affected":"lfprojects/model_context_protocol_servers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27735"},{"id":"INC-01907","date":"2026-02","year":2026,"title":"Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21523"],"affected":"microsoft/visual_studio_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21523"},{"id":"INC-01480","date":"2026-02","year":2026,"title":"n8n — Info Disclosure (CVE-2025-61917)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-61917"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61917"},{"id":"INC-01507","date":"2026-02","year":2026,"title":"n8n — Xss (CVE-2026-25051)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25051"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25051"},{"id":"INC-01474","date":"2026-02","year":2026,"title":"n8n — Auth Bypass (CVE-2026-25052)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25052"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25052"},{"id":"INC-01494","date":"2026-02","year":2026,"title":"n8n — Vulnerability (CVE-2026-25053)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25053"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25053"},{"id":"INC-01508","date":"2026-02","year":2026,"title":"n8n — Xss (CVE-2026-25054)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25054"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25054"},{"id":"INC-01483","date":"2026-02","year":2026,"title":"n8n — Rce (CVE-2026-25055)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25055"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25055"},{"id":"INC-01484","date":"2026-02","year":2026,"title":"n8n — Rce (CVE-2026-25056)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25056"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25056"},{"id":"INC-01495","date":"2026-02","year":2026,"title":"n8n — Vulnerability (CVE-2026-25115)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25115"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25115"},{"id":"INC-01475","date":"2026-02","year":2026,"title":"n8n — Command Injection (CVE-2026-21893)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21893"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21893"},{"id":"INC-01476","date":"2026-02","year":2026,"title":"n8n — Data Exfiltration (CVE-2026-25631)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25631"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25631"},{"id":"INC-01485","date":"2026-02","year":2026,"title":"n8n — Rce (CVE-2026-27498)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27498"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27498"},{"id":"INC-01718","date":"2026-02","year":2026,"title":"Qdrant — Vulnerability (CVE-2026-25628)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25628"],"affected":"qdrant/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25628"},{"id":"INC-01445","date":"2026-02","year":2026,"title":"Milvus — Auth Bypass (CVE-2026-26190)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26190"],"affected":"milvus/milvus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26190"},{"id":"INC-01569","date":"2026-02","year":2026,"title":"Open WebUI — Xss (CVE-2026-26192)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26192"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26192"},{"id":"INC-01570","date":"2026-02","year":2026,"title":"Open WebUI — Xss (CVE-2026-26193)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26193"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26193"},{"id":"INC-01884","date":"2026-02","year":2026,"title":"The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1777","CVE-2026-1778"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1777"},{"id":"INC-00022","date":"2026-02","year":2026,"title":"A vulnerability in Google Cloud Vertex AI Workbench from 7/21/2025 to 01/30/2026 allows an attacker to exfiltrate valid Google Cloud access tokens of other users via abuse of a ...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-2244"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2244"},{"id":"INC-01215","date":"2026-02","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: rust_binder: correctly handle FDA objects of length zero Fix a bug where an empty FDA (fd array) object wit...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23194"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23194"},{"id":"INC-01453","date":"2026-02","year":2026,"title":"Missing Authorization vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Exploiting Incorrectly Configured Access Control...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25338"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25338"},{"id":"INC-01087","date":"2026-02","year":2026,"title":"ggml-org llama — Vulnerability (CVE-2026-2069)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-2069"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2069"},{"id":"INC-09401","date":"2026-02","year":2026,"title":"@langchain/langgraph-checkpoint-redis — Auth Bypass (CVE-2026-27022)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27022"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27022"},{"id":"INC-09359","date":"2026-02","year":2026,"title":"LangGraph Checkpoint defines the base interface for LangGraph checkpointers.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27794"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27794"},{"id":"INC-09846","date":"2026-02","year":2026,"title":"Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-3172"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3172"},{"id":"INC-09847","date":"2026-02","year":2026,"title":"AutoGPT — Ssrf (CVE-2025-62615)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62615"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62615"},{"id":"INC-09848","date":"2026-02","year":2026,"title":"AutoGPT — Vulnerability (CVE-2026-22038)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22038"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22038"},{"id":"INC-09849","date":"2026-02","year":2026,"title":"AutoGPT — Rce (CVE-2026-26020)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26020"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26020"},{"id":"INC-09850","date":"2026-02","year":2026,"title":"An authentication bypass vulnerability has been found in Thesamur's AutoGPT.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-41023"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-41023"},{"id":"INC-14203","date":"2026-02","year":2026,"title":"OpenClaw — Command Injection (CVE-2026-25157)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25157"],"affected":"openclaw/openclaw, apple/macos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25157"},{"id":"INC-14204","date":"2026-02","year":2026,"title":"OpenClaw — Command Injection (CVE-2026-25593)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25593"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25593"},{"id":"INC-09399","date":"2026-02","year":2026,"title":"OpenClaw — Deepfake (CVE-2026-27003)","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27003"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27003"},{"id":"INC-09398","date":"2026-02","year":2026,"title":"OpenClaw — Vulnerability (CVE-2026-27004)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27004"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27004"},{"id":"INC-09384","date":"2026-02","year":2026,"title":"OpenClaw — Vulnerability (CVE-2026-27484)","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27484","CVE-2026-27485","CVE-2026-27488","CVE-2026-27576"],"affected":"openclaw/openclaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27484"},{"id":"INC-09338","date":"2026-02","year":2026,"title":"PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28338"],"affected":"maven/net.sourceforge.pmd:pmd-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28338"},{"id":"INC-09339","date":"2026-02","year":2026,"title":"osctrl is Vulnerable to OS Command Injection via Environment Configuration","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-28279"],"affected":"go/github.com/jmpsec/osctrl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28279"},{"id":"INC-09340","date":"2026-02","year":2026,"title":"Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28208"],"affected":"maven/com.github.junrar:junrar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28208"},{"id":"INC-09342","date":"2026-02","year":2026,"title":"Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27734"],"affected":"go/github.com/henrygd/beszel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27734"},{"id":"INC-09343","date":"2026-02","year":2026,"title":"@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27638"],"affected":"npm/@actual-app/sync-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27638"},{"id":"INC-09344","date":"2026-02","year":2026,"title":"Angular i18n vulnerable to Cross-Site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27970"],"affected":"npm/@angular/core, npm/@angular/core, npm/@angular/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27970"},{"id":"INC-09345","date":"2026-02","year":2026,"title":"n8n has Webhook Forgery on Zendesk Trigger Node","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-38c7-23hj-2wgq"},{"id":"INC-09346","date":"2026-02","year":2026,"title":"n8n has a Guardrail Node Bypass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fvfv-ppw4-7h2w"},{"id":"INC-09348","date":"2026-02","year":2026,"title":"fast-xml-parser has stack overflow in XMLBuilder with preserveOrder","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27942"],"affected":"npm/fast-xml-parser, npm/fast-xml-parser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27942"},{"id":"INC-09349","date":"2026-02","year":2026,"title":"Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27901","CVE-2026-27902"],"affected":"npm/svelte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27902"},{"id":"INC-09350","date":"2026-02","year":2026,"title":"WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27899"],"affected":"go/github.com/h44z/wg-portal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27899"},{"id":"INC-09351","date":"2026-02","year":2026,"title":"MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27896"],"affected":"go/github.com/modelcontextprotocol/go-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27896"},{"id":"INC-09352","date":"2026-02","year":2026,"title":"Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27465"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27465"},{"id":"INC-09353","date":"2026-02","year":2026,"title":"Fleet: Authorization Bypass in certificate template batch deletion for team administrators","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25963"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25963"},{"id":"INC-09354","date":"2026-02","year":2026,"title":"Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24004"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24004"},{"id":"INC-09355","date":"2026-02","year":2026,"title":"Fleet: Device lock PIN can be predicted if lock time is known","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-23999"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23999"},{"id":"INC-09357","date":"2026-02","year":2026,"title":"Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27808"],"affected":"go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27808"},{"id":"INC-09358","date":"2026-02","year":2026,"title":"Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27607","CVE-2026-27822"],"affected":"rust/rustfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27822"},{"id":"INC-09360","date":"2026-02","year":2026,"title":"esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27730"],"affected":"go/github.com/esm-dev/esm.sh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27730"},{"id":"INC-09361","date":"2026-02","year":2026,"title":"Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27116","CVE-2026-27616"],"affected":"go/code.vikunja.io/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27616"},{"id":"INC-09362","date":"2026-02","year":2026,"title":"Astro has memory exhaustion DoS due to missing request body size limit in Server Actions","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27729"],"affected":"npm/@astrojs/node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27729"},{"id":"INC-09363","date":"2026-02","year":2026,"title":"zae-limiter: DynamoDB hot partition throttling enables per-entity Denial of Service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27695"],"affected":"pip/zae-limiter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27695"},{"id":"INC-09364","date":"2026-02","year":2026,"title":"Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-64501","CVE-2026-25136","CVE-2026-25733","CVE-2026-25734","CVE-2026-25735","CVE-2026-25736"],"affected":"pip/rucio-webui, pip/rucio-webui, pip/rucio-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25736"},{"id":"INC-09365","date":"2026-02","year":2026,"title":"Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27702"],"affected":"npm/budibase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27702"},{"id":"INC-09366","date":"2026-02","year":2026,"title":"OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24005"],"affected":"go/github.com/openkruise/kruise, go/github.com/openkruise/kruise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24005"},{"id":"INC-09367","date":"2026-02","year":2026,"title":"TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27621"],"affected":"composer/typicms/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27621"},{"id":"INC-09368","date":"2026-02","year":2026,"title":"Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27614"],"affected":"pip/bugsink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27614"},{"id":"INC-09369","date":"2026-02","year":2026,"title":"repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27612"],"affected":"npm/repostat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27612"},{"id":"INC-09370","date":"2026-02","year":2026,"title":"Fickling has safety check bypass via REDUCE+BUILD opcode sequence","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/fickling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mhc9-48gj-9gp3"},{"id":"INC-09371","date":"2026-02","year":2026,"title":"Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27598"],"affected":"go/github.com/dagu-org/dagu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27598"},{"id":"INC-09372","date":"2026-02","year":2026,"title":"Fickling: OBJ opcode call invisibility bypasses all safety checks","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/fickling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mxhj-88fx-4pcv"},{"id":"INC-09373","date":"2026-02","year":2026,"title":"Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27204"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27204"},{"id":"INC-09374","date":"2026-02","year":2026,"title":"Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27195"],"affected":"rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27195"},{"id":"INC-09375","date":"2026-02","year":2026,"title":"Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27587","CVE-2026-27588"],"affected":"go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27588"},{"id":"INC-09376","date":"2026-02","year":2026,"title":"Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27585"],"affected":"go/github.com/caddyserver/caddy/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27585"},{"id":"INC-09377","date":"2026-02","year":2026,"title":"ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27584"],"affected":"npm/@actual-app/sync-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27584"},{"id":"INC-09378","date":"2026-02","year":2026,"title":"MindsDB: Path Traversal in /api/files Leading to Remote Code Execution","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27483"],"affected":"pip/mindsdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27483"},{"id":"INC-09379","date":"2026-02","year":2026,"title":"Isso affected by Stored XSS via comment website field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27469"],"affected":"pip/isso","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27469"},{"id":"INC-09380","date":"2026-02","year":2026,"title":"ImageMagick's Security Policy Bypass through config/policy-secure.xml via \"fd handler\" leads to stdin/stdout access","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25797","CVE-2026-25965","CVE-2026-25966"],"affected":"nuget/Magick.NET-Q8-x86, nuget/Magick.NET-Q8-arm64, nuget/Magick.NET-Q8-OpenMP-x64","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25966"},{"id":"INC-09381","date":"2026-02","year":2026,"title":"Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56373"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56373"},{"id":"INC-09382","date":"2026-02","year":2026,"title":"Craft CMS has Stored XSS in Table Field via \"HTML\" Column Type","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27126"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27126"},{"id":"INC-09383","date":"2026-02","year":2026,"title":"yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-70058"],"affected":"npm/yapi-vendor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-70058"},{"id":"INC-09387","date":"2026-02","year":2026,"title":"fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25896"],"affected":"npm/fast-xml-parser, npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25896"},{"id":"INC-09388","date":"2026-02","year":2026,"title":"Dagu affected by unauthenticated RCE via inline DAG spec in default configuration","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/dagu-org/dagu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6qr9-g2xw-cw92"},{"id":"INC-09389","date":"2026-02","year":2026,"title":"Pannellum has a XSS vulnerability in hot spot attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27210"],"affected":"npm/pannellum","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27210"},{"id":"INC-09390","date":"2026-02","year":2026,"title":"Formwork Improperly Managed Privileges in User creation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27198"],"affected":"composer/getformwork/formwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27198"},{"id":"INC-09391","date":"2026-02","year":2026,"title":"Prototype pollution in swiper","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-27212"],"affected":"npm/swiper","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27212"},{"id":"INC-09392","date":"2026-02","year":2026,"title":"Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27120"],"affected":"swift/github.com/vapor/leaf-kit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27120"},{"id":"INC-09393","date":"2026-02","year":2026,"title":"Kata Container to Guest micro VM privilege escalation","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24834"],"affected":"go/github.com/kata-containers/kata-containers/src/runtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24834"},{"id":"INC-09394","date":"2026-02","year":2026,"title":"Svelte SSR does not validate dynamic element tag names in `<svelte:element>`","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27122"],"affected":"npm/svelte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27122"},{"id":"INC-09395","date":"2026-02","year":2026,"title":"Svelte affected by XSS in SSR `<option>` element","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27119"],"affected":"npm/svelte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27119"},{"id":"INC-14205","date":"2026-02","year":2026,"title":"Unauthorized npm publish of cline@2.3.0 with modified postinstall script","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/cline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9ppg-jx86-fqw7"},{"id":"INC-09396","date":"2026-02","year":2026,"title":"Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-27112"],"affected":"go/github.com/akuity/kargo, go/github.com/akuity/kargo, go/github.com/akuity/kargo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27112"},{"id":"INC-09397","date":"2026-02","year":2026,"title":"Fabric.js Affected by Stored XSS via SVG Export","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27013"],"affected":"npm/fabric","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27013"},{"id":"INC-09400","date":"2026-02","year":2026,"title":"Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-1669"],"affected":"pip/keras, pip/keras","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1669"},{"id":"INC-09402","date":"2026-02","year":2026,"title":"Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26318"],"affected":"npm/systeminformation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26318"},{"id":"INC-09403","date":"2026-02","year":2026,"title":"LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26990"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26990"},{"id":"INC-09404","date":"2026-02","year":2026,"title":"LibreNMS has a Stored XSS in Alert Rule","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26989","CVE-2026-27016"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26989"},{"id":"INC-09405","date":"2026-02","year":2026,"title":"Nokogiri does not check the return value from xmlC14NExecute","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wx95-c6cv-8532"},{"id":"INC-09406","date":"2026-02","year":2026,"title":"Ghost has a SQL injection in Content API","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26980"],"affected":"npm/ghost","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26980"},{"id":"INC-09409","date":"2026-02","year":2026,"title":"Jenkins has a stored XSS vulnerability in node offline cause description","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-27099"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27099"},{"id":"INC-09413","date":"2026-02","year":2026,"title":"fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26278"],"affected":"npm/fast-xml-parser, npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26278"},{"id":"INC-09414","date":"2026-02","year":2026,"title":"emp3r0r Affected by Concurrent Map Access DoS (panic/crash)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26201"],"affected":"go/github.com/jm33-m0/emp3r0r/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26201"},{"id":"INC-09415","date":"2026-02","year":2026,"title":"Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25500"],"affected":"rubygems/rack, rubygems/rack, rubygems/rack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25500"},{"id":"INC-09416","date":"2026-02","year":2026,"title":"Unauthenticated File Upload in Gogs","severity":"Medium","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25242"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25242"},{"id":"INC-09417","date":"2026-02","year":2026,"title":"Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25229"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25229"},{"id":"INC-09418","date":"2026-02","year":2026,"title":"Known affected by Account Takeover via Password Reset Token Leakage","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26273"],"affected":"composer/idno/known","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26273"},{"id":"INC-09419","date":"2026-02","year":2026,"title":"beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-26226"],"affected":"npm/beautiful-mermaid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26226"},{"id":"INC-09420","date":"2026-02","year":2026,"title":"Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26056"],"affected":"go/github.com/yokecd/yoke","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26056"},{"id":"INC-09421","date":"2026-02","year":2026,"title":"Unauthenticated Admission Webhook Endpoints in Yoke ATC","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26055"],"affected":"go/github.com/yokecd/yoke","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26055"},{"id":"INC-09422","date":"2026-02","year":2026,"title":"golang.org/x/net/html has a Quadratic Parsing Complexity issue","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47911"],"affected":"go/golang.org/x/net/html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47911"},{"id":"INC-09423","date":"2026-02","year":2026,"title":"webtransport-go: CloseWithError can block indefinitely","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21435"],"affected":"go/github.com/quic-go/webtransport-go","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21435"},{"id":"INC-09424","date":"2026-02","year":2026,"title":"Vikunja Vulnerable to XSS Via Task Preview","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25935"],"affected":"go/code.vikunja.io/api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25935"},{"id":"INC-09425","date":"2026-02","year":2026,"title":"Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-15481","CVE-2019-25317","CVE-2020-19825"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-25317"},{"id":"INC-09426","date":"2026-02","year":2026,"title":"Leaky JWTs in OpenMetadata exposing highly-privileged bot users","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-26010"],"affected":"maven/org.open-metadata:openmetadata-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26010"},{"id":"INC-09427","date":"2026-02","year":2026,"title":"Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21218"],"affected":"nuget/System.Security.Cryptography.Cose, nuget/System.Security.Cryptography.Cose,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21218"},{"id":"INC-09428","date":"2026-02","year":2026,"title":"cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-26007"],"affected":"pip/cryptography","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26007"},{"id":"INC-09429","date":"2026-02","year":2026,"title":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21531"],"affected":"pip/azure-ai-language-conversations-authoring","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21531"},{"id":"INC-09430","date":"2026-02","year":2026,"title":"cap-go/capacitor-native-biometric Authentication Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@capgo/capacitor-native-biometric","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vx5f-vmr6-32wf"},{"id":"INC-09431","date":"2026-02","year":2026,"title":"Cube Core is vulnerable to Denial of Service (DoS) via crafted request","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25957"],"affected":"npm/@cubejs-backend/server-core, npm/@cubejs-backend/server-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25957"},{"id":"INC-09432","date":"2026-02","year":2026,"title":"Cube Core is vulnerable to privilege escalation via a specially crafted request","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25958"],"affected":"npm/@cubejs-backend/server-core, npm/@cubejs-backend/server-core, npm/@cubejs-backend/server-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25958"},{"id":"INC-09433","date":"2026-02","year":2026,"title":"FUXA Unauthenticated Remote Arbitrary Scheduler Write","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25939"],"affected":"npm/fuxa-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25939"},{"id":"INC-09434","date":"2026-02","year":2026,"title":"File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25889","CVE-2026-25890"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25890"},{"id":"INC-09435","date":"2026-02","year":2026,"title":"Craft CMS: GraphQL Asset Mutation Privilege Escalation","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25497"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25497"},{"id":"INC-09437","date":"2026-02","year":2026,"title":"MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25904"],"affected":"pip/mcp-run-python","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25904"},{"id":"INC-09438","date":"2026-02","year":2026,"title":"xcode-mcp-server vulnerable to Command Injection","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2178"],"affected":"npm/xcode-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2178"},{"id":"INC-09439","date":"2026-02","year":2026,"title":"mcp-maigret vulnerable to command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2130"],"affected":"npm/mcp-maigret","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2130"},{"id":"INC-09440","date":"2026-02","year":2026,"title":"LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/authzed/spicedb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vhvq-fv9f-wh4q"},{"id":"INC-09441","date":"2026-02","year":2026,"title":"Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/phlex, rubygems/phlex, rubygems/phlex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w67g-2h6v-vjgq"},{"id":"INC-09442","date":"2026-02","year":2026,"title":"SCEditor has DOM XSS via emoticon URL/HTML injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25581"],"affected":"npm/sceditor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25581"},{"id":"INC-09443","date":"2026-02","year":2026,"title":"OpenSTAManager has a SQL Injection in the Prima Nota module","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24419"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24419"},{"id":"INC-09444","date":"2026-02","year":2026,"title":"OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24418"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24418"},{"id":"INC-09445","date":"2026-02","year":2026,"title":"Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24135"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24135"},{"id":"INC-09446","date":"2026-02","year":2026,"title":"Gogs user can update repository content with read-only permission","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23632"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23632"},{"id":"INC-09447","date":"2026-02","year":2026,"title":"OpenSTAManager has a SQL Injection in Scadenzario Print Template","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-69216"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69216"},{"id":"INC-09448","date":"2026-02","year":2026,"title":"OpenSTAManager has an OS Command Injection in P7M File Processing","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-69212"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69212"},{"id":"INC-09449","date":"2026-02","year":2026,"title":"Gogs Vulnerable to 2FA Bypass via Recovery Code","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-64175"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64175"},{"id":"INC-09450","date":"2026-02","year":2026,"title":"OpenCloud Affected by Public Link Exploit","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/opencloud-eu/opencloud, go/github.com/opencloud-eu/opencloud","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vf5j-r2hw-2hrw"},{"id":"INC-09451","date":"2026-02","year":2026,"title":"Unauthenticated Spree Commerce users can access all guest addresses","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25758"],"affected":"rubygems/spree_api, rubygems/spree_api, rubygems/spree_api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25758"},{"id":"INC-09452","date":"2026-02","year":2026,"title":"Unauthenticated Spree Commerce users can view completed guest orders by Order ID","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25757"],"affected":"rubygems/spree_storefront, rubygems/spree_storefront, rubygems/spree_storefront","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25757"},{"id":"INC-09453","date":"2026-02","year":2026,"title":"NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25732"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25732"},{"id":"INC-09454","date":"2026-02","year":2026,"title":"NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25516"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25516"},{"id":"INC-09455","date":"2026-02","year":2026,"title":"FUXA Unauthenticated Remote Arbitrary Device Tag Write","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-25751","CVE-2026-25752"],"affected":"npm/fuxa-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25752"},{"id":"INC-09456","date":"2026-02","year":2026,"title":"EVE Doesn't Protect Config Partition with Measured Boot","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-43634"],"affected":"go/github.com/lf-edge/eve","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43634"},{"id":"INC-09457","date":"2026-02","year":2026,"title":"EVE's Debug Functions Unlockable Without Triggering Measured Boot","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-43631","CVE-2023-43633"],"affected":"go/github.com/lf-edge/eve","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43633"},{"id":"INC-09458","date":"2026-02","year":2026,"title":"EVE Doesn't Measure Config Partition From 2 Fronts","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-43630"],"affected":"go/github.com/lf-edge/eve","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43630"},{"id":"INC-09459","date":"2026-02","year":2026,"title":"Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-25538"],"affected":"go/github.com/devtron-labs/devtron","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25538"},{"id":"INC-09460","date":"2026-02","year":2026,"title":"Alist vulnerable to Path Traversal in multiple file operation handlers","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25161"],"affected":"go/github.com/alist-org/alist/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25161"},{"id":"INC-09461","date":"2026-02","year":2026,"title":"Alist has Insecure TLS Config","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25160"],"affected":"go/github.com/alist-org/alist/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25160"},{"id":"INC-09462","date":"2026-02","year":2026,"title":"Navidrome has XSS via comment from song metadata","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25578"],"affected":"go/github.com/navidrome/navidrome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25578"},{"id":"INC-09463","date":"2026-02","year":2026,"title":"melange affected by potential host command execution via license-check YAML mode patch pipeline","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25143"],"affected":"go/chainguard.dev/melange","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25143"},{"id":"INC-09464","date":"2026-02","year":2026,"title":"melange pipeline working-directory could allow command injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24844"],"affected":"go/chainguard.dev/melange","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24844"},{"id":"INC-09465","date":"2026-02","year":2026,"title":"Qwik SSR XSS via Unsafe Virtual Node Serialization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25148"],"affected":"npm/@builder.io/qwik-city","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25148"},{"id":"INC-09466","date":"2026-02","year":2026,"title":"OpenSTAManager has an SQL Injection in the Stampe Module","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-69215"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69215"},{"id":"INC-09467","date":"2026-02","year":2026,"title":"Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1664"],"affected":"npm/agents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1664"},{"id":"INC-09468","date":"2026-02","year":2026,"title":"FUXA contains an insecure default configuration vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-69970"],"affected":"npm/fuxa-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69970"},{"id":"INC-09469","date":"2026-02","year":2026,"title":"Apache Syncope: Console XXE on Keymaster parameters","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-23795"],"affected":"maven/org.apache.syncope.client.idrepo:syncope-client-idrepo-console, maven/org.apache.syncope.client.idrepo:syncope-cl…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23795"},{"id":"INC-09470","date":"2026-02","year":2026,"title":"Compressing Vulnerable to Arbitrary File Write via Symlink Extraction","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24884"],"affected":"npm/compressing, npm/compressing","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24884"},{"id":"INC-09472","date":"2026-02","year":2026,"title":"Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-70959","CVE-2025-70960"],"affected":"pip/tendenci","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-70959"},{"id":"INC-09473","date":"2026-02","year":2026,"title":"Magento's X-Original-Url header can expose admin url","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25523"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25523"},{"id":"INC-09474","date":"2026-02","year":2026,"title":"Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25482","CVE-2026-25483"],"affected":"composer/craftcms/commerce, composer/craftcms/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25483"},{"id":"INC-09475","date":"2026-02","year":2026,"title":"cert-manager-controller DoS via Specially Crafted DNS Response","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25518"],"affected":"go/github.com/cert-manager/cert-manager, go/github.com/cert-manager/cert-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25518"},{"id":"INC-09476","date":"2026-02","year":2026,"title":"picklescan vulnerable to arbitrary file create using logging.FileHandler","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53874"],"affected":"pip/picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m7j5-r2p5-c39r"},{"id":"INC-02815","date":"2026-02","year":2026,"title":"Langroid has WAF Bypass Leading to RCE in TableChatAgent","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2025-46724","CVE-2025-46725","CVE-2026-25481","CVE-2026-25879"],"affected":"pip/langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25481"},{"id":"INC-09477","date":"2026-02","year":2026,"title":"terraform-provider-proxmox has insecure sudo recommendation in the documentation","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25499"],"affected":"go/github.com/bpg/terraform-provider-proxmox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25499"},{"id":"INC-09478","date":"2026-02","year":2026,"title":"@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25153"],"affected":"npm/@backstage/plugin-techdocs-node, npm/@backstage/plugin-techdocs-node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25153"},{"id":"INC-09479","date":"2026-02","year":2026,"title":"OpenList has Insecure TLS Default Configuration","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25060"],"affected":"go/github.com/OpenListTeam/OpenList/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25060"},{"id":"INC-09480","date":"2026-02","year":2026,"title":"OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24051"],"affected":"go/go.opentelemetry.io/otel/sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24051"},{"id":"INC-09481","date":"2026-02","year":2026,"title":"OpenList vulnerable to Path Traversal in file copy and remove handlers","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-25059"],"affected":"go/github.com/OpenListTeam/OpenList/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25059"},{"id":"INC-09482","date":"2026-02","year":2026,"title":"jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24043"],"affected":"npm/jspdf","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24043"},{"id":"INC-09483","date":"2026-02","year":2026,"title":"FacturaScripts has Stored Cross-Site Scripting (XSS) in \"Observations\" field via History View","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-23997"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23997"},{"id":"INC-09484","date":"2026-02","year":2026,"title":"FacturaScripts is Vulnerable to Reflected XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-23476"],"affected":"composer/facturascripts/facturascripts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23476"},{"id":"INC-09485","date":"2026-02","year":2026,"title":"Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-69207"],"affected":"pip/khoj","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69207"},{"id":"INC-09486","date":"2026-02","year":2026,"title":"@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25152"],"affected":"npm/@backstage/plugin-techdocs-node, npm/@backstage/plugin-techdocs-node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25152"},{"id":"INC-09487","date":"2026-02","year":2026,"title":"Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-0599"],"affected":"pip/text-generation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0599"},{"id":"INC-09488","date":"2026-02","year":2026,"title":"Lollms has an Improper Access Control vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-1117"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1117"},{"id":"INC-09489","date":"2026-02","year":2026,"title":"LobeHub Vulnerable to Improper Authorization in Presigned Upload","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23835"],"affected":"npm/@lobehub/chat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23835"},{"id":"INC-00631","date":"2026-01","year":2026,"title":"AnythingLLM — Vulnerability (CVE-2026-21484)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21484"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21484"},{"id":"INC-00893","date":"2026-01","year":2026,"title":"Dify — Vulnerability (CVE-2025-67732)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-67732"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67732"},{"id":"INC-01191","date":"2026-01","year":2026,"title":"In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Quer...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62327"],"affected":"hcltechsw/hcl_devops_deploy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62327"},{"id":"INC-01345","date":"2026-01","year":2026,"title":"llama.cpp — Rce (CVE-2026-21869)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21869"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21869"},{"id":"INC-02088","date":"2026-01","year":2026,"title":"WeKnora — Info Disclosure (CVE-2026-22687)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-22687"],"affected":"tencent/weknora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22687"},{"id":"INC-01607","date":"2026-01","year":2026,"title":"OpenCode — Vulnerability (CVE-2026-22813)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22813"],"affected":"anoma/opencode","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22813"},{"id":"INC-01799","date":"2026-01","year":2026,"title":"SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65368"],"affected":"codewithcj/sparkyfitness","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65368"},{"id":"INC-00902","date":"2026-01","year":2026,"title":"Dive — Rce (CVE-2026-23523)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23523"],"affected":"openagentplatform/dive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23523"},{"id":"INC-00628","date":"2026-01","year":2026,"title":"AnythingLLM — Path Traversal (CVE-2026-24478)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24478"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24478"},{"id":"INC-02052","date":"2026-01","year":2026,"title":"vLLM — Vulnerability (CVE-2026-22773)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22773"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22773"},{"id":"INC-01803","date":"2026-01","year":2026,"title":"SQLBot — Auth Bypass (CVE-2025-69285)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-69285"],"affected":"fit2cloud/sqlbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69285"},{"id":"INC-01310","date":"2026-01","year":2026,"title":"Langfuse — Vulnerability (CVE-2026-24055)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24055"],"affected":"langfuse/langfuse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24055"},{"id":"INC-01299","date":"2026-01","year":2026,"title":"Langflow — Auth Bypass (CVE-2026-21445)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-21445"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21445"},{"id":"INC-01606","date":"2026-01","year":2026,"title":"OpenCode — Vulnerability (CVE-2026-22812)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22812"],"affected":"anoma/opencode","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22812"},{"id":"INC-00938","date":"2026-01","year":2026,"title":"Enclave — Sandbox Escape (CVE-2026-22686)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22686"],"affected":"agentfront/enclave","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22686"},{"id":"INC-00868","date":"2026-01","year":2026,"title":"Cursor — Prompt Injection (CVE-2026-22708)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-22708"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22708"},{"id":"INC-00758","date":"2026-01","year":2026,"title":"ChatterMate — Vulnerability (CVE-2026-24399)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24399"],"affected":"chattermate/chattermate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24399"},{"id":"INC-01890","date":"2026-01","year":2026,"title":"The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to,...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-13374"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13374"},{"id":"INC-01437","date":"2026-01","year":2026,"title":"Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-9611"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9611"},{"id":"INC-00003","date":"2026-01","year":2026,"title":"@sylphxltd/filesystem-mcp v0.5.8 — Path Traversal (CVE-2025-67366)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67366"],"affected":"sylphx/filesystem-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67366"},{"id":"INC-00013","date":"2026-01","year":2026,"title":"A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66689"],"affected":"busymac/pal_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66689"},{"id":"INC-01611","date":"2026-01","year":2026,"title":"orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22785"],"affected":"orval/orval","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22785"},{"id":"INC-00002","date":"2026-01","year":2026,"title":"5ire — Rce (CVE-2026-22792)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22792","CVE-2026-22793"],"affected":"5ire/5ire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22792"},{"id":"INC-01552","date":"2026-01","year":2026,"title":"Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15063"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15063"},{"id":"INC-00583","date":"2026-01","year":2026,"title":"An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66959","CVE-2025-66960"],"affected":"ollama/ollama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66959"},{"id":"INC-01885","date":"2026-01","year":2026,"title":"The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' parameter of the 'autogen_menu' shortcode in all versions up to, ...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-13704"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13704"},{"id":"INC-01184","date":"2026-01","year":2026,"title":"Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21521"],"affected":"microsoft/365_word_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21521"},{"id":"INC-01190","date":"2026-01","year":2026,"title":"Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24307"],"affected":"microsoft/365_copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24307"},{"id":"INC-01493","date":"2026-01","year":2026,"title":"n8n — Vulnerability (CVE-2026-21877)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21877"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21877"},{"id":"INC-01473","date":"2026-01","year":2026,"title":"n8n — Auth Bypass (CVE-2026-21894)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-21894"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21894"},{"id":"INC-01472","date":"2026-01","year":2026,"title":"n8n — Auth Bypass (CVE-2025-68949)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-68949"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68949"},{"id":"INC-02035","date":"2026-01","year":2026,"title":"Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlyi...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0863"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0863"},{"id":"INC-01470","date":"2026-01","year":2026,"title":"n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-1470"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1470"},{"id":"INC-00582","date":"2026-01","year":2026,"title":"An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-67303"],"affected":"comfy/comfyui-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67303"},{"id":"INC-00846","date":"2026-01","year":2026,"title":"ComfyUI-Manager — Vulnerability (CVE-2026-22777)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22777"],"affected":"comfy/comfyui-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22777"},{"id":"INC-14612","date":"2026-01","year":2026,"title":"The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11972","CVE-2025-13354","CVE-2025-13359","CVE-2025-13922","CVE-2025-14371"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14371"},{"id":"INC-01583","date":"2026-01","year":2026,"title":"OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-65805"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65805"},{"id":"INC-01582","date":"2026-01","year":2026,"title":"OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66786"],"affected":"openairinterface/oai-cn5g-amf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66786"},{"id":"INC-14613","date":"2026-01","year":2026,"title":"The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-14980"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14980"},{"id":"INC-01924","date":"2026-01","year":2026,"title":"Typebot — Data Exfiltration (CVE-2025-65098)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-65098"],"affected":"typebot/typebot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65098"},{"id":"INC-01381","date":"2026-01","year":2026,"title":"MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0757"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0757"},{"id":"INC-01329","date":"2026-01","year":2026,"title":"LibreChat — Auth Bypass (CVE-2025-69220)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-69220","CVE-2025-69221","CVE-2025-69222"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69220"},{"id":"INC-00757","date":"2026-01","year":2026,"title":"ChatterBot — Dos (CVE-2026-23842)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23842"],"affected":"chatterbot/chatterbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23842"},{"id":"INC-01343","date":"2026-01","year":2026,"title":"Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25211"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25211"},{"id":"INC-09866","date":"2026-01","year":2026,"title":"Langflow code Code Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0768"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0768"},{"id":"INC-09867","date":"2026-01","year":2026,"title":"Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0769"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0769"},{"id":"INC-09868","date":"2026-01","year":2026,"title":"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0770"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0770"},{"id":"INC-09869","date":"2026-01","year":2026,"title":"Langflow PythonFunction Code Injection Remote Code Execution Vulnerability.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0771"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0771"},{"id":"INC-09870","date":"2026-01","year":2026,"title":"Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0772"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0772"},{"id":"INC-09871","date":"2026-01","year":2026,"title":"In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ks...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68809"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68809"},{"id":"INC-09872","date":"2026-01","year":2026,"title":"AutoGPT — Rce (CVE-2026-24780)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24780"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24780"},{"id":"INC-09873","date":"2026-01","year":2026,"title":"Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0760"],"affected":"deepwisdom/metagpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0760"},{"id":"INC-09874","date":"2026-01","year":2026,"title":"Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0761"],"affected":"deepwisdom/metagpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0761"},{"id":"INC-09553","date":"2026-01","year":2026,"title":"Label Studio — Xss (CVE-2026-22033)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-43791","CVE-2023-47115","CVE-2023-47116","CVE-2023-47117","CVE-2024-23633","CVE-2024-26152","CVE-2025-25296","CVE-2025-25297","CVE-2025-47783","CVE-2026-22033"],"affected":"humansignal/label_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22033"},{"id":"INC-09490","date":"2026-01","year":2026,"title":"Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62348"],"affected":"pip/salt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62348"},{"id":"INC-09491","date":"2026-01","year":2026,"title":"CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-25130"],"affected":"pip/cai-framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25130"},{"id":"INC-09492","date":"2026-01","year":2026,"title":"fast-xml-parser has RangeError DoS Numeric Entities Bug","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25128"],"affected":"npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25128"},{"id":"INC-09493","date":"2026-01","year":2026,"title":"deepHas vulnerable to Prototype Pollution via constructor.prototype","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-25047"],"affected":"npm/deephas","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25047"},{"id":"INC-09494","date":"2026-01","year":2026,"title":"NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24768"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24768"},{"id":"INC-09495","date":"2026-01","year":2026,"title":"NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24769"],"affected":"npm/nocodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24769"},{"id":"INC-09496","date":"2026-01","year":2026,"title":"EGroupware has SQL Injection in Nextmatch Filter Processing","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22243"],"affected":"composer/egroupware/egroupware, composer/egroupware/egroupware","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22243"},{"id":"INC-09497","date":"2026-01","year":2026,"title":"TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"pip/agentos-taskweaver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gpx9-96j6-pp87"},{"id":"INC-09498","date":"2026-01","year":2026,"title":"StudioCMS has Authorization Bypass Through User-Controlled Key","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-24134"],"affected":"npm/studiocms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24134"},{"id":"INC-09499","date":"2026-01","year":2026,"title":"askbot inexhaustive permissions check allows any user to modify a different user's profile picture","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1213"],"affected":"pip/askbot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1213"},{"id":"INC-09500","date":"2026-01","year":2026,"title":"Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-24740"],"affected":"go/github.com/amir20/dozzle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24740"},{"id":"INC-09501","date":"2026-01","year":2026,"title":"MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-24490"],"affected":"pip/mobsf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24490"},{"id":"INC-09502","date":"2026-01","year":2026,"title":"Gakido vulnerable to HTTP Header Injection (CRLF Injection)","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24489"],"affected":"pip/gakido","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24489"},{"id":"INC-09503","date":"2026-01","year":2026,"title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-46984","CVE-2026-24400"],"affected":"maven/org.assertj:assertj-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24400"},{"id":"INC-09504","date":"2026-01","year":2026,"title":"LavaLite CMS affected by a stored cross-site scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-71177"],"affected":"composer/lavalite/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71177"},{"id":"INC-09505","date":"2026-01","year":2026,"title":"Gitea does not properly validate project ownership in organization project operations","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-20750"],"affected":"go/github.com/go-gitea/gitea","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-20750"},{"id":"INC-09506","date":"2026-01","year":2026,"title":"Incus container environment configuration newline injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23953"],"affected":"go/github.com/lxc/incus/v6","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23953"},{"id":"INC-09507","date":"2026-01","year":2026,"title":"SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/surrealdb, rust/surrealdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3v2x-9xcv-2v2v"},{"id":"INC-09508","date":"2026-01","year":2026,"title":"Dragonfly Manager Job API Unauthenticated Access","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24124"],"affected":"go/d7y.io/dragonfly/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24124"},{"id":"INC-09509","date":"2026-01","year":2026,"title":"Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24049"],"affected":"pip/wheel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24049"},{"id":"INC-09510","date":"2026-01","year":2026,"title":"docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24009"],"affected":"pip/docling-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24009"},{"id":"INC-09511","date":"2026-01","year":2026,"title":"Wrangler affected by OS Command Injection in `wrangler pages deploy`","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0933"],"affected":"npm/wrangler, npm/wrangler","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0933"},{"id":"INC-09512","date":"2026-01","year":2026,"title":"Triton VM has a Soundness Vulnerability due to Improper Sampling of Randomness","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/triton-vm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rjr4-v43m-pxq6"},{"id":"INC-09513","date":"2026-01","year":2026,"title":"Argo Workflows affected by stored XSS in the artifact directory listing","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23960"],"affected":"go/github.com/argoproj/argo-workflows, go/github.com/argoproj/argo-workflows/v3,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23960"},{"id":"INC-09514","date":"2026-01","year":2026,"title":"sm-crypto Affected by Signature Forgery in SM2-DSA","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23965"],"affected":"npm/sm-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23965"},{"id":"INC-09515","date":"2026-01","year":2026,"title":"sm-crypto Affected by Signature Malleability in SM2-DSA","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23967"],"affected":"npm/sm-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23967"},{"id":"INC-09516","date":"2026-01","year":2026,"title":"sm-crypto Affected by Private Key Recovery in SM2-PKE","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23966"],"affected":"npm/sm-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23966"},{"id":"INC-09517","date":"2026-01","year":2026,"title":"CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-23959"],"affected":"composer/coreshop/core-shop","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23959"},{"id":"INC-09518","date":"2026-01","year":2026,"title":"Apache Solr: Insufficient file-access checking in standalone core-creation requests","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22444"],"affected":"maven/org.apache.solr:solr-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22444"},{"id":"INC-09519","date":"2026-01","year":2026,"title":"ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/Magick.NET-Q16-HDRI-AnyCPU, nuget/Magick.NET-Q16-AnyCPU, nuget/Magick.NET-Q8-AnyCPU","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qp59-x883-77qv"},{"id":"INC-09520","date":"2026-01","year":2026,"title":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23950"],"affected":"npm/tar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950"},{"id":"INC-09521","date":"2026-01","year":2026,"title":"SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-23851"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23851"},{"id":"INC-09522","date":"2026-01","year":2026,"title":"Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-23829","CVE-2026-23845"],"affected":"go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23845"},{"id":"INC-09523","date":"2026-01","year":2026,"title":"Orval has a code injection via unsanitized x-enum-descriptions in enum generation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23947"],"affected":"npm/@orval/core, npm/@orval/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23947"},{"id":"INC-09524","date":"2026-01","year":2026,"title":"SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23847"],"affected":"go/github.com/siyuan-note/siyuan/kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23847"},{"id":"INC-09525","date":"2026-01","year":2026,"title":"Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23518"],"affected":"go/github.com/fleetdm/fleet, go/github.com/fleetdm/fleet, go/github.com/fleetdm/fleet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23518"},{"id":"INC-09526","date":"2026-01","year":2026,"title":"Fleet has an Access Control vulnerability in debug/pprof endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-23517"],"affected":"go/github.com/fleetdm/fleet/v4, go/github.com/fleetdm/fleet, go/github.com/fleetdm/fleet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23517"},{"id":"INC-09527","date":"2026-01","year":2026,"title":"Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22808"],"affected":"go/github.com/fleetdm/fleet/v4, go/github.com/fleetdm/fleet, go/github.com/fleetdm/fleet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22808"},{"id":"INC-09528","date":"2026-01","year":2026,"title":"Turbo Frame responses can restore stale session cookies","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66803"],"affected":"npm/@hotwired/turbo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66803"},{"id":"INC-09529","date":"2026-01","year":2026,"title":"XDocReport affected by an XML External Entity (XXE) vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65482"],"affected":"maven/fr.opensagres.xdocreport:fr.opensagres.xdocreport.document","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65482"},{"id":"INC-09530","date":"2026-01","year":2026,"title":"Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-23733"],"affected":"npm/@lobehub/chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23733"},{"id":"INC-09531","date":"2026-01","year":2026,"title":"Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23522"],"affected":"npm/@lobehub/chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23522"},{"id":"INC-09532","date":"2026-01","year":2026,"title":"Kimai has an Authenticated Server-Side Template Injection (SSTI)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-23626"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23626"},{"id":"INC-09533","date":"2026-01","year":2026,"title":"@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22037"],"affected":"npm/@fastify/express","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22037"},{"id":"INC-09534","date":"2026-01","year":2026,"title":"Apache Linkis: Password Exposure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-59355"],"affected":"maven/org.apache.linkis:linkis-metadata","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59355"},{"id":"INC-09535","date":"2026-01","year":2026,"title":"Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/@veramo/data-store","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-38cw-85xc-xr9x"},{"id":"INC-09536","date":"2026-01","year":2026,"title":"svelte is vulnerable to XSS with textarea bind:value","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/svelte","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gw32-9rmw-qwww"},{"id":"INC-09537","date":"2026-01","year":2026,"title":"Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-26216","CVE-2026-26217"],"affected":"pip/Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26216"},{"id":"INC-09538","date":"2026-01","year":2026,"title":"Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-15104"],"affected":"npm/vnu-jar, maven/nu.validator:validator","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15104"},{"id":"INC-09539","date":"2026-01","year":2026,"title":"PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0858"],"affected":"maven/net.sourceforge.plantuml:plantuml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0858"},{"id":"INC-09540","date":"2026-01","year":2026,"title":"solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45046"],"affected":"composer/solspace/craft-freeform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-44jg-mv3h-wj6g"},{"id":"INC-09541","date":"2026-01","year":2026,"title":"Vert.x Web static handler component cache can be manipulated to deny the access to static files","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1002"],"affected":"maven/io.vertx:vertx-core, maven/io.vertx:vertx-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1002"},{"id":"INC-09542","date":"2026-01","year":2026,"title":"svelte vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15265"],"affected":"npm/svelte","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15265"},{"id":"INC-09543","date":"2026-01","year":2026,"title":"alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23622"],"affected":"composer/alextselegidis/easyappointments","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23622"},{"id":"INC-09544","date":"2026-01","year":2026,"title":"Pimcore Web2Print Tools Bundle \"Favourite Output Channel Configuration\" Missing Function Level Authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-23496"],"affected":"composer/pimcore/web2print-tools-bundle, composer/pimcore/web2print-tools-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23496"},{"id":"INC-09545","date":"2026-01","year":2026,"title":"Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/algolia/algoliasearch-magento-2, composer/algolia/algoliasearch-magento-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-595p-g7xc-c333"},{"id":"INC-09546","date":"2026-01","year":2026,"title":"html2pdf.js contains a cross-site scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22787"],"affected":"npm/html2pdf.js","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22787"},{"id":"INC-09547","date":"2026-01","year":2026,"title":"BlackSheep's ClientSession is vulnerable to CRLF injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22779"],"affected":"pip/blacksheep","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22779"},{"id":"INC-09548","date":"2026-01","year":2026,"title":"Quill is vulnerable to XSS via HTML export feature","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15056"],"affected":"npm/quill","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15056"},{"id":"INC-09549","date":"2026-01","year":2026,"title":"TYPO3 CMS Allows Broken Access Control in Redirects Module","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59021"],"affected":"composer/typo3/cms-redirects, composer/typo3/cms-redirects, composer/typo3/cms-redirects","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59021"},{"id":"INC-09550","date":"2026-01","year":2026,"title":"Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/renovate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3f44-xw83-3pmg"},{"id":"INC-09551","date":"2026-01","year":2026,"title":"Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/renovate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xjr7-3c3g-m763"},{"id":"INC-09552","date":"2026-01","year":2026,"title":"Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/renovate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-36j9-mx87-2cff"},{"id":"INC-09875","date":"2026-01","year":2026,"title":"Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/renovate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pfq2-hh62-7m96"},{"id":"INC-09876","date":"2026-01","year":2026,"title":"Envoy Extension Policy lua scripts injection causes arbitrary command execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22771"],"affected":"go/github.com/envoyproxy/gateway, go/github.com/envoyproxy/gateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22771"},{"id":"INC-09877","date":"2026-01","year":2026,"title":"Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-22689"],"affected":"go/github.com/axllent/mailpit, go/github.com/axllent/mailpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22689"},{"id":"INC-09878","date":"2026-01","year":2026,"title":"RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22700"],"affected":"rust/sm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22700"},{"id":"INC-09879","date":"2026-01","year":2026,"title":"Apache Struts 2 is Missing XML Validation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68493"],"affected":"maven/org.apache.struts.xwork:xwork-core, maven/com.opensymphony:xwork, maven/org.apache.struts:struts2-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68493"},{"id":"INC-09880","date":"2026-01","year":2026,"title":"SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22699"],"affected":"rust/sm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22699"},{"id":"INC-09881","date":"2026-01","year":2026,"title":"SM2-PKE has 32-bit Biased Nonce Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22698"],"affected":"rust/sm2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22698"},{"id":"INC-09882","date":"2026-01","year":2026,"title":"Fickling Blocklist Bypass: cProfile.run()","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67748","CVE-2026-22606","CVE-2026-22607"],"affected":"pip/fickling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22607"},{"id":"INC-09883","date":"2026-01","year":2026,"title":"jose-swift has JWT Signature Verification Bypass via None Algorithm","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"swift/github.com/beatt83/jose-swift","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-88q6-jcjg-hvmw"},{"id":"INC-09884","date":"2026-01","year":2026,"title":"Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22588"],"affected":"rubygems/spree_api, rubygems/spree_api, rubygems/spree_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22588"},{"id":"INC-09885","date":"2026-01","year":2026,"title":"Salvo is vulnerable to reflected XSS in the list_html function","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22256","CVE-2026-22257"],"affected":"rust/salvo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22256"},{"id":"INC-09886","date":"2026-01","year":2026,"title":"NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21871","CVE-2026-21872","CVE-2026-21873"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21873"},{"id":"INC-09887","date":"2026-01","year":2026,"title":"Bio-Formats has an XML External Entity (XXE) vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22186"],"affected":"maven/ome:pom-bio-formats","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22186"},{"id":"INC-09888","date":"2026-01","year":2026,"title":"OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-22244"],"affected":"maven/org.open-metadata:platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22244"},{"id":"INC-09889","date":"2026-01","year":2026,"title":"CoreShop Vulnerable to SQL Injection via Admin Reports","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22242"],"affected":"composer/coreshop/core-shop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22242"},{"id":"INC-09890","date":"2026-01","year":2026,"title":"Preact has JSON VNode Injection issue","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-22028"],"affected":"npm/preact, npm/preact, npm/preact","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22028"},{"id":"INC-09891","date":"2026-01","year":2026,"title":"pnpm v10+ Bypass \"Dependency lifecycle scripts execution disabled by default\"","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-69264"],"affected":"npm/pnpm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69264"},{"id":"INC-09892","date":"2026-01","year":2026,"title":"terminal-controller-mcp vulnerable to Command Injection","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61492"],"affected":"pip/terminal-controller","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61492"},{"id":"INC-09893","date":"2026-01","year":2026,"title":"Directus has open redirect in SAML","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-22032"],"affected":"npm/@directus/api, npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22032"},{"id":"INC-09894","date":"2026-01","year":2026,"title":"Bypassing Kyverno Policies via Double Policy Exceptions","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/kyverno/kyverno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gg4x-fgg2-h9w9"},{"id":"INC-09895","date":"2026-01","year":2026,"title":"Bokeh server applications have Incomplete Origin Validation in WebSockets","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21883"],"affected":"pip/bokeh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21883"},{"id":"INC-09896","date":"2026-01","year":2026,"title":"MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21851"],"affected":"pip/monai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21851"},{"id":"INC-09897","date":"2026-01","year":2026,"title":"Pterodactyl TOTPs can be reused during validity window","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-69197"],"affected":"composer/pterodactyl/panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69197"},{"id":"INC-09898","date":"2026-01","year":2026,"title":"`vega-functions` vulnerable to Cross-site Scripting via `setdata` function","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66648"],"affected":"npm/vega-functions","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66648"},{"id":"INC-09899","date":"2026-01","year":2026,"title":"Apache SIS has Improper Restriction of XML External Entity Reference vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68280"],"affected":"maven/org.apache.sis.core:sis-metadata","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68280"},{"id":"INC-09900","date":"2026-01","year":2026,"title":"MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21452"],"affected":"maven/org.msgpack:msgpack-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21452"},{"id":"INC-09901","date":"2026-01","year":2026,"title":"Vaadin vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15022"],"affected":"maven/com.vaadin:vaadin-spreadsheet-flow, maven/com.vaadin:vaadin-spreadsheet-flow,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15022"},{"id":"INC-09902","date":"2026-01","year":2026,"title":"listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-21483"],"affected":"go/github.com/knadh/listmonk, go/github.com/knadh/listmonk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21483"},{"id":"INC-09903","date":"2026-01","year":2026,"title":"Bagisto has HTML Filter Bypass that Enables Stored XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-21451"],"affected":"composer/bagisto/bagisto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21451"},{"id":"INC-09904","date":"2026-01","year":2026,"title":"Bagisto Missing Authentication on Installer API Endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21446"],"affected":"composer/bagisto/bagisto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21446"},{"id":"INC-09905","date":"2026-01","year":2026,"title":"Duplicate Advisory: Reflected XSS in go-httpbin due to unrestricted client control over Content-Type","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/mccutchen/go-httpbin, go/github.com/mccutchen/go-httpbin/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p4f6-h8jj-vfvf"},{"id":"INC-09906","date":"2026-01","year":2026,"title":"Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68272"],"affected":"npm/signalk-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68272"},{"id":"INC-09907","date":"2026-01","year":2026,"title":"Feast vulnerable to Deserialization of Untrusted Data","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11157"],"affected":"pip/feast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11157"},{"id":"INC-09908","date":"2026-01","year":2026,"title":"Malware in n8n-nodes-comfyui-illu","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/n8n-nodes-comfyui-illu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h3jq-3362-m28h"},{"id":"INC-09925","date":"2026-01","year":2026,"title":"Malware in weaviate-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/weaviate-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hwmx-j3gv-65mh"},{"id":"INC-09926","date":"2026-01","year":2026,"title":"Malware in qdrant-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/qdrant-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8p85-84qw-3m2v"},{"id":"INC-09927","date":"2026-01","year":2026,"title":"Malware in anthropic-sdk","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/anthropic-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j8wc-8p9m-6fm6"},{"id":"INC-09939","date":"2026-01","year":2026,"title":"Malware in llamaindex-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/llamaindex-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-675f-h4p7-2vp4"},{"id":"INC-09940","date":"2026-01","year":2026,"title":"Malware in milvus-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/milvus-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j947-h9rh-h2jr"},{"id":"INC-09942","date":"2026-01","year":2026,"title":"Malware in huggingface-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/huggingface-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5fpx-j295-mggf"},{"id":"INC-02487","date":"2025-12","year":2025,"title":"DeepChat — Xss (CVE-2025-66481)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66481"],"affected":"thinkinai/deepchat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66481"},{"id":"INC-02948","date":"2025-12","year":2025,"title":"Neuron — Prompt Injection (CVE-2025-67509)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-67509","CVE-2025-67510"],"affected":"neuron-ai/neuron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67509"},{"id":"INC-02722","date":"2025-12","year":2025,"title":"IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-14148"],"affected":"ibm/devops_deploy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14148"},{"id":"INC-02528","date":"2025-12","year":2025,"title":"Dive — Xss (CVE-2025-66580)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66580"],"affected":"openagentplatform/dive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66580"},{"id":"INC-02842","date":"2025-12","year":2025,"title":"LMDeploy — Deserialization (CVE-2025-67729)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67729"],"affected":"internlm/lmdeploy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67729"},{"id":"INC-02821","date":"2025-12","year":2025,"title":"Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-49642"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49642"},{"id":"INC-02872","date":"2025-12","year":2025,"title":"MCP Server Kubernetes — Prompt Injection (CVE-2025-66404)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-66404"],"affected":"suyogs/mcp-server-kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66404"},{"id":"INC-03271","date":"2025-12","year":2025,"title":"The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12189"],"affected":"breadbutter/bread_\\&_butter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12189"},{"id":"INC-02481","date":"2025-12","year":2025,"title":"Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-67511"],"affected":"aliasrobotics/cybersecurity_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67511"},{"id":"INC-02305","date":"2025-12","year":2025,"title":"An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-63390"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63390"},{"id":"INC-02807","date":"2025-12","year":2025,"title":"Langflow — Ssrf (CVE-2025-68477)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-68477"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68477"},{"id":"INC-02808","date":"2025-12","year":2025,"title":"Langflow — Vulnerability (CVE-2025-68478)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68478"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68478"},{"id":"INC-02755","date":"2025-12","year":2025,"title":"Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message histo...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-63664"],"affected":"gtedge/gt_edge_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63664"},{"id":"INC-02438","date":"2025-12","year":2025,"title":"Claude Code — Rce (CVE-2025-66032)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66032"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66032"},{"id":"INC-02876","date":"2025-12","year":2025,"title":"MCP Watch — Command Injection (CVE-2025-66401)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66401"],"affected":"kapilduraphe/mcp_watch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66401"},{"id":"INC-02875","date":"2025-12","year":2025,"title":"MCP TypeScript SDK — Vulnerability (CVE-2025-66414)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66414"],"affected":"lfprojects/mcp_typescript_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66414"},{"id":"INC-03286","date":"2025-12","year":2025,"title":"The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53365","CVE-2025-53366","CVE-2025-66416"],"affected":"lfprojects/mcp_python_sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66416"},{"id":"INC-02335","date":"2025-12","year":2025,"title":"Arcade MCP allows you to to create, deploy, and share MCP Servers.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-66454"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66454"},{"id":"INC-02738","date":"2025-12","year":2025,"title":"In Splunk MCP Server app versions below 0.2.4, a user with access to the \"run_splunk_query\" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in ...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-20381"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-20381"},{"id":"INC-02486","date":"2025-12","year":2025,"title":"DeepChat — Xss (CVE-2025-66222)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66222"],"affected":"thinkinai/deepchat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66222"},{"id":"INC-03295","date":"2025-12","year":2025,"title":"The Serverless Framework — Command Injection (CVE-2025-69256)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-69256"],"affected":"serverless/serverless","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69256"},{"id":"INC-03389","date":"2025-12","year":2025,"title":"Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68433"],"affected":"zed/zed","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68433"},{"id":"INC-02131","date":"2025-12","year":2025,"title":"5ire — Rce (CVE-2025-68669)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68669"],"affected":"5ire/5ire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68669"},{"id":"INC-02712","date":"2025-12","year":2025,"title":"Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14920"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14920"},{"id":"INC-02716","date":"2025-12","year":2025,"title":"Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14921"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14921"},{"id":"INC-02702","date":"2025-12","year":2025,"title":"Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14922"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14922"},{"id":"INC-02711","date":"2025-12","year":2025,"title":"Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14924"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14924"},{"id":"INC-02701","date":"2025-12","year":2025,"title":"Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14925"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14925"},{"id":"INC-02714","date":"2025-12","year":2025,"title":"Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14926"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14926"},{"id":"INC-02715","date":"2025-12","year":2025,"title":"Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14927"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14927"},{"id":"INC-02710","date":"2025-12","year":2025,"title":"Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14928"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14928"},{"id":"INC-02718","date":"2025-12","year":2025,"title":"Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14929"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14929"},{"id":"INC-02708","date":"2025-12","year":2025,"title":"Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14930"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14930"},{"id":"INC-02704","date":"2025-12","year":2025,"title":"Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-14931"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14931"},{"id":"INC-02741","date":"2025-12","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-53762"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-53762"},{"id":"INC-02751","date":"2025-12","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: kcm: Fix memory leak in error path of kcm_sendmsg() syzbot reported a memory leak like below: BUG: memory ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-54112"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-54112"},{"id":"INC-02763","date":"2025-12","year":2025,"title":"Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI C...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-62994","CVE-2025-62998"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62994"},{"id":"INC-02907","date":"2025-12","year":2025,"title":"Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: fr...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62116"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62116"},{"id":"INC-02934","date":"2025-12","year":2025,"title":"n8n — Rce (CVE-2025-65964)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65964"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65964"},{"id":"INC-02942","date":"2025-12","year":2025,"title":"n8n — Xss (CVE-2025-61914)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61914"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61914"},{"id":"INC-02935","date":"2025-12","year":2025,"title":"n8n — Sandbox Escape (CVE-2025-68668)","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68668"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68668"},{"id":"INC-02938","date":"2025-12","year":2025,"title":"n8n — Vulnerability (CVE-2025-68697)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68697"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68697"},{"id":"INC-02505","date":"2025-12","year":2025,"title":"Default credentials in Dify thru 1.5.1.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-56157"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-56157"},{"id":"INC-02430","date":"2025-12","year":2025,"title":"ChurchCRM — Sql Injection (CVE-2025-66396)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-66396"],"affected":"churchcrm/churchcrm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66396"},{"id":"INC-02323","date":"2025-12","year":2025,"title":"Anthropic Sandbox Runtime — Vulnerability (CVE-2025-66479)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66479"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66479"},{"id":"INC-02824","date":"2025-12","year":2025,"title":"LibreChat — Vulnerability (CVE-2025-66450)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66450"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66450"},{"id":"INC-02825","date":"2025-12","year":2025,"title":"LibreChat — Vulnerability (CVE-2025-66451)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66451"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66451"},{"id":"INC-02826","date":"2025-12","year":2025,"title":"LibreChat — Xss (CVE-2025-66452)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66452"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66452"},{"id":"INC-02908","date":"2025-12","year":2025,"title":"Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting I...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62154"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62154"},{"id":"INC-09952","date":"2025-12","year":2025,"title":"LangGraph SQLite Checkpoint — Sql Injection (CVE-2025-67644)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67644"],"affected":"langchain/langgraph-checkpoint-sqlite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67644"},{"id":"INC-09953","date":"2025-12","year":2025,"title":"DeepSeek V3.2 has a Cross Site Scripting (XSS) vulnerability, which allows JavaScript execution through model-generated SVG content.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-63872"],"affected":"deepseek/deepseek","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63872"},{"id":"INC-09954","date":"2025-12","year":2025,"title":"Trix has a stored XSS vulnerability through its attachment attribute","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/action_text-trix, npm/trix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g9jg-w8vm-g96v"},{"id":"INC-09955","date":"2025-12","year":2025,"title":"RustFS has a gRPC Hardcoded Token Authentication Bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-68926"],"affected":"rust/rustfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68926"},{"id":"INC-09956","date":"2025-12","year":2025,"title":"FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-69210"],"affected":"composer/facturascripts/facturascripts, composer/facturascripts/facturascripts, composer/facturascripts/facturascripts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69210"},{"id":"INC-09957","date":"2025-12","year":2025,"title":"Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-69211"],"affected":"npm/@nestjs/platform-fastify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69211"},{"id":"INC-09958","date":"2025-12","year":2025,"title":"Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-46h3-79wf-xr6c"},{"id":"INC-09959","date":"2025-12","year":2025,"title":"Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71322","CVE-2025-71339"],"affected":"pip/picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71339"},{"id":"INC-09960","date":"2025-12","year":2025,"title":"Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/pterodactyl/panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mgr9-6c2j-jxrq"},{"id":"INC-09961","date":"2025-12","year":2025,"title":"phpMyFAQ has Stored XSS in user list via admin-managed display_name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68951"],"affected":"composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68951"},{"id":"INC-09962","date":"2025-12","year":2025,"title":"apidoc-core has a prototype pollution vulnerability","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-13158"],"affected":"npm/apidoc-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13158"},{"id":"INC-09963","date":"2025-12","year":2025,"title":"libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25341"],"affected":"npm/libxmljs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25341"},{"id":"INC-09964","date":"2025-12","year":2025,"title":"Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68942"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68942"},{"id":"INC-09965","date":"2025-12","year":2025,"title":"httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-68696"],"affected":"rubygems/httparty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68696"},{"id":"INC-09966","date":"2025-12","year":2025,"title":"LibreNMS Alert Rule API Cross-Site Scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68614"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68614"},{"id":"INC-09967","date":"2025-12","year":2025,"title":"Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-67743"],"affected":"pip/local-deep-research","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67743"},{"id":"INC-09968","date":"2025-12","year":2025,"title":"Fedify has ReDoS Vulnerability in HTML Parsing Regex","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68475"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68475"},{"id":"INC-09969","date":"2025-12","year":2025,"title":"Piranha has stored cross-site scripting (XSS) vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67290","CVE-2025-67291"],"affected":"nuget/Piranha","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67290"},{"id":"INC-09970","date":"2025-12","year":2025,"title":"KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-68476"],"affected":"go/github.com/kedacore/keda/v2, go/github.com/kedacore/keda/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68476"},{"id":"INC-09971","date":"2025-12","year":2025,"title":"Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@tutao/tutanota-utils","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-24v3-254g-jv85"},{"id":"INC-09972","date":"2025-12","year":2025,"title":"Kimai contains a SameSite cookie vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-53957"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-53957"},{"id":"INC-09973","date":"2025-12","year":2025,"title":"Orejime has executable code in HTML attributes","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68457"],"affected":"npm/orejime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68457"},{"id":"INC-09974","date":"2025-12","year":2025,"title":"tinacms is vulnerable to arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68278"],"affected":"npm/@tinacms/graphql, npm/@tinacms/cli, npm/tinacms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68278"},{"id":"INC-09975","date":"2025-12","year":2025,"title":"Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68463"],"affected":"pip/biopython","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68463"},{"id":"INC-09976","date":"2025-12","year":2025,"title":"phpMyFAQ contains a CSV injection vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-53929"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-53929"},{"id":"INC-09977","date":"2025-12","year":2025,"title":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-68146"],"affected":"pip/filelock","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68146"},{"id":"INC-09978","date":"2025-12","year":2025,"title":"Libredesk has Improper Neutralization of HTML Tags in a Web Page","severity":"High","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-68927"],"affected":"go/github.com/abhinavxd/libredesk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68927"},{"id":"INC-09979","date":"2025-12","year":2025,"title":"tRPC has possible prototype pollution in `experimental_nextAppDirCaller`","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68130"],"affected":"npm/@trpc/server, npm/@trpc/server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68130"},{"id":"INC-09980","date":"2025-12","year":2025,"title":"Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68115"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68115"},{"id":"INC-09981","date":"2025-12","year":2025,"title":"Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-67715"],"affected":"pip/Weblate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67715"},{"id":"INC-09982","date":"2025-12","year":2025,"title":"Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-67492"],"affected":"pip/Weblate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67492"},{"id":"INC-09983","date":"2025-12","year":2025,"title":"MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-12827","CVE-2025-67898"],"affected":"npm/mjml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67898"},{"id":"INC-09984","date":"2025-12","year":2025,"title":"Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8082"],"affected":"npm/vuetify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8082"},{"id":"INC-09985","date":"2025-12","year":2025,"title":"Jenkins's build authorization token is stored and displayed in plain text","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-67637","CVE-2025-67640"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67637"},{"id":"INC-09986","date":"2025-12","year":2025,"title":"XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66474"],"affected":"maven/org.xwiki.rendering:xwiki-rendering-xml, maven/org.xwiki.rendering:xwiki-rendering-xml,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66474"},{"id":"INC-09987","date":"2025-12","year":2025,"title":"Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65513"],"affected":"npm/mcp-fetch-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65513"},{"id":"INC-09988","date":"2025-12","year":2025,"title":"Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-13877"],"affected":"npm/@nocobase/auth, npm/@nocobase/auth, npm/@nocobase/auth","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13877"},{"id":"INC-09989","date":"2025-12","year":2025,"title":"SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-66578"],"affected":"composer/onelogin/php-saml, composer/onelogin/php-saml, composer/onelogin/php-saml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5j8p-438x-rgg5"},{"id":"INC-09990","date":"2025-12","year":2025,"title":"Open Redirect Vulnerability in Taguette","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-67502"],"affected":"pip/taguette","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67502"},{"id":"INC-09991","date":"2025-12","year":2025,"title":"@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-67489"],"affected":"npm/@vitejs/plugin-rsc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-67489"},{"id":"INC-09992","date":"2025-12","year":2025,"title":"Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-25291","CVE-2025-25292","CVE-2025-25293","CVE-2025-66567","CVE-2025-66568"],"affected":"rubygems/ruby-saml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66568"},{"id":"INC-09993","date":"2025-12","year":2025,"title":"NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66470"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66470"},{"id":"INC-09994","date":"2025-12","year":2025,"title":"memos vulnerability allows arbitrarily modification or deletion registered identity providers","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-65797","CVE-2025-65798"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65797"},{"id":"INC-09995","date":"2025-12","year":2025,"title":"Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66565"],"affected":"go/github.com/gofiber/utils, go/github.com/gofiber/utils/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66565"},{"id":"INC-09996","date":"2025-12","year":2025,"title":"Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-66623"],"affected":"maven/io.strimzi:strimzi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66623"},{"id":"INC-09997","date":"2025-12","year":2025,"title":"nitro-tpm-pcr-compute may allow kernel command line modification by an account operator","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/nitro-tpm-pcr-compute","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xrv8-2pf5-f3q7"},{"id":"INC-09998","date":"2025-12","year":2025,"title":"alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65346"],"affected":"composer/alexusmai/laravel-file-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65346"},{"id":"INC-09999","date":"2025-12","year":2025,"title":"alexusmai laravel-file-manager is vulnerable to Directory Traversal","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65345"],"affected":"composer/alexusmai/laravel-file-manager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65345"},{"id":"INC-10000","date":"2025-12","year":2025,"title":"Coder logs sensitive objects unsanitized","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66411"],"affected":"go/github.com/coder/coder/v2, go/github.com/coder/coder/v2, go/github.com/coder/coder/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66411"},{"id":"INC-10001","date":"2025-12","year":2025,"title":"gokey allows secret recovery from a seed file without the master password","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-13353"],"affected":"go/github.com/cloudflare/gokey","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13353"},{"id":"INC-10002","date":"2025-12","year":2025,"title":"Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-66294"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66294"},{"id":"INC-10003","date":"2025-12","year":2025,"title":"Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-66307","CVE-2025-66308","CVE-2025-66310","CVE-2025-66311"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66310"},{"id":"INC-10004","date":"2025-12","year":2025,"title":"Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-66295","CVE-2025-66296"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66295"},{"id":"INC-10005","date":"2025-12","year":2025,"title":"Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66412"],"affected":"npm/@angular/compiler, npm/@angular/compiler, npm/@angular/compiler","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66412"},{"id":"INC-10006","date":"2025-12","year":2025,"title":"Gin-vue-admin has an arbitrary file deletion vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66410"],"affected":"go/github.com/flipped-aurora/gin-vue-admin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66410"},{"id":"INC-10007","date":"2025-12","year":2025,"title":"Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66405"],"affected":"npm/@portkey-ai/gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66405"},{"id":"INC-10008","date":"2025-12","year":2025,"title":"Keras Directory Traversal Vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12060"],"affected":"pip/keras","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12060"},{"id":"INC-10009","date":"2025-12","year":2025,"title":"Grav Exposes Password Hashes Leading to privilege escalation","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-66303","CVE-2025-66304"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66304"},{"id":"INC-10010","date":"2025-12","year":2025,"title":"Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-66301"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66301"},{"id":"INC-03148","date":"2025-12","year":2025,"title":"Better Auth affected by external request basePath modification DoS","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62593"],"affected":"npm/better-auth","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-569q-mpph-wgww"},{"id":"INC-10011","date":"2025-12","year":2025,"title":"Spotipy has a XSS vulnerability in its OAuth callback server","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66040"],"affected":"pip/spotipy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66040"},{"id":"INC-10012","date":"2025-12","year":2025,"title":"fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66034"],"affected":"pip/fonttools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66034"},{"id":"INC-10013","date":"2025-12","year":2025,"title":"XWiki Jetty Package (XJetty) allows accessing any application file through URL","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-55749"],"affected":"maven/org.xwiki.platform:xwiki-platform-tool-jetty-resources, maven/org.xwiki.platform:xwiki-platform-tool-jetty-resour…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55749"},{"id":"INC-10014","date":"2025-12","year":2025,"title":"FeehiCMS fails to enforce server-side immutability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-63523"],"affected":"composer/feehi/feehicms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63523"},{"id":"INC-10017","date":"2025-12","year":2025,"title":"Malware in vscode-azure-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/vscode-azure-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g3xg-r65r-rjp9"},{"id":"INC-10020","date":"2025-12","year":2025,"title":"Malware in excluder-mcp-package","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/excluder-mcp-package","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h43q-7r78-rf73"},{"id":"INC-10021","date":"2025-12","year":2025,"title":"Malware in excluder-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/excluder-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gg9p-qcrr-r7fv"},{"id":"INC-14614","date":"2025-11","year":2025,"title":"Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mulesoft Anypoint Cod...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-10875","CVE-2025-64318","CVE-2025-64320","CVE-2025-64321"],"affected":"salesforce/mulesoft_anypoint_code_builder","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10875"},{"id":"INC-02801","date":"2025-11","year":2025,"title":"LangChain — Vulnerability (CVE-2025-65106)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-65106"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65106"},{"id":"INC-02823","date":"2025-11","year":2025,"title":"LibreChat — Ssrf (CVE-2025-66201)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66201"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66201"},{"id":"INC-02809","date":"2025-11","year":2025,"title":"Langfuse — Vulnerability (CVE-2025-64504)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64504"],"affected":"langfuse/langfuse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64504"},{"id":"INC-02810","date":"2025-11","year":2025,"title":"Langfuse — Phishing (CVE-2025-65107)","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-65107"],"affected":"langfuse/langfuse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65107"},{"id":"INC-03291","date":"2025-11","year":2025,"title":"The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “Pytho...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-12695"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12695"},{"id":"INC-03187","date":"2025-11","year":2025,"title":"Roo Code — Vulnerability (CVE-2025-65946)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-65946"],"affected":"roocode/roo_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65946"},{"id":"INC-02446","date":"2025-11","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-65099)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-65099"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65099"},{"id":"INC-02445","date":"2025-11","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-64755)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64755"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64755"},{"id":"INC-02475","date":"2025-11","year":2025,"title":"Cursor — Prompt Injection (CVE-2025-64107)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-64107"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64107"},{"id":"INC-02476","date":"2025-11","year":2025,"title":"Cursor — Prompt Injection (CVE-2025-64108)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-64108"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64108"},{"id":"INC-02977","date":"2025-11","year":2025,"title":"OctoPrint provides a web interface for controlling consumer 3D printers.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64187"],"affected":"octoprint/octoprint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64187"},{"id":"INC-02479","date":"2025-11","year":2025,"title":"Cursor — Vulnerability (CVE-2025-64106)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64106"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64106"},{"id":"INC-02477","date":"2025-11","year":2025,"title":"Cursor — Rce (CVE-2025-64109)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64109"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64109"},{"id":"INC-02304","date":"2025-11","year":2025,"title":"An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-58337"],"affected":"apache/doris_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58337"},{"id":"INC-02136","date":"2025-11","year":2025,"title":"A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/serv...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-63603"],"affected":"mcp_server_for_data_exploration_project/mcp_server_for_data_exploration","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63603"},{"id":"INC-02378","date":"2025-11","year":2025,"title":"By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant c...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-35028"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-35028"},{"id":"INC-02746","date":"2025-11","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a sur...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-35810","CVE-2025-40110"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-40110"},{"id":"INC-02743","date":"2025-11","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-50177","CVE-2024-57918","CVE-2024-57919","CVE-2025-40148"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-40148"},{"id":"INC-02730","date":"2025-11","year":2025,"title":"Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those s...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62354"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62354"},{"id":"INC-02729","date":"2025-11","year":2025,"title":"Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security fe...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62449"],"affected":"microsoft/github_copilot_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62449"},{"id":"INC-02732","date":"2025-11","year":2025,"title":"Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62453"],"affected":"microsoft/visual_studio_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62453"},{"id":"INC-02904","date":"2025-11","year":2025,"title":"Milvus — Auth Bypass (CVE-2025-64513)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-64513"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64513"},{"id":"INC-03270","date":"2025-11","year":2025,"title":"The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-12360"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12360"},{"id":"INC-03296","date":"2025-11","year":2025,"title":"The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check o...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-12732"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12732"},{"id":"INC-14615","date":"2025-11","year":2025,"title":"The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12973"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12973"},{"id":"INC-03265","date":"2025-11","year":2025,"title":"The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-12156"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12156"},{"id":"INC-02762","date":"2025-11","year":2025,"title":"Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Se...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-62039"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62039"},{"id":"INC-03266","date":"2025-11","year":2025,"title":"The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-13380"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13380"},{"id":"INC-02917","date":"2025-11","year":2025,"title":"MLX — Info Disclosure (CVE-2025-62608)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-62608"],"affected":"ml-explore/mlx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62608"},{"id":"INC-02918","date":"2025-11","year":2025,"title":"MLX — Vulnerability (CVE-2025-62609)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62609"],"affected":"ml-explore/mlx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62609"},{"id":"INC-10034","date":"2025-11","year":2025,"title":"LangGraph SQLite Checkpoint — Rce (CVE-2025-64439)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64439"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64439"},{"id":"INC-10035","date":"2025-11","year":2025,"title":"oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12487","CVE-2025-12488"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12487"},{"id":"INC-10036","date":"2025-11","year":2025,"title":"trytond does not enforce access rights for the route of the HTML editor.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66423"],"affected":"pip/trytond, pip/trytond, pip/trytond","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66423"},{"id":"INC-10037","date":"2025-11","year":2025,"title":"Tryton sao allows XSS via an HTML attachment","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66420"],"affected":"npm/tryton-sao, npm/tryton-sao, npm/tryton-sao","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66420"},{"id":"INC-10038","date":"2025-11","year":2025,"title":"Peppol-py is vulnerable to XXE attacks due to Saxon configuration","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66371"],"affected":"pip/peppol_py","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66371"},{"id":"INC-10039","date":"2025-11","year":2025,"title":"Apache SkyWalking has a stored XSS vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54057"],"affected":"maven/org.apache.skywalking:apm-webapp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54057"},{"id":"INC-10040","date":"2025-11","year":2025,"title":"pretix has Email Content Injection Through Maliciously Formatted Names","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-13742"],"affected":"pip/pretix, pip/pretix, pip/pretix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-13742"},{"id":"INC-10041","date":"2025-11","year":2025,"title":"REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64049","CVE-2025-66026"],"affected":"composer/redaxo/source","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66026"},{"id":"INC-10042","date":"2025-11","year":2025,"title":"OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66028"],"affected":"npm/@oneuptime/common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66028"},{"id":"INC-10043","date":"2025-11","year":2025,"title":"OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66021"],"affected":"maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66021"},{"id":"INC-10044","date":"2025-11","year":2025,"title":"GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-21621"],"affected":"maven/org.geoserver:gs-wms, maven/org.geoserver.web:gs-web-app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21621"},{"id":"INC-10045","date":"2025-11","year":2025,"title":"OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64761"],"affected":"go/github.com/openbao/openbao","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64761"},{"id":"INC-10046","date":"2025-11","year":2025,"title":"Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64027"],"affected":"composer/snipe/snipe-it","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64027"},{"id":"INC-10047","date":"2025-11","year":2025,"title":"phppgadmin vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-60796"],"affected":"composer/phppgadmin/phppgadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-60796"},{"id":"INC-10048","date":"2025-11","year":2025,"title":"golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47914"],"affected":"go/golang.org/x/crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47914"},{"id":"INC-10049","date":"2025-11","year":2025,"title":"OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-65103"],"affected":"composer/devcode-it/openstamanager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65103"},{"id":"INC-10050","date":"2025-11","year":2025,"title":"esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65026"],"affected":"go/github.com/esm-dev/esm.sh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65026"},{"id":"INC-10051","date":"2025-11","year":2025,"title":"Astro vulnerable to reflected XSS via the server islands feature","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64745","CVE-2025-64764"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64764"},{"id":"INC-10052","date":"2025-11","year":2025,"title":"Modular Max Serve has Unsafe Deserialization vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-60455"],"affected":"pip/modular","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-60455"},{"id":"INC-10053","date":"2025-11","year":2025,"title":"LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65093"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65093"},{"id":"INC-10054","date":"2025-11","year":2025,"title":"joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-65015"],"affected":"pip/joserfc, pip/joserfc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65015"},{"id":"INC-10055","date":"2025-11","year":2025,"title":"Kirby CMS has cross-site scripting (XSS) in the changes dialog","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65012"],"affected":"composer/getkirby/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65012"},{"id":"INC-10056","date":"2025-11","year":2025,"title":"@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64758"],"affected":"npm/@dependencytrack/frontend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64758"},{"id":"INC-10057","date":"2025-11","year":2025,"title":"phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62519"],"affected":"composer/phpmyfaq/phpmyfaq, composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62519"},{"id":"INC-10058","date":"2025-11","year":2025,"title":"Memos' Access Tokens Stay Valid after User Password Change","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21635"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21635"},{"id":"INC-10059","date":"2025-11","year":2025,"title":"Directus is Vulnerable to Stored Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64747"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64747"},{"id":"INC-10060","date":"2025-11","year":2025,"title":"Directus has Improper Permission Handling on Deleted Fields","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-64746"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64746"},{"id":"INC-10061","date":"2025-11","year":2025,"title":"PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64711"],"affected":"composer/privatebin/privatebin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64711"},{"id":"INC-10062","date":"2025-11","year":2025,"title":"js-yaml has prototype pollution in merge (<<)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64718"],"affected":"npm/js-yaml, npm/js-yaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718"},{"id":"INC-14206","date":"2025-11","year":2025,"title":"golang.org/x/crypto/ssh/agent has a potential denial of service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47913"],"affected":"go/golang.org/x/crypto/ssh/agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47913"},{"id":"INC-10063","date":"2025-11","year":2025,"title":"Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64186"],"affected":"go/github.com/evervault/evervault-go","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64186"},{"id":"INC-10064","date":"2025-11","year":2025,"title":"Wasmtime provides unsound API access to a WebAssembly shared linear memory","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64345"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64345"},{"id":"INC-10065","date":"2025-11","year":2025,"title":"sudo-rs: Partial password reveal is possible after timeout","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64170"],"affected":"rust/sudo-rs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64170"},{"id":"INC-10066","date":"2025-11","year":2025,"title":"changedetection.io: Stored XSS in Watch update via API","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62780"],"affected":"pip/changedetection.io","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62780"},{"id":"INC-10067","date":"2025-11","year":2025,"title":"TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-64519"],"affected":"composer/torrentpier/torrentpier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64519"},{"id":"INC-10068","date":"2025-11","year":2025,"title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64518"],"affected":"maven/org.cyclonedx:cyclonedx-core-java","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64518"},{"id":"INC-10069","date":"2025-11","year":2025,"title":"KubeVirt Vulnerable to Arbitrary Host File Read and Write","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64324"],"affected":"go/kubevirt.io/kubevirt, go/kubevirt.io/kubevirt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64324"},{"id":"INC-10070","date":"2025-11","year":2025,"title":"Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48985"],"affected":"npm/ai, npm/ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48985"},{"id":"INC-10071","date":"2025-11","year":2025,"title":"KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-64436"],"affected":"go/kubevirt.io/kubevirt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64436"},{"id":"INC-10072","date":"2025-11","year":2025,"title":"KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64435"],"affected":"go/kubevirt.io/kubevirt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64435"},{"id":"INC-10073","date":"2025-11","year":2025,"title":"KubeVirt Arbitrary Container File Read","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64433"],"affected":"go/kubevirt.io/kubevirt, go/kubevirt.io/kubevirt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64433"},{"id":"INC-10074","date":"2025-11","year":2025,"title":"IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-64431"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64431"},{"id":"INC-10075","date":"2025-11","year":2025,"title":"youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-52881","CVE-2025-62596"],"affected":"rust/youki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62596"},{"id":"INC-10076","date":"2025-11","year":2025,"title":"WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-10713"],"affected":"maven/org.wso2.carbon.mediation:org.wso2.carbon.localentry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10713"},{"id":"INC-10077","date":"2025-11","year":2025,"title":"runc container escape with malicious config due to /dev/console mount and related races","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-52565"],"affected":"go/github.com/opencontainers/runc, go/github.com/opencontainers/runc, go/github.com/opencontainers/runc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52565"},{"id":"INC-10078","date":"2025-11","year":2025,"title":"runc container escape via \"masked path\" abuse due to mount race conditions","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31133"],"affected":"go/github.com/opencontainers/runc, go/github.com/opencontainers/runc, go/github.com/opencontainers/runc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31133"},{"id":"INC-10083","date":"2025-11","year":2025,"title":"Malware in mcp-polymarket","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-polymarket","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f8cg-j5h4-4v2j"},{"id":"INC-10084","date":"2025-11","year":2025,"title":"Malware in @browserbasehq/mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@browserbasehq/mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j9hg-hmwf-9qx7"},{"id":"INC-10089","date":"2025-11","year":2025,"title":"Malware in @seezo/sdr-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@seezo/sdr-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3c5g-45xx-w65c"},{"id":"INC-10090","date":"2025-11","year":2025,"title":"Malware in @relyt/mcp-server-relytone","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@relyt/mcp-server-relytone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9jcv-5hcv-f23r"},{"id":"INC-10091","date":"2025-11","year":2025,"title":"Malware in @relyt/claude-context-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@relyt/claude-context-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r4xp-273q-hmxr"},{"id":"INC-10092","date":"2025-11","year":2025,"title":"Malware in ids-enterprise-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/ids-enterprise-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jj4q-9hf2-5rfx"},{"id":"INC-10097","date":"2025-11","year":2025,"title":"Malware in web-scraper-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/web-scraper-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-92qg-p459-45jx"},{"id":"INC-10099","date":"2025-11","year":2025,"title":"Malware in lite-serper-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/lite-serper-mcp-server, npm/lite-serper-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w7vj-jqhx-2jr7"},{"id":"INC-10114","date":"2025-11","year":2025,"title":"Malware in rce-poc-test-honor-mcp","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/rce-poc-test-honor-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9c65-qg9h-c3gr"},{"id":"INC-10117","date":"2025-11","year":2025,"title":"Malware in kubeflow","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/kubeflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5v64-wcgg-87wf"},{"id":"INC-02799","date":"2025-10","year":2025,"title":"LangBot — Vulnerability (CVE-2025-59835)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59835"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59835"},{"id":"INC-02419","date":"2025-10","year":2025,"title":"Cherry Studio — Vulnerability (CVE-2025-61929)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-61929"],"affected":"cherry-ai/cherry_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61929"},{"id":"INC-02522","date":"2025-10","year":2025,"title":"Dify — Xss (CVE-2025-58747)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58747"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58747"},{"id":"INC-03284","date":"2025-10","year":2025,"title":"The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpoint i...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-11257"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11257"},{"id":"INC-03214","date":"2025-10","year":2025,"title":"SillyTavern — Phishing (CVE-2025-59159)","severity":"Critical","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59159"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59159"},{"id":"INC-02833","date":"2025-10","year":2025,"title":"LLaMA-Factory — Ssrf (CVE-2025-61784)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61784"],"affected":"hiyouga/llama-factory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61784"},{"id":"INC-03261","date":"2025-10","year":2025,"title":"text-generation-webui — Vulnerability (CVE-2025-62364)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62364"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62364"},{"id":"INC-02862","date":"2025-10","year":2025,"title":"Mastra — Path Traversal (CVE-2025-61685)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61685"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61685"},{"id":"INC-02705","date":"2025-10","year":2025,"title":"Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-11844"],"affected":"huggingface/smolagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11844"},{"id":"INC-02567","date":"2025-10","year":2025,"title":"FastGPT — Ssrf (CVE-2025-62612)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62612"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62612"},{"id":"INC-02444","date":"2025-10","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-59829)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59829"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59829"},{"id":"INC-02474","date":"2025-10","year":2025,"title":"Cursor — Prompt Injection (CVE-2025-61589)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-54132","CVE-2025-61589"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61589"},{"id":"INC-02547","date":"2025-10","year":2025,"title":"EspoCRM — Vulnerability (CVE-2025-59428)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-59428"],"affected":"espocrm/espocrm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59428"},{"id":"INC-02155","date":"2025-10","year":2025,"title":"A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end us...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-62353"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62353"},{"id":"INC-02154","date":"2025-10","year":2025,"title":"A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user’s ...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-62356"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62356"},{"id":"INC-02571","date":"2025-10","year":2025,"title":"FastMCP — Xss (CVE-2025-62800)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62800"],"affected":"jlowin/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62800"},{"id":"INC-02570","date":"2025-10","year":2025,"title":"FastMCP — Command Injection (CVE-2025-62801)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62801"],"affected":"jlowin/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62801"},{"id":"INC-02782","date":"2025-10","year":2025,"title":"Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information a...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-64131","CVE-2025-64132","CVE-2025-64134","CVE-2025-64143","CVE-2025-64144","CVE-2025-64146"],"affected":"jenkins/mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64132"},{"id":"INC-03280","date":"2025-10","year":2025,"title":"The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-6985"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6985"},{"id":"INC-02162","date":"2025-10","year":2025,"title":"A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation.","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-64104","CVE-2025-8709"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8709"},{"id":"INC-01015","date":"2025-10","year":2025,"title":"Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to ins...","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM05","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI07"],"cve_ids":["CVE-2024-31621","CVE-2024-36420","CVE-2024-36421","CVE-2024-36422","CVE-2024-36423","CVE-2024-37145","CVE-2024-37146","CVE-2024-58351","CVE-2024-8181","CVE-2024-8182","CVE-2025-26319","CVE-2025-29192","CVE-2025-34267","CVE-2025-50538","CVE-2025-54994","CVE-2025-55346","CVE-2025-57164","CVE-2025-58434","CVE-2025-59527","CVE-2025-59528","CVE-2025-61687","CVE-2025-61913","CVE-2025-71324","CVE-2025-71327","CVE-2025-71328","CVE-2025-71331","CVE-2025-71332","CVE-2025-71333","CVE-2025-71334","CVE-2025-71335","CVE-2025-71336","CVE-2025-71337","CVE-2025-71338","CVE-2025-8943","CVE-2026-22252","CVE-2026-22688","CVE-2026-30615","CVE-2026-30616","CVE-2026-30617","CVE-2026-30624","CVE-2026-30625","CVE-2026-30820","CVE-2026-30821","CVE-2026-30822","CVE-2026-30823","CVE-2026-30824","CVE-2026-31829","CVE-2026-40933","CVE-2026-41137","CVE-2026-41138","CVE-2026-41264","CVE-2026-41265","CVE-2026-41266","CVE-2026-41267","CVE-2026-41268","CVE-2026-41269","CVE-2026-41270","CVE-2026-41271","CVE-2026-41272","CVE-2026-41273","CVE-2026-41274","CVE-2026-41275","CVE-2026-41276","CVE-2026-41277","CVE-2026-41278","CVE-2026-41279","CVE-2026-42861","CVE-2026-42862","CVE-2026-42863","CVE-2026-43995","CVE-2026-46440","CVE-2026-46441","CVE-2026-46442","CVE-2026-46443","CVE-2026-46444","CVE-2026-46475","CVE-2026-46476","CVE-2026-46477","CVE-2026-46478","CVE-2026-46479","CVE-2026-46480","CVE-2026-56267","CVE-2026-56268","CVE-2026-56269","CVE-2026-56270","CVE-2026-56272","CVE-2026-56274","CVE-2026-56275","CVE-2026-56276","CVE-2026-56277","CVE-2026-56278","CVE-2026-8026"],"affected":"flowiseai/flowise","corpus":"security","quality_tier":"curated","tier":"landmark","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-34267"},{"id":"INC-02747","date":"2025-10","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potenti...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-50440"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-50440"},{"id":"INC-02933","date":"2025-10","year":2025,"title":"n8n — Rce (CVE-2025-62726)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-62726"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62726"},{"id":"INC-03138","date":"2025-10","year":2025,"title":"pwn.college DOJO — Auth Bypass (CVE-2025-62376)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62376"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62376"},{"id":"INC-10118","date":"2025-10","year":2025,"title":"LiteLLM Information health API_KEY Information Disclosure Vulnerability.","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-11203"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11203"},{"id":"INC-10119","date":"2025-10","year":2025,"title":"LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-8849"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8849"},{"id":"INC-10120","date":"2025-10","year":2025,"title":"ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8406"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8406"},{"id":"INC-10121","date":"2025-10","year":2025,"title":"Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62267"],"affected":"maven/com.liferay:com.liferay.dynamic.data.mapping.item.selector.web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62267"},{"id":"INC-10122","date":"2025-10","year":2025,"title":"Agno session state overwrites between different sessions/users","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64168"],"affected":"pip/agno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64168"},{"id":"INC-10123","date":"2025-10","year":2025,"title":"Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62264"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62264"},{"id":"INC-10124","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to XSS in the Blogs widget","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62265"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62265"},{"id":"INC-10125","date":"2025-10","year":2025,"title":"Byaidu PDFMathTranslate vulnerable to open redirect","severity":"Low","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-50736"],"affected":"pip/pdf2zh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50736"},{"id":"INC-10126","date":"2025-10","year":2025,"title":"DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-64095"],"affected":"nuget/DNN.PLATFORM","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64095"},{"id":"INC-10127","date":"2025-10","year":2025,"title":"DNN CKEditor Provider allows unauthenticated upload out-of-the-box","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62802"],"affected":"nuget/Dnn.Platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62802"},{"id":"INC-10128","date":"2025-10","year":2025,"title":"FastMCP Auth Integration Allows for Confused Deputy Account Takeover","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/fastmcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c2jp-c369-7pvx"},{"id":"INC-10129","date":"2025-10","year":2025,"title":"CKAN vulnerable to stored XSS in resource description","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54384"],"affected":"pip/ckan, pip/ckan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54384"},{"id":"INC-10130","date":"2025-10","year":2025,"title":"Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62798"],"affected":"composer/code16/sharp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62798"},{"id":"INC-10131","date":"2025-10","year":2025,"title":"NextAuthjs Email misdelivery Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/next-auth, npm/next-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5jpx-9hw9-2fx4"},{"id":"INC-10132","date":"2025-10","year":2025,"title":"PrivateBin is missing HTML sanitization of attached filename in file size hint","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62796"],"affected":"composer/privatebin/privatebin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62796"},{"id":"INC-10133","date":"2025-10","year":2025,"title":"Contrast has insecure LUKS2 persistent storage partitions may be opened and used","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/edgelesssys/contrast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f5p4-p5q5-jv3h"},{"id":"INC-10134","date":"2025-10","year":2025,"title":"Liferay Portal Vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43791","CVE-2025-62263"],"affected":"maven/com.liferay:com.liferay.account.admin.web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62263"},{"id":"INC-10135","date":"2025-10","year":2025,"title":"Wasmtime vulnerable to segfault when using component resources","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62711"],"affected":"rust/wasmtime","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62711"},{"id":"INC-10136","date":"2025-10","year":2025,"title":"Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62255"],"affected":"maven/com.liferay:com.liferay.knowledge.base.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62255"},{"id":"INC-10137","date":"2025-10","year":2025,"title":"Piranha CMS vulnerable to stored cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61413"],"affected":"nuget/Piranha","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61413"},{"id":"INC-10138","date":"2025-10","year":2025,"title":"Liferay Portal and DXP do not properly restrict access to OpenAPI","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62256"],"affected":"maven/com.liferay:com.liferay.portal.security.auth.verifier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62256"},{"id":"INC-10139","date":"2025-10","year":2025,"title":"Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62710"],"affected":"maven/org.sakaiproject.kernel:sakai-kernel-impl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62710"},{"id":"INC-10140","date":"2025-10","year":2025,"title":"Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11966"],"affected":"maven/io.vertx:vertx-web, maven/io.vertx:vertx-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11966"},{"id":"INC-10141","date":"2025-10","year":2025,"title":"aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62611"],"affected":"pip/aiomysql","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62611"},{"id":"INC-10142","date":"2025-10","year":2025,"title":"Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62617"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62617"},{"id":"INC-10143","date":"2025-10","year":2025,"title":"Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/shopware/core, composer/shopware/core, composer/shopware/platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3cpp-fv95-mpr5"},{"id":"INC-10144","date":"2025-10","year":2025,"title":"Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"npm/@actual-app/sync-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xvp7-8vm8-xfxx"},{"id":"INC-10145","date":"2025-10","year":2025,"title":"Citizen vulnerable to stored XSS in sticky header button messages","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62508"],"affected":"composer/starcitizentools/citizen-skin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62508"},{"id":"INC-10146","date":"2025-10","year":2025,"title":"TastyIgniter vulnerable to Cross-Site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-61417"],"affected":"composer/tastyigniter/tastyigniter","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61417"},{"id":"INC-10147","date":"2025-10","year":2025,"title":"Mammoth is vulnerable to Directory Traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11849"],"affected":"nuget/Mammoth, pip/mammoth, maven/org.zwobble.mammoth:mammoth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11849"},{"id":"INC-10148","date":"2025-10","year":2025,"title":"MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62506"],"affected":"go/github.com/minio/minio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62506"},{"id":"INC-10149","date":"2025-10","year":2025,"title":"bagisto has Cross Site Scripting (XSS) in Create New Customer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62414"],"affected":"composer/bagisto/bagisto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62414"},{"id":"INC-10150","date":"2025-10","year":2025,"title":"LibreNMS alert-rules has a Cross-Site Scripting Vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62412"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62412"},{"id":"INC-10151","date":"2025-10","year":2025,"title":"bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62415"],"affected":"composer/bagisto/bagisto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62415"},{"id":"INC-10152","date":"2025-10","year":2025,"title":"OpenSearch Data Prepper plugins trust all SSL certificates by default","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-62371"],"affected":"maven/org.opensearch.dataprepper.plugins:opensearch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62371"},{"id":"INC-10153","date":"2025-10","year":2025,"title":"`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-62381"],"affected":"npm/sveltekit-superforms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62381"},{"id":"INC-10154","date":"2025-10","year":2025,"title":"Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-62366","CVE-2025-62380"],"affected":"npm/mailgen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62380"},{"id":"INC-10155","date":"2025-10","year":2025,"title":"reflex-dev/reflex has an Open Redirect vulnerability","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62379"],"affected":"pip/reflex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62379"},{"id":"INC-10156","date":"2025-10","year":2025,"title":"Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-55248"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55248"},{"id":"INC-10157","date":"2025-10","year":2025,"title":"Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55247"],"affected":"nuget/Microsoft.Build.Utilities.Core, nuget/Microsoft.Build.Utilities.Core, nuget/Microsoft.Build.Utilities.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55247"},{"id":"INC-10158","date":"2025-10","year":2025,"title":"Apache Spark has Inadequate Encryption Strength","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55039"],"affected":"pip/pyspark, pip/pyspark, maven/org.apache.spark:spark-network-common_2.12","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55039"},{"id":"INC-10159","date":"2025-10","year":2025,"title":"Magento allows incorrect authorization","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54263","CVE-2025-54264","CVE-2025-54265","CVE-2025-54266","CVE-2025-54267"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54265"},{"id":"INC-10160","date":"2025-10","year":2025,"title":"Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55315"],"affected":"nuget/Microsoft.AspNetCore.Server.Kestrel.Core, nuget/Microsoft.AspNetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55315"},{"id":"INC-10161","date":"2025-10","year":2025,"title":"Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62172"],"affected":"pip/homeassistant","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62172"},{"id":"INC-10162","date":"2025-10","year":2025,"title":"Argo Workflow may expose artifact repository credentials","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-62157"],"affected":"go/github.com/argoproj/argo-workflows/v3, go/github.com/argoproj/argo-workflows/v3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62157"},{"id":"INC-10163","date":"2025-10","year":2025,"title":"Liferay Mentions Web is Vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62246"],"affected":"maven/com.liferay:com.liferay.mentions.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62246"},{"id":"INC-10164","date":"2025-10","year":2025,"title":"Happy DOM: VM Context Escape can lead to Remote Code Execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-61927"],"affected":"npm/happy-dom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61927"},{"id":"INC-10165","date":"2025-10","year":2025,"title":"python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-61912"],"affected":"pip/python-ldap","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61912"},{"id":"INC-10166","date":"2025-10","year":2025,"title":"Rack has a Possible Information Disclosure Vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61780"],"affected":"rubygems/rack, rubygems/rack, rubygems/rack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61780"},{"id":"INC-10167","date":"2025-10","year":2025,"title":"Liferay Portal Commerce is vulnerable to XSS through account \"name\" field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62237"],"affected":"maven/com.liferay.commerce:com.liferay.commerce.order.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62237"},{"id":"INC-10168","date":"2025-10","year":2025,"title":"Liferay Portal's Membership page is vulnerable to XSS through “name“ text field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62238"],"affected":"maven/com.liferay:com.liferay.account.admin.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62238"},{"id":"INC-10169","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to XSS through its workflow process builder","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62239"],"affected":"maven/com.liferay:com.liferay.portal.workflow.kaleo.designer.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62239"},{"id":"INC-10170","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to XSS through its Calendar Events parameters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62240"],"affected":"maven/com.liferay:com.liferay.calendar.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62240"},{"id":"INC-10171","date":"2025-10","year":2025,"title":"Better Auth: Unauthenticated API key creation through api-key plugin","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-61928"],"affected":"npm/better-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61928"},{"id":"INC-10172","date":"2025-10","year":2025,"title":"n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/n8n, npm/n8n-nodes-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-365g-vjw2-grx8"},{"id":"INC-10173","date":"2025-10","year":2025,"title":"Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-61788"],"affected":"maven/org.opencastproject:opencast-common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61788"},{"id":"INC-10174","date":"2025-10","year":2025,"title":"Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43771"],"affected":"maven/com.liferay:com.liferay.flags.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43771"},{"id":"INC-10175","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to Stored XSS through Forms text type field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43830"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43830"},{"id":"INC-10176","date":"2025-10","year":2025,"title":"Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43829"],"affected":"maven/com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43829"},{"id":"INC-10177","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43821"],"affected":"maven/com.liferay.commerce:com.liferay.commerce.product.service","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43821"},{"id":"INC-10178","date":"2025-10","year":2025,"title":"FuelVM is vulnerable to heap memory allocation re-use bug","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"rust/fuel-vm, rust/fuel-vm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2pgj-5cv2-6xxw"},{"id":"INC-10179","date":"2025-10","year":2025,"title":"Liferay Portal is vulnerable to XSS through its Commerce Search Result widget","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43823"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43823"},{"id":"INC-10180","date":"2025-10","year":2025,"title":"Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43822"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43822"},{"id":"INC-10181","date":"2025-10","year":2025,"title":"pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-11362"],"affected":"npm/pdfmake","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11362"},{"id":"INC-10182","date":"2025-10","year":2025,"title":"clearml is vulnerable to Path Traversal through its `safe_extract` function","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8917"],"affected":"pip/clearml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8917"},{"id":"INC-10183","date":"2025-10","year":2025,"title":"NiceGUI has a Reflected XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53354"],"affected":"pip/nicegui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53354"},{"id":"INC-10184","date":"2025-10","year":2025,"title":"Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-54286"],"affected":"go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54286"},{"id":"INC-10185","date":"2025-10","year":2025,"title":"Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54287"],"affected":"go/github.com/lxc/lxd, go/github.com/lxc/lxd, go/github.com/lxc/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54287"},{"id":"INC-10186","date":"2025-10","year":2025,"title":"Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-54288"],"affected":"go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54288"},{"id":"INC-10187","date":"2025-10","year":2025,"title":"Canonical LXD Project Existence Determination Through Error Handling in Image Export Function","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54290"],"affected":"go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54290"},{"id":"INC-10188","date":"2025-10","year":2025,"title":"Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-54293"],"affected":"go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54293"},{"id":"INC-10189","date":"2025-10","year":2025,"title":"Canonical LXD Project Existence Determination Through Error Handling in Image Get Function","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54291"],"affected":"go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54291"},{"id":"INC-10190","date":"2025-10","year":2025,"title":"Liferay Portal Vulnerable to XSS in Web Content translation","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43826"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43826"},{"id":"INC-10193","date":"2025-10","year":2025,"title":"Malware in shiprocket-mcp","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/shiprocket-mcp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qq2g-4w88-354g"},{"id":"INC-10202","date":"2025-10","year":2025,"title":"Malware in langflow-api-chat","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/langflow-api-chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8wp3-pqmc-8vmv"},{"id":"INC-10205","date":"2025-10","year":2025,"title":"Malware in mcp-server-fixthis","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-server-fixthis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p45p-rjrm-xmh3"},{"id":"INC-10207","date":"2025-10","year":2025,"title":"Malware in @lanyer640/mcp-runcommand-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@lanyer640/mcp-runcommand-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xmqc-rm22-fxq6"},{"id":"INC-02527","date":"2025-09","year":2025,"title":"Dive — Rce (CVE-2025-58176)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58176"],"affected":"openagentplatform/dive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58176"},{"id":"INC-03047","date":"2025-09","year":2025,"title":"Promptcraft Forge Studio — Vulnerability (CVE-2025-58353)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58353"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58353"},{"id":"INC-03048","date":"2025-09","year":2025,"title":"Promptcraft Forge Studio — Xss (CVE-2025-58361)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58361"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58361"},{"id":"INC-02519","date":"2025-09","year":2025,"title":"Dify — Auth Bypass (CVE-2025-59422)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-59422"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59422"},{"id":"INC-02589","date":"2025-09","year":2025,"title":"Flowise — Vulnerability (CVE-2025-59434)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-59434"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59434"},{"id":"INC-03185","date":"2025-09","year":2025,"title":"Roo Code — Rce (CVE-2025-58370)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58370"],"affected":"roocode/roo_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58370"},{"id":"INC-03186","date":"2025-09","year":2025,"title":"Roo Code — Rce (CVE-2025-58371)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-58371"],"affected":"roocode/roo_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58371"},{"id":"INC-02187","date":"2025-09","year":2025,"title":"AgentAPI — Data Exfiltration (CVE-2025-59956)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-59956"],"affected":"coder/agentapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59956"},{"id":"INC-02442","date":"2025-09","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-58764)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58764"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58764"},{"id":"INC-02437","date":"2025-09","year":2025,"title":"Claude Code — Rce (CVE-2025-59041)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59041"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59041"},{"id":"INC-02754","date":"2025-09","year":2025,"title":"Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smolagents.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-9959"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9959"},{"id":"INC-02130","date":"2025-09","year":2025,"title":"5ire — Prompt Injection (CVE-2025-58357)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-58357"],"affected":"5ire/5ire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58357"},{"id":"INC-03289","date":"2025-09","year":2025,"title":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59046"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59046"},{"id":"INC-02804","date":"2025-09","year":2025,"title":"Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-9556"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9556"},{"id":"INC-02843","date":"2025-09","year":2025,"title":"Lobe Chat — Prompt Injection (CVE-2025-59417)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-59417"],"affected":"lobehub/lobe_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59417"},{"id":"INC-03285","date":"2025-09","year":2025,"title":"The MCP inspector — Xss (CVE-2025-58444)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58444"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58444"},{"id":"INC-02311","date":"2025-09","year":2025,"title":"An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-56406"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-56406"},{"id":"INC-02529","date":"2025-09","year":2025,"title":"DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against local...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-10193"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10193"},{"id":"INC-03287","date":"2025-09","year":2025,"title":"The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to p...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59333"],"affected":"executeautomation/mcp_database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59333"},{"id":"INC-02183","date":"2025-09","year":2025,"title":"ADB MCP Server — Command Injection (CVE-2025-59834)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59834"],"affected":"srmorete/adb_mcp_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59834"},{"id":"INC-03329","date":"2025-09","year":2025,"title":"vet — Supply Chain (CVE-2025-59163)","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59163"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59163"},{"id":"INC-02858","date":"2025-09","year":2025,"title":"Markdownify — Command Injection (CVE-2025-58358)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58358"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58358"},{"id":"INC-02684","date":"2025-09","year":2025,"title":"hackmd-mcp — Ssrf (CVE-2025-59155)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59155"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59155"},{"id":"INC-02161","date":"2025-09","year":2025,"title":"The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing.","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-2828","CVE-2025-6984"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6984"},{"id":"INC-02972","date":"2025-09","year":2025,"title":"NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2025-23268","CVE-2025-23316","CVE-2025-23328","CVE-2025-23329","CVE-2025-23336"],"affected":"nvidia/triton_inference_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23268"},{"id":"INC-02306","date":"2025-09","year":2025,"title":"An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files sec...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-10155","CVE-2025-10156","CVE-2025-10157","CVE-2025-71325"],"affected":"mmaitre314/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10155"},{"id":"INC-02737","date":"2025-09","year":2025,"title":"In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46148","CVE-2025-46149","CVE-2025-46150","CVE-2025-46152","CVE-2025-46153"],"affected":"linuxfoundation/pytorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46148"},{"id":"INC-02309","date":"2025-09","year":2025,"title":"An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55551","CVE-2025-55552","CVE-2025-55553","CVE-2025-55554","CVE-2025-55556","CVE-2025-55557","CVE-2025-55558","CVE-2025-55559","CVE-2025-55560"],"affected":"linuxfoundation/pytorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55551"},{"id":"INC-02753","date":"2025-09","year":2025,"title":"In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-26448"],"affected":"google/android","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26448"},{"id":"INC-02742","date":"2025-09","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_list_sync iterates ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-53252"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-53252"},{"id":"INC-02745","date":"2025-09","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address a...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-39807"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-39807"},{"id":"INC-02976","date":"2025-09","year":2025,"title":"Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58401"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58401"},{"id":"INC-02145","date":"2025-09","year":2025,"title":"A flaw was found in Red Hat Openshift AI Service.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-10725"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10725"},{"id":"INC-02457","date":"2025-09","year":2025,"title":"Codex CLI — Path Traversal (CVE-2025-59532)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59532"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59532"},{"id":"INC-03206","date":"2025-09","year":2025,"title":"Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Fo...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58829"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58829"},{"id":"INC-02308","date":"2025-09","year":2025,"title":"An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-50708","CVE-2025-50709"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50709"},{"id":"INC-02830","date":"2025-09","year":2025,"title":"Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55178"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55178"},{"id":"INC-10208","date":"2025-09","year":2025,"title":"A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_...","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6237"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6237"},{"id":"INC-10209","date":"2025-09","year":2025,"title":"DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain.","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-26210"],"affected":"deepseek/deepseek-r1, deepseek/deepseek-v2, deepseek/deepseek-v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26210"},{"id":"INC-10210","date":"2025-09","year":2025,"title":"Liferay Portal vulnerable to cross-site scripting in the web content template","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43812"],"affected":"maven/com.liferay:com.liferay.journal.web, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43812"},{"id":"INC-10211","date":"2025-09","year":2025,"title":"Liferay Portal vulnerable to cross-site scripting in the Calendar widget","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43818","CVE-2025-43820"],"affected":"maven/com.liferay:com.liferay.calendar.web, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43820"},{"id":"INC-10212","date":"2025-09","year":2025,"title":"Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43815"],"affected":"maven/com.liferay:com.liferay.product.navigation.control.menu.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43815"},{"id":"INC-10213","date":"2025-09","year":2025,"title":"Liferay Portal vulnerable to cross-site scripting in the related asset selector","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43811"],"affected":"maven/com.liferay:com.liferay.item.selector.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43811"},{"id":"INC-10214","date":"2025-09","year":2025,"title":"Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43817"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43817"},{"id":"INC-10215","date":"2025-09","year":2025,"title":"MinIO Java Client XML Tag Value Substitution Vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-59952"],"affected":"maven/io.minio:minio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59952"},{"id":"INC-10216","date":"2025-09","year":2025,"title":"Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-59845"],"affected":"npm/@apollo/explorer, npm/@apollo/sandbox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59845"},{"id":"INC-10217","date":"2025-09","year":2025,"title":"Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59839"],"affected":"composer/starcitizenwiki/embedvideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59839"},{"id":"INC-10218","date":"2025-09","year":2025,"title":"CSVTOJSON has a prototype pollution vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-57350"],"affected":"npm/csvtojson","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57350"},{"id":"INC-10219","date":"2025-09","year":2025,"title":"Liferay Portal and DXP does not properly expire sessions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-43819"],"affected":"maven/com.liferay:com.liferay.saml.impl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43819"},{"id":"INC-10220","date":"2025-09","year":2025,"title":"GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57407"],"affected":"composer/gp247/core, composer/s-cart/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57407"},{"id":"INC-10221","date":"2025-09","year":2025,"title":"DNN Vulnerable to Stored XSS Using Backend Admin Credentials","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59546"],"affected":"nuget/DotNetNuke.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59546"},{"id":"INC-10222","date":"2025-09","year":2025,"title":"DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59545"],"affected":"nuget/DotNetNuke.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59545"},{"id":"INC-10223","date":"2025-09","year":2025,"title":"DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59539"],"affected":"nuget/DotNetNuke.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59539"},{"id":"INC-10224","date":"2025-09","year":2025,"title":"Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43807"],"affected":"maven/com.liferay:com.liferay.change.tracking.service","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43807"},{"id":"INC-10225","date":"2025-09","year":2025,"title":"Mailgen: HTML injection vulnerability in plaintext e-mails","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-59526"],"affected":"npm/mailgen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59526"},{"id":"INC-10226","date":"2025-09","year":2025,"title":"Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/ammonia, rust/ammonia, rust/ammonia","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mm7x-qfjj-5g2c"},{"id":"INC-10227","date":"2025-09","year":2025,"title":"The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-9905"],"affected":"pip/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9905"},{"id":"INC-10228","date":"2025-09","year":2025,"title":"Dragonfly doesn't have authentication enabled for some Manager’s endpoints","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59345"],"affected":"go/d7y.io/dragonfly/v2, go/github.com/dragonflyoss/dragonfly","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59345"},{"id":"INC-10229","date":"2025-09","year":2025,"title":"esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59342"],"affected":"go/github.com/esm-dev/esm.sh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59342"},{"id":"INC-10230","date":"2025-09","year":2025,"title":"esm.sh has File Inclusion issue","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-59341"],"affected":"go/github.com/esm-dev/esm.sh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59341"},{"id":"INC-10231","date":"2025-09","year":2025,"title":"REXML has DoS condition when parsing malformed XML file","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58767"],"affected":"rubygems/rexml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58767"},{"id":"INC-10232","date":"2025-09","year":2025,"title":"Jenkins has a missing permission check, allowing users to obtain agent names","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59474"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59474"},{"id":"INC-10233","date":"2025-09","year":2025,"title":"Liferay search widget vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43804"],"affected":"maven/com.liferay:com.liferay.portal.search","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43804"},{"id":"INC-10234","date":"2025-09","year":2025,"title":"Liferay Stored Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43802"],"affected":"maven/com.liferay.workspace:com.liferay.ticket.workspace","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43802"},{"id":"INC-10235","date":"2025-09","year":2025,"title":"Liferay Portal Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43800"],"affected":"maven/com.liferay:com.liferay.dynamic.data.mapping.form.field.type","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43800"},{"id":"INC-10236","date":"2025-09","year":2025,"title":"serde_yml crate is unsound and unmaintained","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/serde_yml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hhw4-xg65-fp2x"},{"id":"INC-10237","date":"2025-09","year":2025,"title":"Liferay Portal has stored cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43794"],"affected":"maven/com.liferay.portal:com.liferay.portal.impl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43794"},{"id":"INC-10238","date":"2025-09","year":2025,"title":"Axios is vulnerable to DoS attack through lack of data size check","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58754"],"affected":"npm/axios, npm/axios","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58754"},{"id":"INC-10239","date":"2025-09","year":2025,"title":"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-9910"],"affected":"npm/jsondiffpatch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9910"},{"id":"INC-10240","date":"2025-09","year":2025,"title":"Liferay Portal is vulnerable to Reflected XSS attack through get_editor path","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43783"],"affected":"maven/com.liferay:com.liferay.frontend.editor.ckeditor.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43783"},{"id":"INC-10241","date":"2025-09","year":2025,"title":"Shopware: Reflective Cross Site-Scripting (XSS) in CMS components","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/shopware/core, composer/shopware/shopware","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9v82-vcjx-m76j"},{"id":"INC-10242","date":"2025-09","year":2025,"title":"Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54123"],"affected":"go/github.com/SpectoLabs/hoverfly","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54123"},{"id":"INC-10243","date":"2025-09","year":2025,"title":"Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-26266","CVE-2025-43785"],"affected":"maven/com.liferay:com.liferay.portal.workflow.task.web, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43785"},{"id":"INC-10244","date":"2025-09","year":2025,"title":"Liferay Portal is vulnerable to XSS attack through its search bar portlet","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43781"],"affected":"maven/com.liferay:com.liferay.portal.search.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43781"},{"id":"INC-10245","date":"2025-09","year":2025,"title":"Liferay Portal is vulnerable to XSS attacks via its remote app title field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43775"],"affected":"maven/com.liferay:com.liferay.client.extension.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43775"},{"id":"INC-10246","date":"2025-09","year":2025,"title":"Monai: Unsafe use of Pickle deserialization may lead to RCE","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58756","CVE-2025-58757"],"affected":"pip/monai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58757"},{"id":"INC-10247","date":"2025-09","year":2025,"title":"MONAI does not prevent path traversal, potentially leading to arbitrary file writes","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58755"],"affected":"pip/monai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58755"},{"id":"INC-10248","date":"2025-09","year":2025,"title":"Vite's `server.fs` settings were not applied to HTML files","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-58752"],"affected":"npm/vite, npm/vite, npm/vite","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58752"},{"id":"INC-10249","date":"2025-09","year":2025,"title":"listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-58430"],"affected":"go/github.com/knadh/listmonk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58430"},{"id":"INC-10250","date":"2025-09","year":2025,"title":"Element Plus Link component (el-link) implements insufficient input validation for the href attribute","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57665"],"affected":"npm/element-plus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57665"},{"id":"INC-10251","date":"2025-09","year":2025,"title":"sanitize-html is vulnerable to XSS through incomprehensive sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-25225"],"affected":"npm/sanitize-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-25225"},{"id":"INC-10252","date":"2025-09","year":2025,"title":"xgrammar vulnerable to denial of service by huge enum grammar","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58446"],"affected":"pip/xgrammar","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58446"},{"id":"INC-10253","date":"2025-09","year":2025,"title":"Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/usd-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-58p5-r2f6-g2cj"},{"id":"INC-10254","date":"2025-09","year":2025,"title":"Mautic vulnerable to SSRF via webhook function","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-9821"],"affected":"composer/mautic/core, composer/mautic/core, composer/mautic/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9821"},{"id":"INC-10255","date":"2025-09","year":2025,"title":"Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/@anthropic-ai/claude-code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-ph6w-f82w-28w6"},{"id":"INC-10256","date":"2025-09","year":2025,"title":"CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58064"],"affected":"npm/@ckeditor/ckeditor5-clipboard, npm/ckeditor5, npm/@ckeditor/ckeditor5-clipboard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58064"},{"id":"INC-10261","date":"2025-09","year":2025,"title":"Malware in mcp-knowledge-graph","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-knowledge-graph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qq74-6323-3h57"},{"id":"INC-10262","date":"2025-09","year":2025,"title":"Malware in mcp-knowledge-base","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-knowledge-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f8qw-968c-jxpq"},{"id":"INC-10264","date":"2025-09","year":2025,"title":"Malware in mcp-server-everything","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-server-everything","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6j44-frpv-rvv9"},{"id":"INC-10265","date":"2025-09","year":2025,"title":"Malware in mcp-chat-client","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-chat-client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r7jv-6f7p-rr8q"},{"id":"INC-10268","date":"2025-09","year":2025,"title":"Malware in mcp-lumin","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/mcp-lumin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h4r4-cm9c-4mcc"},{"id":"INC-02127","date":"2025-08","year":2025,"title":"1Panel — Rce (CVE-2025-54424)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54424"],"affected":"fit2cloud/1panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54424"},{"id":"INC-02417","date":"2025-08","year":2025,"title":"Cherry Studio — Rce (CVE-2025-54063)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54063"],"affected":"cherry-ai/cherry_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54063"},{"id":"INC-02416","date":"2025-08","year":2025,"title":"Cherry Studio — Command Injection (CVE-2025-54074)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54074"],"affected":"cherry-ai/cherry_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54074"},{"id":"INC-02418","date":"2025-08","year":2025,"title":"Cherry Studio — Rce (CVE-2025-54382)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54382"],"affected":"cherry-ai/cherry_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54382"},{"id":"INC-02576","date":"2025-08","year":2025,"title":"Firecrawl turns entire websites into LLM-ready markdown or structured data.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57818"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57818"},{"id":"INC-03184","date":"2025-08","year":2025,"title":"Roo Code — Rce (CVE-2025-57771)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57771"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57771"},{"id":"INC-02806","date":"2025-08","year":2025,"title":"Langflow — Rce (CVE-2025-57760)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57760"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57760"},{"id":"INC-02440","date":"2025-08","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-54794)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54794"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54794"},{"id":"INC-02441","date":"2025-08","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-54795)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54795"],"affected":"anthropic/claude_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54795"},{"id":"INC-02473","date":"2025-08","year":2025,"title":"Cursor — Prompt Injection (CVE-2025-54131)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-54131"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54131"},{"id":"INC-02694","date":"2025-08","year":2025,"title":"Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-44179"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-44179"},{"id":"INC-02844","date":"2025-08","year":2025,"title":"LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-58062"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58062"},{"id":"INC-02761","date":"2025-08","year":2025,"title":"Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-45150"],"affected":"x-d_lab/langchain-chatglm-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-45150"},{"id":"INC-02472","date":"2025-08","year":2025,"title":"Cursor — Info Disclosure (CVE-2025-54133)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-54133"],"affected":"anysphere/cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54133"},{"id":"INC-03273","date":"2025-08","year":2025,"title":"The configuration of Cursor on macOS, specifically the \"RunAsNode\" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor ...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-9190"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9190"},{"id":"INC-02894","date":"2025-08","year":2025,"title":"Microsoft 365 Copilot BizChat Information Disclosure Vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-53774","CVE-2025-53787"],"affected":"microsoft/365_copilot_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53774"},{"id":"INC-02940","date":"2025-08","year":2025,"title":"n8n — Xss (CVE-2025-52478)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-52478"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52478"},{"id":"INC-02937","date":"2025-08","year":2025,"title":"n8n — Vulnerability (CVE-2025-57749)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-57749"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57749"},{"id":"INC-02943","date":"2025-08","year":2025,"title":"n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55526"],"affected":"n8n/fastapi, n8n/pydantic, n8n/uvicorn, microsoft/windows_11","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55526"},{"id":"INC-14616","date":"2025-08","year":2025,"title":"The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is...","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6716","CVE-2025-7725"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7725"},{"id":"INC-02452","date":"2025-08","year":2025,"title":"claude-code-router — Vulnerability (CVE-2025-57755)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-57755"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57755"},{"id":"INC-10270","date":"2025-08","year":2025,"title":"Tracing logging user input may result in poisoning logs with ANSI escape sequences","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58160"],"affected":"rust/tracing-subscriber","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58160"},{"id":"INC-10271","date":"2025-08","year":2025,"title":"Rancher Fleet Helm Values are stored inside BundleDeployment in plain text","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-52284"],"affected":"go/github.com/rancher/fleet, go/github.com/rancher/fleet, go/github.com/rancher/fleet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52284"},{"id":"INC-10272","date":"2025-08","year":2025,"title":"Google Sign-In for Rails allowed redirect to protocol-relative URI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58067"],"affected":"rubygems/google_sign_in","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58067"},{"id":"INC-10273","date":"2025-08","year":2025,"title":"Versity panic induced by AWS chunked data sent to port","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/versity/versitygw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v2ch-c8v8-fgr7"},{"id":"INC-10274","date":"2025-08","year":2025,"title":"Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55304"],"affected":"pip/Exiv2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55304"},{"id":"INC-10275","date":"2025-08","year":2025,"title":"Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54080"],"affected":"pip/Exiv2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54080"},{"id":"INC-10276","date":"2025-08","year":2025,"title":"Valtimo scripting engine can be used to gain access to sensitive data or resources","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-58059"],"affected":"maven/com.ritense.valtimo:core, maven/com.ritense.valtimo:core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-58059"},{"id":"INC-10277","date":"2025-08","year":2025,"title":"FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-56236"],"affected":"nuget/FormCMS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-56236"},{"id":"INC-10278","date":"2025-08","year":2025,"title":"Malicious versions of Nx were published","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-10894"],"affected":"npm/@nx/workspace, npm/@nx/js, npm/@nx/devkit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10894"},{"id":"INC-10280","date":"2025-08","year":2025,"title":"Badaso CMS file upload vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-52353"],"affected":"composer/badaso/core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52353"},{"id":"INC-10281","date":"2025-08","year":2025,"title":"Picklescan has a missing detection when calling built-in python library idlelib.calltip.get_entity","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71354","CVE-2025-71358","CVE-2025-71361"],"affected":"pip/picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9xph-j2h6-g47v"},{"id":"INC-10282","date":"2025-08","year":2025,"title":"ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry \":\" leads to crash","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55212"],"affected":"nuget/Magick.NET-Q8-x86, nuget/Magick.NET-Q8-x64, nuget/Magick.NET-Q8-arm64","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55212"},{"id":"INC-10283","date":"2025-08","year":2025,"title":"request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-57814"],"affected":"npm/request-filtering-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57814"},{"id":"INC-10284","date":"2025-08","year":2025,"title":"ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55154","CVE-2025-55160","CVE-2025-55298","CVE-2025-57807"],"affected":"nuget/Magick.NET-Q8-x86, nuget/Magick.NET-Q8-x64, nuget/Magick.NET-Q8-arm64","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55160"},{"id":"INC-10285","date":"2025-08","year":2025,"title":"ImageMagick has a heap-buffer-overflow","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68469"],"affected":"nuget/Magick.NET-Q8-x86, nuget/Magick.NET-Q8-x64, nuget/Magick.NET-Q8-arm64","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68469"},{"id":"INC-10286","date":"2025-08","year":2025,"title":"Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-23015","CVE-2025-26467"],"affected":"maven/org.apache.cassandra:cassandra-all","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26467"},{"id":"INC-10287","date":"2025-08","year":2025,"title":"PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54370"],"affected":"composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54370"},{"id":"INC-10288","date":"2025-08","year":2025,"title":"Liferay Portal vulnerable to Stored XSS in Components portlet","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43769"],"affected":"maven/com.liferay:com.liferay.plugins.admin.web","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43769"},{"id":"INC-10289","date":"2025-08","year":2025,"title":"Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43761"],"affected":"npm/liferay-ckeditor, maven/com.liferay:com.liferay.frontend.js.dependencies.web,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43761"},{"id":"INC-10290","date":"2025-08","year":2025,"title":"gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-57801"],"affected":"go/github.com/consensys/gnark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57801"},{"id":"INC-10291","date":"2025-08","year":2025,"title":"Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vv6j-3g6g-2pvj"},{"id":"INC-10292","date":"2025-08","year":2025,"title":"Dpanel has an arbitrary file read vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53363"],"affected":"go/github.com/donknap/dpanel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53363"},{"id":"INC-10293","date":"2025-08","year":2025,"title":"Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-57751"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-57751"},{"id":"INC-10294","date":"2025-08","year":2025,"title":"UnoPim vulnerable to CSRF on Product edit feature and creation of other types","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55744"],"affected":"composer/unopim/unopim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55744"},{"id":"INC-10295","date":"2025-08","year":2025,"title":"UnoPim vulnerable to remote code execution through Arbitrary File upload","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55743"],"affected":"composer/unopim/unopim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55743"},{"id":"INC-10296","date":"2025-08","year":2025,"title":"UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-55742"],"affected":"composer/unopim/unopim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55742"},{"id":"INC-10297","date":"2025-08","year":2025,"title":"Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54988"],"affected":"maven/org.apache.tika:tika-parsers, maven/org.apache.tika:tika-parser-pdf-module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54988"},{"id":"INC-10298","date":"2025-08","year":2025,"title":"Directus allows unauthenticated file upload and file modification due to lacking input sanitization","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-55746"],"affected":"npm/@directus/api, npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55746"},{"id":"INC-10299","date":"2025-08","year":2025,"title":"Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43744"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43744"},{"id":"INC-10300","date":"2025-08","year":2025,"title":"WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8678"],"affected":"composer/johnbillion/wp-crontrol","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8678"},{"id":"INC-10301","date":"2025-08","year":2025,"title":"Mermaid improperly sanitizes sequence diagram labels leading to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54881"],"affected":"npm/mermaid, npm/mermaid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54881"},{"id":"INC-10302","date":"2025-08","year":2025,"title":"Mermaid does not properly sanitize architecture diagram iconText leading to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54880"],"affected":"npm/mermaid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54880"},{"id":"INC-10303","date":"2025-08","year":2025,"title":"HydrAIDE Authentication Bypass Vulnerability","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/hydraide/hydraide, go/github.com/hydraide/hydraide","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qp7j-x725-g67f"},{"id":"INC-10304","date":"2025-08","year":2025,"title":"moonshine Stored Cross-Site Scripting Vulnerability in Create Article","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51487","CVE-2025-51488"],"affected":"composer/moonshine/moonshine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51487"},{"id":"INC-10305","date":"2025-08","year":2025,"title":"Liferay Portal Email Modification Vulnerability via Calendar Portlet","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-43739"],"affected":"maven/com.liferay:com.liferay.calendar.service","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43739"},{"id":"INC-10306","date":"2025-08","year":2025,"title":"Copier's safe template has filesystem write access outside destination path","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55214"],"affected":"pip/copier","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55214"},{"id":"INC-10307","date":"2025-08","year":2025,"title":"Information Disclosure in Amazon ECS Container Agent","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-9039"],"affected":"go/github.com/aws/amazon-ecs-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9039"},{"id":"INC-10308","date":"2025-08","year":2025,"title":"Helm May Panic Due To Incorrect YAML Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55198"],"affected":"go/helm.sh/helm/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55198"},{"id":"INC-10309","date":"2025-08","year":2025,"title":"svg-sanitizer Bypasses Attribute Sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55166"],"affected":"composer/enshrined/svg-sanitize","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55166"},{"id":"INC-10310","date":"2025-08","year":2025,"title":"Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8747"],"affected":"pip/keras","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8747"},{"id":"INC-10311","date":"2025-08","year":2025,"title":"Magento vulnerable to denial of service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49554","CVE-2025-49555","CVE-2025-49556","CVE-2025-49557","CVE-2025-49558","CVE-2025-49559"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49554"},{"id":"INC-10312","date":"2025-08","year":2025,"title":"content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55164"],"affected":"npm/content-security-policy-parser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55164"},{"id":"INC-10313","date":"2025-08","year":2025,"title":"PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55156"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55156"},{"id":"INC-10314","date":"2025-08","year":2025,"title":"Komari vulnerable to Cross-site WebSocket Hijacking","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/komari-monitor/komari","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q355-h244-969h"},{"id":"INC-10315","date":"2025-08","year":2025,"title":"HFS user adding a \"web link\" in HFS is vulnerable to \"target=_blank\" exploit","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":[],"affected":"npm/hfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xcxh-6cv4-q8p8"},{"id":"INC-10316","date":"2025-08","year":2025,"title":"Litestar has potential log injection in exception logging","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/litestar","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-674p-xv2x-rf3g"},{"id":"INC-10317","date":"2025-08","year":2025,"title":"The AuthKit Remix Library renders sensitive auth data in HTML","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-55009"],"affected":"npm/@workos-inc/authkit-remix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55009"},{"id":"INC-10318","date":"2025-08","year":2025,"title":"The AuthKit React Router Library rendered sensitive auth data in HTML","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55008"],"affected":"npm/@workos-inc/authkit-react-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55008"},{"id":"INC-10319","date":"2025-08","year":2025,"title":"@fedify/fedify has Improper Authentication and Incorrect Authorization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54888"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54888"},{"id":"INC-10320","date":"2025-08","year":2025,"title":"ExecuTorch integer overflow vulnerability leads to code execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54952"],"affected":"pip/executorch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54952"},{"id":"INC-10321","date":"2025-08","year":2025,"title":"ExecuTorch integer overflow vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-30404","CVE-2025-30405"],"affected":"swift/github.com/pytorch/executorch, maven/org.pytorch:executorch-android, pip/executorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30404"},{"id":"INC-10322","date":"2025-08","year":2025,"title":"ExecuTorch heap buffer overflow vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54949"],"affected":"swift/github.com/pytorch/executorch, maven/org.pytorch:executorch-android, pip/executorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54949"},{"id":"INC-10323","date":"2025-08","year":2025,"title":"ExecuTorch out-of-bounds access vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54950"],"affected":"swift/github.com/pytorch/executorch, maven/org.pytorch:executorch-android, pip/executorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54950"},{"id":"INC-10324","date":"2025-08","year":2025,"title":"ExecuTorch vulnerable to Heap-based Buffer Overflow","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54951"],"affected":"swift/github.com/pytorch/executorch, maven/org.pytorch:executorch-android, pip/executorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54951"},{"id":"INC-10325","date":"2025-08","year":2025,"title":"XWiki exposes passwords and emails stored in fields not named password/email in xml.vm","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54125"],"affected":"maven/org.xwiki.platform:xwiki-platform-legacy-oldcore, maven/org.xwiki.platform:xwiki-platform-legacy-oldcore,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54125"},{"id":"INC-10326","date":"2025-08","year":2025,"title":"js-toml Prototype Pollution Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54803"],"affected":"npm/js-toml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54803"},{"id":"INC-10327","date":"2025-08","year":2025,"title":"Grafana Infinity Datasource Plugin SSRF Vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-8341"],"affected":"go/github.com/grafana/grafana-infinity-datasource","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8341"},{"id":"INC-10328","date":"2025-08","year":2025,"title":"@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-54782"],"affected":"npm/@nestjs/devtools-integration","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54782"},{"id":"INC-02837","date":"2025-07","year":2025,"title":"llama.cpp — Vulnerability (CVE-2025-53630)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53630"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53630"},{"id":"INC-02612","date":"2025-07","year":2025,"title":"GitHub Kanban MCP Server — Command Injection (CVE-2025-53818)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53818"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53818"},{"id":"INC-02134","date":"2025-07","year":2025,"title":"mcp-package-docs — Command Injection (CVE-2025-54073)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2025-53107","CVE-2025-53355","CVE-2025-53372","CVE-2025-53832","CVE-2025-54073"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54073"},{"id":"INC-02760","date":"2025-07","year":2025,"title":"Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits vi...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-51867"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51867"},{"id":"INC-03231","date":"2025-07","year":2025,"title":"Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51860"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51860"},{"id":"INC-02157","date":"2025-07","year":2025,"title":"A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tok...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51864"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51864"},{"id":"INC-02237","date":"2025-07","year":2025,"title":"Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), allowing attackers to gain sensitvie in...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-51865"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51865"},{"id":"INC-03232","date":"2025-07","year":2025,"title":"Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51859"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51859"},{"id":"INC-02141","date":"2025-07","year":2025,"title":"A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling.","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-34072"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-34072"},{"id":"INC-03183","date":"2025-07","year":2025,"title":"Roo Code — Command Injection (CVE-2025-54377)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54377"],"affected":"roocode/roo_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54377"},{"id":"INC-03179","date":"2025-07","year":2025,"title":"RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53100"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53100"},{"id":"INC-02931","date":"2025-07","year":2025,"title":"n8n — Dos (CVE-2025-49595)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-49595"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49595"},{"id":"INC-02936","date":"2025-07","year":2025,"title":"n8n — Vulnerability (CVE-2025-52554)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-52554"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52554"},{"id":"INC-02812","date":"2025-07","year":2025,"title":"langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-3466"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3466"},{"id":"INC-02652","date":"2025-07","year":2025,"title":"GPT-SoVITS-WebUI — Command Injection (CVE-2025-49833)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49833","CVE-2025-49834","CVE-2025-49835"],"affected":"rvc-boss/gpt-sovits-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49833"},{"id":"INC-02595","date":"2025-07","year":2025,"title":"Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user in...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-7021"],"affected":"openai/operator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7021"},{"id":"INC-02537","date":"2025-07","year":2025,"title":"DSpace open source software — Vulnerability (CVE-2025-53621)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53621"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53621"},{"id":"INC-03267","date":"2025-07","year":2025,"title":"The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-7780"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7780"},{"id":"INC-02998","date":"2025-07","year":2025,"title":"OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54558"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54558"},{"id":"INC-03204","date":"2025-07","year":2025,"title":"Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG file to the chat int...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51863"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51863"},{"id":"INC-03364","date":"2025-07","year":2025,"title":"Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47995"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47995"},{"id":"INC-02728","date":"2025-07","year":2025,"title":"Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-49746"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49746"},{"id":"INC-02906","date":"2025-07","year":2025,"title":"Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-49747"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49747"},{"id":"INC-02485","date":"2025-07","year":2025,"title":"dedupe — Data Exfiltration (CVE-2025-54430)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54430"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54430"},{"id":"INC-10329","date":"2025-07","year":2025,"title":"SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the \"/key/block\" and \"/key/unblock\" API endp...","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-45809"],"affected":"litellm/litellm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-45809"},{"id":"INC-10330","date":"2025-07","year":2025,"title":"AutoGPT — Auth Bypass (CVE-2025-53944)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53944"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53944"},{"id":"INC-10331","date":"2025-07","year":2025,"title":"MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53012"],"affected":"pip/MaterialX","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53012"},{"id":"INC-10332","date":"2025-07","year":2025,"title":"MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53009"],"affected":"pip/MaterialX","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53009"},{"id":"INC-10333","date":"2025-07","year":2025,"title":"MS SWIFT Deserialization RCE Vulnerability","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/ms-swift","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r54c-2xmf-2cf3"},{"id":"INC-10334","date":"2025-07","year":2025,"title":"MS SWIFT WEB-UI RCE Vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-41419"],"affected":"pip/ms-swift","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-41419"},{"id":"INC-10335","date":"2025-07","year":2025,"title":"MS SWIFT Remote Code Execution via unsafe PyYAML deserialization","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50460"],"affected":"pip/ms-swift","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50460"},{"id":"INC-10336","date":"2025-07","year":2025,"title":"GitProxy Hidden Commits Injection","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54584","CVE-2025-54586"],"affected":"npm/@finos/git-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54586"},{"id":"INC-10337","date":"2025-07","year":2025,"title":"Ruby SAML DOS vulnerability with large SAML response","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54572"],"affected":"rubygems/ruby-saml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54572"},{"id":"INC-10338","date":"2025-07","year":2025,"title":"Pyload log Injection via API /json/add_package in add_name parameter","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3wwm-hjv7-23r3"},{"id":"INC-10339","date":"2025-07","year":2025,"title":"Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-50738"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50738"},{"id":"INC-10340","date":"2025-07","year":2025,"title":"z-push/z-push-dev SQL Injection Vulnerability","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8264"],"affected":"composer/z-push/z-push-dev","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8264"},{"id":"INC-10341","date":"2025-07","year":2025,"title":"Node-SAML SAML Signature Verification Vulnerability","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54369","CVE-2025-54419"],"affected":"npm/@node-saml/passport-saml, npm/passport-saml, npm/@node-saml/node-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54419"},{"id":"INC-10342","date":"2025-07","year":2025,"title":"smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-5120"],"affected":"pip/smolagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5120"},{"id":"INC-10343","date":"2025-07","year":2025,"title":"Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8101"],"affected":"npm/linkifyjs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8101"},{"id":"INC-10344","date":"2025-07","year":2025,"title":"Opencast still publishes global system account credentials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54380"],"affected":"maven/org.opencastproject:opencast-publication-service-oaipmh-remote, maven/org.opencastproject:opencast-kernel,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54380"},{"id":"INC-10345","date":"2025-07","year":2025,"title":"HAX CMS API Lacks Authorization Checks","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54378"],"affected":"composer/elmsln/haxcms, npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54378"},{"id":"INC-10346","date":"2025-07","year":2025,"title":"Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54412"],"affected":"pip/skops","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54412"},{"id":"INC-10347","date":"2025-07","year":2025,"title":"Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-45406"],"affected":"composer/codeigniter4/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-45406"},{"id":"INC-10348","date":"2025-07","year":2025,"title":"Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55013"],"affected":"pip/assemblyline-service-client, pip/assemblyline-service-client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55013"},{"id":"INC-10349","date":"2025-07","year":2025,"title":"Mezzanine CMS vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50481"],"affected":"pip/Mezzanine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50481"},{"id":"INC-10350","date":"2025-07","year":2025,"title":"FastAPI Guard has a regex bypass","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-54365"],"affected":"pip/fastapi-guard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54365"},{"id":"INC-10351","date":"2025-07","year":2025,"title":"Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53942"],"affected":"go/goauthentik.io","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53942"},{"id":"INC-10352","date":"2025-07","year":2025,"title":"NodeJS version of the HAX CMS application is distributed with Default Secrets","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-54137"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54137"},{"id":"INC-10353","date":"2025-07","year":2025,"title":"NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54127"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54127"},{"id":"INC-10354","date":"2025-07","year":2025,"title":"Nokogiri patches vendored libxml2 to resolve multiple CVEs","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-353f-x4gh-cqq8"},{"id":"INC-10355","date":"2025-07","year":2025,"title":"Dolibarr has Remote Code Execution Vulnerability (Bypass)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-49xw-hw94-fmv2"},{"id":"INC-10356","date":"2025-07","year":2025,"title":"Cadwyn vulnerable to XSS on the docs page","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53528"],"affected":"pip/cadwyn","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53528"},{"id":"INC-10357","date":"2025-07","year":2025,"title":"Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-54075"],"affected":"npm/@nuxtjs/mdc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54075"},{"id":"INC-10358","date":"2025-07","year":2025,"title":"melange's world-writable permissions expose SBOM files to potential image tampering","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54059"],"affected":"go/chainguard.dev/melange","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54059"},{"id":"INC-10359","date":"2025-07","year":2025,"title":"apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53945"],"affected":"go/chainguard.dev/apko","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53945"},{"id":"INC-10360","date":"2025-07","year":2025,"title":"Wasmtime CLI is vulnerable to host panic through its fd_renumber function","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53901"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53901"},{"id":"INC-10361","date":"2025-07","year":2025,"title":"vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53892"],"affected":"npm/petite-vue-i18n, npm/petite-vue-i18n, npm/@intlify/vue-i18n-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53892"},{"id":"INC-10362","date":"2025-07","year":2025,"title":"File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53893"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53893"},{"id":"INC-10363","date":"2025-07","year":2025,"title":"File Browser’s insecure JWT handling can lead to session replay attacks after logout","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53826"],"affected":"go/github.com/filebrowser/filebrowser/v2, go/github.com/filebrowser/filebrowser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53826"},{"id":"INC-10364","date":"2025-07","year":2025,"title":"Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10031"],"affected":"maven/org.glassfish.main.admingui:console-common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10031"},{"id":"INC-10365","date":"2025-07","year":2025,"title":"XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53835"],"affected":"maven/org.xwiki.rendering:xwiki-rendering-syntax-xhtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53835"},{"id":"INC-10366","date":"2025-07","year":2025,"title":"ExecuTorch vulnerable to Heap-based Buffer Overflow attack","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-30402"],"affected":"swift/github.com/pytorch/executorch, maven/org.pytorch:executorch-android, pip/executorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30402"},{"id":"INC-10367","date":"2025-07","year":2025,"title":"@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53626"],"affected":"npm/@pdfme/common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53626"},{"id":"INC-10369","date":"2025-07","year":2025,"title":"Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/edgelesssys/contrast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-phhq-63jg-fp7r"},{"id":"INC-10370","date":"2025-07","year":2025,"title":"Juju zip slip vulnerability via authenticated endpoint","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-53513"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53513"},{"id":"INC-10371","date":"2025-07","year":2025,"title":"Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/babylonlabs-io/babylon/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rj53-j6jw-7f7g"},{"id":"INC-10372","date":"2025-07","year":2025,"title":"LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6210"],"affected":"pip/llama-index-readers-obsidian","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6210"},{"id":"INC-10373","date":"2025-07","year":2025,"title":"Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-6386"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6386"},{"id":"INC-10374","date":"2025-07","year":2025,"title":"LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-3225"],"affected":"pip/llama-index-readers-papers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3225"},{"id":"INC-10375","date":"2025-07","year":2025,"title":"Citizen Short Description stored XSS vulnerability through wikitext","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53369"],"affected":"composer/starcitizentools/short-description","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53369"},{"id":"INC-10376","date":"2025-07","year":2025,"title":"Citizen vulnerable to Stored XSS through short descriptions","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53368","CVE-2025-53370"],"affected":"composer/starcitizentools/citizen-skin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53370"},{"id":"INC-10377","date":"2025-07","year":2025,"title":"tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48939"],"affected":"npm/tarteaucitronjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48939"},{"id":"INC-10378","date":"2025-07","year":2025,"title":"LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/lf-edge/ekuiper, go/github.com/lf-edge/ekuiper/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fv2p-qj5p-wqq4"},{"id":"INC-10379","date":"2025-07","year":2025,"title":"junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-53103"],"affected":"maven/org.junit.platform:junit-platform-reporting","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53103"},{"id":"INC-10380","date":"2025-07","year":2025,"title":"Malware in paypal-examples-langchain","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/paypal-examples-langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f2cq-6rfj-2m8v"},{"id":"INC-10381","date":"2025-07","year":2025,"title":"Malware in openai-fm","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openai-fm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c5rv-v785-phmr"},{"id":"INC-10382","date":"2025-07","year":2025,"title":"Malware in @jaswanthlanka/mcp-proxy","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@jaswanthlanka/mcp-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cm3w-fxm2-349q"},{"id":"INC-10384","date":"2025-07","year":2025,"title":"Malware in glean-mcp-server","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/glean-mcp-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-94vh-73p7-p3wc"},{"id":"INC-02338","date":"2025-06","year":2025,"title":"AstrBot — Path Traversal (CVE-2025-48957)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-48957"],"affected":"astrbot/astrbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48957"},{"id":"INC-03276","date":"2025-06","year":2025,"title":"The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), ...","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-57783"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-57783"},{"id":"INC-03363","date":"2025-06","year":2025,"title":"We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5688"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5688"},{"id":"INC-02835","date":"2025-06","year":2025,"title":"llama.cpp — Rce (CVE-2025-49847)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49847"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49847"},{"id":"INC-02521","date":"2025-06","year":2025,"title":"Dify — Xss (CVE-2025-49149)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49149"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49149"},{"id":"INC-02836","date":"2025-06","year":2025,"title":"llama.cpp — Vulnerability (CVE-2025-52566)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-52566"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52566"},{"id":"INC-02771","date":"2025-06","year":2025,"title":"iOS Simulator MCP Server (ios-simulator-mcp) is a Model Context Protocol (MCP) server for interacting with iOS simulators.","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-52573"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52573"},{"id":"INC-02832","date":"2025-06","year":2025,"title":"LLaMA-Factory — Rce (CVE-2025-53002)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53002"],"affected":"hiyouga/llama-factory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53002"},{"id":"INC-02566","date":"2025-06","year":2025,"title":"FastGPT — Rce (CVE-2025-49131)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49131"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49131"},{"id":"INC-02135","date":"2025-06","year":2025,"title":"A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5141"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5141"},{"id":"INC-02569","date":"2025-06","year":2025,"title":"FastGPT — Xss (CVE-2025-52552)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-52552"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52552"},{"id":"INC-03021","date":"2025-06","year":2025,"title":"pgai — Rce (CVE-2025-52467)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-52467"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52467"},{"id":"INC-02439","date":"2025-06","year":2025,"title":"Claude Code — Vulnerability (CVE-2025-52882)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-52882"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52882"},{"id":"INC-03215","date":"2025-06","year":2025,"title":"Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49619"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49619"},{"id":"INC-03292","date":"2025-06","year":2025,"title":"The Phoenix Code's configuration on macOS, specifically the presence of entitlements: \"com.apple.security.cs.allow-dyld-environment-variables\" and \"com.apple.security.cs.disable...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5255","CVE-2025-5963"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5255"},{"id":"INC-03040","date":"2025-06","year":2025,"title":"PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database ...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5690"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5690"},{"id":"INC-02146","date":"2025-06","year":2025,"title":"A flaw was found in the X Rendering extension's handling of animated cursors.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-49175"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49175"},{"id":"INC-02932","date":"2025-06","year":2025,"title":"n8n — Info Disclosure (CVE-2025-49592)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-49592"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49592"},{"id":"INC-02790","date":"2025-06","year":2025,"title":"Jupyter Core — Vulnerability (CVE-2025-30167)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30167"],"affected":"jupyter/jupyter_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30167"},{"id":"INC-03333","date":"2025-06","year":2025,"title":"Visionatrix — Xss (CVE-2025-49126)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-49126"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49126"},{"id":"INC-02511","date":"2025-06","year":2025,"title":"Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability.","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-41233"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-41233"},{"id":"INC-03279","date":"2025-06","year":2025,"title":"The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hiv...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-5018"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5018"},{"id":"INC-03269","date":"2025-06","year":2025,"title":"The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-13816","CVE-2024-13882","CVE-2025-6206"],"affected":"coderevolution/aiomatic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6206"},{"id":"INC-10402","date":"2025-06","year":2025,"title":"electron ASAR Integrity bypass by just modifying the content","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-46992"],"affected":"npm/electron, npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46992"},{"id":"INC-10403","date":"2025-06","year":2025,"title":"File Browser vulnerable to insecure password handling","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-52997"],"affected":"go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52997"},{"id":"INC-10404","date":"2025-06","year":2025,"title":"File Browser's password protection of links is bypassable","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-52996"],"affected":"go/github.com/filebrowser/filebrowser/v2, go/github.com/filebrowser/filebrowser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52996"},{"id":"INC-10405","date":"2025-06","year":2025,"title":"File Browser allows sensitive data to be transferred in URL","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-52901"],"affected":"go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52901"},{"id":"INC-10406","date":"2025-06","year":2025,"title":"TabberNeue vulnerable to Stored XSS through wikitext","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53093"],"affected":"composer/starcitizentools/tabber-neue","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53093"},{"id":"INC-10407","date":"2025-06","year":2025,"title":"filebrowser allows Stored Cross-Site Scripting through the Markdown preview function","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-52902"],"affected":"go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52902"},{"id":"INC-10408","date":"2025-06","year":2025,"title":"Magento Security feature bypass","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-27206","CVE-2025-43585","CVE-2025-47110","CVE-2025-49549","CVE-2025-49550"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49550"},{"id":"INC-10409","date":"2025-06","year":2025,"title":"Allure Report allows Improper XXE Restriction via DocumentBuilderFactory","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-52888"],"affected":"maven/io.qameta.allure.plugins:trx-plugin, maven/io.qameta.allure.plugins:junit-xml-plugin,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-52888"},{"id":"INC-10410","date":"2025-06","year":2025,"title":"PowSyBl Core XML Reader allows XXE and SSRF","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-47293"],"affected":"maven/com.powsybl:powsybl-commons","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47293"},{"id":"INC-10411","date":"2025-06","year":2025,"title":"Taylored webhook validation vulnerabilities","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"npm/taylored","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8g98-m4j9-qww5"},{"id":"INC-10412","date":"2025-06","year":2025,"title":"OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50183"],"affected":"npm/@openlist-frontend/openlist-frontend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50183"},{"id":"INC-10413","date":"2025-06","year":2025,"title":"Withdrawn Advisory: microlight allows a denial of service","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-45526"],"affected":"npm/microlight","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-45526"},{"id":"INC-10414","date":"2025-06","year":2025,"title":"ash_authentication_phoenix has Insufficient Session Expiration","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-4754"],"affected":"erlang/ash_authentication_phoenix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4754"},{"id":"INC-10415","date":"2025-06","year":2025,"title":"Teleport allows remote authentication bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-49825"],"affected":"go/github.com/gravitational/teleport, go/github.com/gravitational/teleport, go/github.com/gravitational/teleport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49825"},{"id":"INC-10416","date":"2025-06","year":2025,"title":"starcitizentools/citizen-skin allows stored XSS in user registration date message","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49575","CVE-2025-49576","CVE-2025-49577","CVE-2025-49578","CVE-2025-49579"],"affected":"composer/starcitizentools/citizen-skin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49578"},{"id":"INC-10417","date":"2025-06","year":2025,"title":"Regex literal in Hurl files are not escaped when exported to HTML, allowing injections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/hurl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v33j-v3x4-42qg"},{"id":"INC-10418","date":"2025-06","year":2025,"title":"Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-49142"],"affected":"pip/nautobot, pip/nautobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49142"},{"id":"INC-10419","date":"2025-06","year":2025,"title":"matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48937"],"affected":"rust/matrix-sdk-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48937"},{"id":"INC-10420","date":"2025-06","year":2025,"title":"GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-30220"],"affected":"maven/org.geonetwork-opensource:gn-wfsfeature-harvester, maven/org.geonetwork-opensource:gn-wfsfeature-harvester,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2p76-gc46-5fvc"},{"id":"INC-10421","date":"2025-06","year":2025,"title":"GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34711"],"affected":"maven/org.geoserver.main:gs-main, maven/org.geoserver.web:gs-web-app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34711"},{"id":"INC-10422","date":"2025-06","year":2025,"title":"GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29198"],"affected":"maven/org.geoserver.web:gs-app, maven/org.geoserver:gs-wfs, maven/org.geoserver.web:gs-app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29198"},{"id":"INC-10423","date":"2025-06","year":2025,"title":"Apache Kafka Deserialization of Untrusted Data vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-25194","CVE-2025-27818"],"affected":"maven/org.apache.kafka:kafka_2.13, maven/org.apache.kafka:kafka_2.12, maven/org.apache.kafka:kafka_2.11","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27818"},{"id":"INC-10424","date":"2025-06","year":2025,"title":"HaxCMS-PHP Command Injection Vulnerability","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49141"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49141"},{"id":"INC-10425","date":"2025-06","year":2025,"title":"@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-49139"],"affected":"npm/@haxtheweb/haxcms-nodejs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49139"},{"id":"INC-10426","date":"2025-06","year":2025,"title":"Backend.AI Missing Authorization vulnerability","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-49651","CVE-2025-49652","CVE-2025-49653"],"affected":"pip/backend.ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49651"},{"id":"INC-10427","date":"2025-06","year":2025,"title":"Hax CMS Stored Cross-Site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49137"],"affected":"composer/elmsln/haxcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49137"},{"id":"INC-10428","date":"2025-06","year":2025,"title":"Laravel Translation Manager Vulnerable to Stored Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49130"],"affected":"composer/barryvdh/laravel-translation-manager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49130"},{"id":"INC-10429","date":"2025-06","year":2025,"title":"Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-49128"],"affected":"maven/com.fasterxml.jackson.core:jackson-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49128"},{"id":"INC-10430","date":"2025-06","year":2025,"title":"Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-48996"],"affected":"npm/@haxtheweb/open-apis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48996"},{"id":"INC-10431","date":"2025-06","year":2025,"title":"SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-48994"],"affected":"pip/signxml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48994"},{"id":"INC-10432","date":"2025-06","year":2025,"title":"SignXML's signature verification with HMAC is vulnerable to a timing attack","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-48995"],"affected":"pip/signxml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48995"},{"id":"INC-10433","date":"2025-06","year":2025,"title":"kro Confused Deputy vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-48710"],"affected":"go/github.com/kro-run/kro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48710"},{"id":"INC-10434","date":"2025-06","year":2025,"title":"Gokapi vulnerable to stored XSS via uploading file with malicious file name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-48494"],"affected":"go/github.com/forceu/gokapi, go/github.com/forceu/gokapi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48494"},{"id":"INC-10435","date":"2025-06","year":2025,"title":"Gokapi has stored XSS vulnerability in friendly name for API keys","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-48495"],"affected":"go/github.com/forceu/gokapi, go/github.com/forceu/gokapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48495"},{"id":"INC-10436","date":"2025-06","year":2025,"title":"Malware in rush-mcp-example-plugin","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/rush-mcp-example-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h53p-7hxf-2rjc"},{"id":"INC-10445","date":"2025-06","year":2025,"title":"Malware in yaml-mcp-wrapper","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/yaml-mcp-wrapper","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pchh-j24j-3v4c"},{"id":"INC-02814","date":"2025-05","year":2025,"title":"Langroid — Info Disclosure (CVE-2025-46726)","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-46726"],"affected":"langroid/langroid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46726"},{"id":"INC-02829","date":"2025-05","year":2025,"title":"LLama Factory enables fine-tuning of large language models.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52803","CVE-2025-46567"],"affected":"hiyouga/llama-factory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46567"},{"id":"INC-03350","date":"2025-05","year":2025,"title":"vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cac...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47277"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47277"},{"id":"INC-03346","date":"2025-05","year":2025,"title":"vLLM — Vulnerability (CVE-2025-46570)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46570"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46570"},{"id":"INC-03343","date":"2025-05","year":2025,"title":"vLLM — Info Disclosure (CVE-2025-46722)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-46722"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46722"},{"id":"INC-03045","date":"2025-05","year":2025,"title":"Project AI — Vulnerability (CVE-2025-48491)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-48491"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48491"},{"id":"INC-03255","date":"2025-05","year":2025,"title":"Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46735"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46735"},{"id":"INC-03369","date":"2025-05","year":2025,"title":"While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action.","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-3893"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3893"},{"id":"INC-02351","date":"2025-05","year":2025,"title":"aws-mcp-server MCP server is vulnerable to command injection.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-5277"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5277"},{"id":"INC-03290","date":"2025-05","year":2025,"title":"The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on...","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-4143"],"affected":"cloudflare/workers-oauth-provider","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4143"},{"id":"INC-03299","date":"2025-05","year":2025,"title":"ToolHive — Vulnerability (CVE-2025-47274)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-47274"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47274"},{"id":"INC-02256","date":"2025-05","year":2025,"title":"All versions of the package mcp-markdownify-server are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5273"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5273"},{"id":"INC-02257","date":"2025-05","year":2025,"title":"All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-5276"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5276"},{"id":"INC-02132","date":"2025-05","year":2025,"title":"5ire — Xss (CVE-2025-47777)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-47777"],"affected":"5ire/5ire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47777"},{"id":"INC-02756","date":"2025-05","year":2025,"title":"Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0649"],"affected":"google/tensorflow_serving","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0649"},{"id":"INC-02987","date":"2025-05","year":2025,"title":"Open WebUI — Rce (CVE-2025-46571)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46571"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46571"},{"id":"INC-02989","date":"2025-05","year":2025,"title":"Open WebUI — Xss (CVE-2025-46719)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46719"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46719"},{"id":"INC-03272","date":"2025-05","year":2025,"title":"The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML inject...","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-43714"],"affected":"openai/chatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43714"},{"id":"INC-02156","date":"2025-05","year":2025,"title":"A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-25014"],"affected":"elastic/kibana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25014"},{"id":"INC-02834","date":"2025-05","year":2025,"title":"LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1753"],"affected":"llamaindex/llamaindex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1753"},{"id":"INC-10446","date":"2025-05","year":2025,"title":"Uncontrolled resource consumption for some OpenVINO™ model server software maintained by Intel(R) before version 2024.4 may allow an unauthenticated user to potentially enable d...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-22892"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22892"},{"id":"INC-10447","date":"2025-05","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: net: vlan: don't propagate flags on open With the device instance lock, there is now a possibility of a dea...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-23163"],"affected":"linux/linux_kernel, debian/debian_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23163"},{"id":"INC-10448","date":"2025-05","year":2025,"title":"Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-48938"],"affected":"go/github.com/cli/go-gh/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48938"},{"id":"INC-10449","date":"2025-05","year":2025,"title":"Navidrome Transcoding Permission Bypass Vulnerability Report","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-48948"],"affected":"go/github.com/navidrome/navidrome","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48948"},{"id":"INC-10450","date":"2025-05","year":2025,"title":"Navidrome allows SQL Injection via role parameter","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-48949"],"affected":"go/github.com/navidrome/navidrome","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48949"},{"id":"INC-10451","date":"2025-05","year":2025,"title":"PHPOffice Math allows XXE when processing an XML file in the MathML format","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48882"],"affected":"composer/phpoffice/math","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48882"},{"id":"INC-10452","date":"2025-05","year":2025,"title":"Fabio allows HTTP clients to manipulate custom headers it adds","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-48865"],"affected":"go/github.com/fabiolb/fabio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48865"},{"id":"INC-10453","date":"2025-05","year":2025,"title":"Mautic does not shield .env files from web traffic","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-47056"],"affected":"composer/mautic/core, composer/mautic/core, composer/mautic/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47056"},{"id":"INC-10454","date":"2025-05","year":2025,"title":"Argo CD allows cross-site scripting on repositories page","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-47933"],"affected":"go/github.com/argoproj/argo-cd/v3, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47933"},{"id":"INC-10455","date":"2025-05","year":2025,"title":"radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-48054"],"affected":"npm/radashi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48054"},{"id":"INC-10456","date":"2025-05","year":2025,"title":"Marked allows Regular Expression Denial of Service (ReDoS) attacks","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-25110"],"affected":"npm/marked","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-25110"},{"id":"INC-10457","date":"2025-05","year":2025,"title":"Eclipse JGit XML External Entity (XXE) Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-4949"],"affected":"maven/org.eclipse.jgit:org.eclipse.jgit, maven/org.eclipse.jgit:org.eclipse.jgit,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4949"},{"id":"INC-10458","date":"2025-05","year":2025,"title":"containerd allows host filesystem access on pull","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47290"],"affected":"go/github.com/containerd/containerd/v2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47290"},{"id":"INC-10459","date":"2025-05","year":2025,"title":"samlify SAML Signature Wrapping attack","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47949"],"affected":"npm/samlify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47949"},{"id":"INC-10460","date":"2025-05","year":2025,"title":"Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-47946"],"affected":"composer/symfony/ux-live-component, composer/symfony/ux-twig-component","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47946"},{"id":"INC-10461","date":"2025-05","year":2025,"title":"tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11718"],"affected":"composer/couleurcitron/tarteaucitron-wp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11718"},{"id":"INC-10462","date":"2025-05","year":2025,"title":"Reflex vulnerable to private state fields modification","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47425"],"affected":"pip/reflex, pip/reflex, pip/reflex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47425"},{"id":"INC-10463","date":"2025-05","year":2025,"title":"Sulu vulnerable to XXE in SVG File upload Inspector","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47778"],"affected":"composer/sulu/sulu, composer/sulu/sulu, composer/sulu/sulu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47778"},{"id":"INC-10464","date":"2025-05","year":2025,"title":"BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-4641"],"affected":"maven/io.github.bonigarcia:webdrivermanager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4641"},{"id":"INC-10465","date":"2025-05","year":2025,"title":"nosurf vulnerable to CSRF due to non-functional same-origin request checks","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-46721"],"affected":"go/github.com/justinas/nosurf","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46721"},{"id":"INC-10466","date":"2025-05","year":2025,"title":"Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-26646"],"affected":"nuget/Microsoft.Build.Tasks.Core, nuget/Microsoft.Build.Tasks.Core, nuget/Microsoft.Build.Tasks.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26646"},{"id":"INC-10467","date":"2025-05","year":2025,"title":"Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47280"],"affected":"nuget/Umbraco.Forms, nuget/UmbracoForms, nuget/Umbraco.Forms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47280"},{"id":"INC-10468","date":"2025-05","year":2025,"title":"@lumieducation/h5p-server Fails to Sanitize Plain Text Strings","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-47828"],"affected":"npm/@lumieducation/h5p-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47828"},{"id":"INC-10469","date":"2025-05","year":2025,"title":"Graylog Allows Session Takeover via Insufficient HTML Sanitization","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46827"],"affected":"maven/org.graylog2:graylog2-server, maven/org.graylog2:graylog2-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46827"},{"id":"INC-10470","date":"2025-05","year":2025,"title":"Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46572","CVE-2025-46573"],"affected":"npm/passport-wsfed-saml2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46573"},{"id":"INC-10471","date":"2025-05","year":2025,"title":"league/commonmark contains a XSS vulnerability in Attributes extension","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46734"],"affected":"composer/league/commonmark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46734"},{"id":"INC-10472","date":"2025-05","year":2025,"title":"Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-47241"],"affected":"pip/browser-use","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-47241"},{"id":"INC-10473","date":"2025-05","year":2025,"title":"October CMS Allows Unprotected SVG Rename in Media Manager","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-51991"],"affected":"composer/october/october, composer/october/system","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51991"},{"id":"INC-10474","date":"2025-05","year":2025,"title":"WSO2 API Manager XML External Entity (XXE) vulnerability","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-2905"],"affected":"maven/org.wso2.am:am-distribution-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2905"},{"id":"INC-10475","date":"2025-05","year":2025,"title":"OPA server Data API HTTP path injection of Rego","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46569"],"affected":"go/github.com/open-policy-agent/opa, go/github.com/open-policy-agent/opa/server,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46569"},{"id":"INC-10476","date":"2025-05","year":2025,"title":"@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-4144"],"affected":"npm/@cloudflare/workers-oauth-provider","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4144"},{"id":"INC-10483","date":"2025-05","year":2025,"title":"Malware in grunt-autogen-bemdecl","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/grunt-autogen-bemdecl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-h8gc-x6c6-gpjm"},{"id":"INC-02149","date":"2025-04","year":2025,"title":"A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of u...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-3578","CVE-2025-3579"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3578"},{"id":"INC-02538","date":"2025-04","year":2025,"title":"E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53844","CVE-2025-32779"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32779"},{"id":"INC-02517","date":"2025-04","year":2025,"title":"Dify — Auth Bypass (CVE-2025-32790)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-32790"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32790"},{"id":"INC-02518","date":"2025-04","year":2025,"title":"Dify — Auth Bypass (CVE-2025-32795)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-32795","CVE-2025-32796","CVE-2025-43862"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32795"},{"id":"INC-02520","date":"2025-04","year":2025,"title":"DIFY — Vulnerability (CVE-2025-43854)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-43854"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43854"},{"id":"INC-03341","date":"2025-04","year":2025,"title":"vLLM — Dos (CVE-2025-30202)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30202"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30202"},{"id":"INC-02866","date":"2025-04","year":2025,"title":"MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG).","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32383"],"affected":"maxkb/maxkb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32383"},{"id":"INC-03146","date":"2025-04","year":2025,"title":"Rasa Pro — Vulnerability (CVE-2025-32377)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-32377"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32377"},{"id":"INC-02478","date":"2025-04","year":2025,"title":"Cursor — Vulnerability (CVE-2025-32018)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32018"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32018"},{"id":"INC-03386","date":"2025-04","year":2025,"title":"YoutubeDLSharp — Vulnerability (CVE-2025-43858)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-43858"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43858"},{"id":"INC-02579","date":"2025-04","year":2025,"title":"Flowise <= 2.2.3 is vulnerable to SQL Injection.","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-29189"],"affected":"flowiseai/flowise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29189"},{"id":"INC-03294","date":"2025-04","year":2025,"title":"The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all ...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1512"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1512"},{"id":"INC-02748","date":"2025-04","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_r...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-21939"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21939"},{"id":"INC-02535","date":"2025-04","year":2025,"title":"DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command.","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-26268"],"affected":"dragonflydb/dragonfly","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26268"},{"id":"INC-02939","date":"2025-04","year":2025,"title":"n8n — Xss (CVE-2025-46343)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46343"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46343"},{"id":"INC-02516","date":"2025-04","year":2025,"title":"Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-29720"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29720"},{"id":"INC-02909","date":"2025-04","year":2025,"title":"Missing Authorization vulnerability in Wilson OpenAI Tools for WordPress & WooCommerce openai-tools-for-wp-wc allows Exploiting Incorrectly Configured Access Control Security Le...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-31843"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31843"},{"id":"INC-02731","date":"2025-04","year":2025,"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31564"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31564"},{"id":"INC-10488","date":"2025-04","year":2025,"title":"NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23249","CVE-2025-23250","CVE-2025-23251"],"affected":"nvidia/nemo, apple/macos, linux/linux_kernel, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23249"},{"id":"INC-10489","date":"2025-04","year":2025,"title":"AutoGPT — Ssrf (CVE-2025-31490)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31490"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31490"},{"id":"INC-10490","date":"2025-04","year":2025,"title":"AutoGPT — Path Traversal (CVE-2025-31491)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-31491"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31491"},{"id":"INC-10491","date":"2025-04","year":2025,"title":"AutoGPT — Vulnerability (CVE-2025-31494)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-31494"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31494"},{"id":"INC-10492","date":"2025-04","year":2025,"title":"YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-46348"],"affected":"composer/yeswiki/yeswiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46348"},{"id":"INC-10493","date":"2025-04","year":2025,"title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-46349"],"affected":"composer/yeswiki/yeswiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-46349"},{"id":"INC-10494","date":"2025-04","year":2025,"title":"org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32970"],"affected":"maven/org.xwiki.platform:xwiki-platform-wysiwyg-api, maven/org.xwiki.platform:xwiki-platform-wysiwyg-api,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32970"},{"id":"INC-10495","date":"2025-04","year":2025,"title":"React Router allows pre-render data spoofing on React-Router framework mode","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43865"],"affected":"npm/react-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43865"},{"id":"INC-10496","date":"2025-04","year":2025,"title":"uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-26994"],"affected":"go/github.com/refraction-networking/utls","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-26994"},{"id":"INC-10497","date":"2025-04","year":2025,"title":"Laravel Starter Cross Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-26159"],"affected":"composer/nasirkhan/laravel-starter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26159"},{"id":"INC-10498","date":"2025-04","year":2025,"title":"XSS in the /download Endpoint of the JPA Web API","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-32950","CVE-2025-32951","CVE-2025-32960","CVE-2025-32961"],"affected":"maven/com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32961"},{"id":"INC-10499","date":"2025-04","year":2025,"title":"OctoPrint Authenticated Reverse Proxy Page Authentication Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-32788"],"affected":"pip/octoprint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32788"},{"id":"INC-10500","date":"2025-04","year":2025,"title":"Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5w6v-399v-w3cc"},{"id":"INC-10501","date":"2025-04","year":2025,"title":"OpenCMS Cross-Site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-42699","CVE-2024-5520"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42699"},{"id":"INC-10502","date":"2025-04","year":2025,"title":"OpenCMS cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41446"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41446"},{"id":"INC-10503","date":"2025-04","year":2025,"title":"QMarkdown Cross-Site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-43954"],"affected":"npm/@quasar/quasar-ui-qmarkdown","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-43954"},{"id":"INC-10504","date":"2025-04","year":2025,"title":"Crawl4AI SSRF vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-28197"],"affected":"pip/Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-28197"},{"id":"INC-10505","date":"2025-04","year":2025,"title":"Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41447"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41447"},{"id":"INC-10506","date":"2025-04","year":2025,"title":"ash_authentication has email link auto-click account confirmation vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32782"],"affected":"erlang/ash_authentication","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32782"},{"id":"INC-10507","date":"2025-04","year":2025,"title":"Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32445"],"affected":"go/github.com/argoproj/argo-events","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32445"},{"id":"INC-10508","date":"2025-04","year":2025,"title":"Formie has XSS vulnerability for email notification content for preview","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-32426"],"affected":"composer/verbb/formie","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-32426"},{"id":"INC-10509","date":"2025-04","year":2025,"title":"Silverstripe Framework has a XSS vulnerability in HTML editor","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30148"],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30148"},{"id":"INC-10510","date":"2025-04","year":2025,"title":"ibexa/fieldtype-richtext allows access to external entities in XML","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/ibexa/fieldtype-richtext","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cj3w-g42v-wcj6"},{"id":"INC-10511","date":"2025-04","year":2025,"title":"wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/wallabag/wallabag","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5pm7-cp8f-p2c2"},{"id":"INC-10512","date":"2025-04","year":2025,"title":"Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-31672"],"affected":"maven/org.apache.poi:poi-ooxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31672"},{"id":"INC-10513","date":"2025-04","year":2025,"title":"Magento Improper Access Control leads to Security feature bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-27188","CVE-2025-27190","CVE-2025-27191","CVE-2025-27192"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27191"},{"id":"INC-10514","date":"2025-04","year":2025,"title":"Pimcore's Admin Classic Bundle allows HTML Injection","severity":"Low","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30166"],"affected":"composer/pimcore/admin-ui-classic-bundle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30166"},{"id":"INC-10515","date":"2025-04","year":2025,"title":"Picklescan missing detection when calling built-in python library function timeit.timeit()","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v7x6-rv5q-mhwc"},{"id":"INC-10516","date":"2025-04","year":2025,"title":"Picklescan failed to detect to some unsafe global function in Numpy library","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fj43-3qmq-673f"},{"id":"INC-10517","date":"2025-04","year":2025,"title":"js-object-utilities Vulnerable to Prototype Pollution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-28269"],"affected":"npm/js-object-utilities","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-28269"},{"id":"INC-10518","date":"2025-04","year":2025,"title":"tarteaucitron.js allows prototype pollution via custom text injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31475"],"affected":"npm/tarteaucitronjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31475"},{"id":"INC-10519","date":"2025-04","year":2025,"title":"The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-31487"],"affected":"maven/org.xwiki.contrib.jira:jira-macro-default","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31487"},{"id":"INC-10520","date":"2025-04","year":2025,"title":"jupyterlab-git has a command injection vulnerability in \"Open Git Repository in Terminal\"","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-30370"],"affected":"pip/jupyterlab-git","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30370"},{"id":"INC-10521","date":"2025-04","year":2025,"title":"Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-31720","CVE-2025-31721","CVE-2025-31727","CVE-2025-31728"],"affected":"maven/org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31727"},{"id":"INC-10522","date":"2025-04","year":2025,"title":"Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-29049"],"affected":"npm/mathlive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-929m-phjg-qwcc"},{"id":"INC-10523","date":"2025-04","year":2025,"title":"Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27427"],"affected":"maven/org.apache.activemq:artemis-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27427"},{"id":"INC-10524","date":"2025-04","year":2025,"title":"Drupal AI Vulnerable to OS Command Injection via Optional Automator Types","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31692"],"affected":"composer/drupal/ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31692"},{"id":"INC-10525","date":"2025-04","year":2025,"title":"Drupal AI Vulnerable to OS Command Injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-31693"],"affected":"composer/drupal/ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31693"},{"id":"INC-10526","date":"2025-04","year":2025,"title":"Drupal AI Cross-Site Request Forgery (CSRF) vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-31677"],"affected":"composer/drupal/ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31677"},{"id":"INC-10527","date":"2025-04","year":2025,"title":"Drupal AI Missing Authorization vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-31678"],"affected":"composer/drupal/ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-31678"},{"id":"INC-10529","date":"2025-04","year":2025,"title":"Malware in @reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5cq2-m4gq-f8j3"},{"id":"INC-10530","date":"2025-04","year":2025,"title":"Malware in @reserach_org_jfhalsdhfkslsfds/openai-server-skfghdg","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/@reserach_org_jfhalsdhfkslsfds/openai-server-skfghdg","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r6hh-8vfr-qg79"},{"id":"INC-02568","date":"2025-03","year":2025,"title":"FastGPT — Vulnerability (CVE-2025-27600)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27600"],"affected":"fastgpt/fastgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27600"},{"id":"INC-02180","date":"2025-03","year":2025,"title":"A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1497"],"affected":"mljar/plotai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1497"},{"id":"INC-02733","date":"2025-03","year":2025,"title":"In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-10950"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10950"},{"id":"INC-02739","date":"2025-03","year":2025,"title":"In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10954"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10954"},{"id":"INC-03327","date":"2025-03","year":2025,"title":"Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests.","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-7764"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7764"},{"id":"INC-02644","date":"2025-03","year":2025,"title":"GPT Academic provides interactive interfaces for large language models.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31224","CVE-2025-25185"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25185"},{"id":"INC-02881","date":"2025-03","year":2025,"title":"Mesop — Prompt Injection (CVE-2025-30358)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-30358"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30358"},{"id":"INC-02166","date":"2025-03","year":2025,"title":"A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the host file system.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-10940"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10940"},{"id":"INC-03025","date":"2025-03","year":2025,"title":"picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1944","CVE-2025-1945"],"affected":"mmaitre314/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1944"},{"id":"INC-02740","date":"2025-03","year":2025,"title":"In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its...","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6577"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6577"},{"id":"INC-02165","date":"2025-03","year":2025,"title":"A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user coo...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-13060"],"affected":"mintplexlabs/anythingllm_docker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-13060"},{"id":"INC-03331","date":"2025-03","year":2025,"title":"Vim — Vulnerability (CVE-2025-27423)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27423"],"affected":"vim/vim, netapp/hci_compute_node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27423"},{"id":"INC-02750","date":"2025-03","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for the freeing of relinquished volume The freeing of relinquished volum...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52982"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-52982"},{"id":"INC-02167","date":"2025-03","year":2025,"title":"A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10252"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10252"},{"id":"INC-02175","date":"2025-03","year":2025,"title":"A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0185"],"affected":"dify/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0185"},{"id":"INC-03031","date":"2025-03","year":2025,"title":"Pinecone — Xss (CVE-2025-27155)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27155"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27155"},{"id":"INC-02315","date":"2025-03","year":2025,"title":"An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multi...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10650"],"affected":"gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10650"},{"id":"INC-02599","date":"2025-03","year":2025,"title":"gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10707"],"affected":"gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10707"},{"id":"INC-02645","date":"2025-03","year":2025,"title":"GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_e...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-11030"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11030"},{"id":"INC-02752","date":"2025-03","year":2025,"title":"In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-11031"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11031"},{"id":"INC-02147","date":"2025-03","year":2025,"title":"A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12065"],"affected":"hliu/llava","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12065"},{"id":"INC-02142","date":"2025-03","year":2025,"title":"A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12074","CVE-2025-0187"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0187"},{"id":"INC-02140","date":"2025-03","year":2025,"title":"A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10481"],"affected":"comfy/comfyui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10481"},{"id":"INC-02348","date":"2025-03","year":2025,"title":"automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10935"],"affected":"automatic1111/stable-diffusion-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10935"},{"id":"INC-02314","date":"2025-03","year":2025,"title":"An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a spec...","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-11044"],"affected":"automatic1111/stable-diffusion-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11044"},{"id":"INC-02139","date":"2025-03","year":2025,"title":"A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a Git...","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11045"],"affected":"automatic1111/stable-diffusion-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11045"},{"id":"INC-02163","date":"2025-03","year":2025,"title":"A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12374"],"affected":"automatic1111/stable-diffusion-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12374"},{"id":"INC-02148","date":"2025-03","year":2025,"title":"A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12375"],"affected":"automatic1111/stable-diffusion-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12375"},{"id":"INC-02151","date":"2025-03","year":2025,"title":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-11037"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11037"},{"id":"INC-02811","date":"2025-03","year":2025,"title":"langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /co...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12775"],"affected":"langgenius/dify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12775"},{"id":"INC-10536","date":"2025-03","year":2025,"title":"NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23360"],"affected":"nvidia/nemo, apple/macos, linux/linux_kernel, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23360"},{"id":"INC-10537","date":"2025-03","year":2025,"title":"An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11173"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11173"},{"id":"INC-10538","date":"2025-03","year":2025,"title":"A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8018"],"affected":"pribai/privategpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8018"},{"id":"INC-10539","date":"2025-03","year":2025,"title":"AutoGPT — Ssrf (CVE-2025-22603)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-22603"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22603"},{"id":"INC-10540","date":"2025-03","year":2025,"title":"AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE).","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1040"],"affected":"agpt/autogpt_platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1040"},{"id":"INC-10541","date":"2025-03","year":2025,"title":"A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9340"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9340"},{"id":"INC-10542","date":"2025-03","year":2025,"title":"Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-30223"],"affected":"go/github.com/beego/beego, go/github.com/beego/beego/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30223"},{"id":"INC-10543","date":"2025-03","year":2025,"title":"array-init-cursor is unsound when used with types that implement `Drop`","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/array-init-cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-67r5-rqwv-9p9q"},{"id":"INC-10544","date":"2025-03","year":2025,"title":"Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-28254"],"affected":"composer/leantime/leantime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jf6p-4hgv-v6qh"},{"id":"INC-10545","date":"2025-03","year":2025,"title":"Django TomSelect incomplete escaping of dangerous characters in widget attributes","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/django-tomselect","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-785h-76cm-cpmf"},{"id":"INC-10546","date":"2025-03","year":2025,"title":"Directus's S3 assets become unavailable after a burst of HEAD requests","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30350"],"affected":"npm/directus, npm/@directus/storage-driver-s3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30350"},{"id":"INC-10547","date":"2025-03","year":2025,"title":"Directus's S3 assets become unavailable after a burst of malformed transformations","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30225"],"affected":"npm/directus, npm/@directus/storage-driver-s3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30225"},{"id":"INC-10548","date":"2025-03","year":2025,"title":"SageMaker Workflow component allows possibility of MD5 hash collisions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0508"],"affected":"pip/sagemaker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0508"},{"id":"INC-10549","date":"2025-03","year":2025,"title":"LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-48057","CVE-2024-9900"],"affected":"go/github.com/mudler/LocalAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9900"},{"id":"INC-10550","date":"2025-03","year":2025,"title":"AgentScope path traversal vulnerability","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-8537","CVE-2024-8551"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8537"},{"id":"INC-10551","date":"2025-03","year":2025,"title":"AgentScope Deserialization Vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8502"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8502"},{"id":"INC-10552","date":"2025-03","year":2025,"title":"AgentScope stored cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8556"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8556"},{"id":"INC-10553","date":"2025-03","year":2025,"title":"AgentScope Cross-Origin Resource Sharing (CORS) vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-8487"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8487"},{"id":"INC-10554","date":"2025-03","year":2025,"title":"AgentScope directory traversal vulnerability in /read-examples","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8438","CVE-2024-8524"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8524"},{"id":"INC-10555","date":"2025-03","year":2025,"title":"AgentScope arbitrary file download vulnerability in rpc_agent_client","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-8501"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8501"},{"id":"INC-10557","date":"2025-03","year":2025,"title":"Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8053"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8053"},{"id":"INC-10558","date":"2025-03","year":2025,"title":"Open WebUI denial of service through endpoint for converting markdown","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7983"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7983"},{"id":"INC-10560","date":"2025-03","year":2025,"title":"PyTorch Lightning denial of service vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8020"],"affected":"pip/pytorch-lightning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8020"},{"id":"INC-10562","date":"2025-03","year":2025,"title":"Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7035"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7035"},{"id":"INC-03427","date":"2025-03","year":2025,"title":"PyTorch Lightning path traversal vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5452","CVE-2024-5980","CVE-2024-8019"],"affected":"pip/pytorch-lightning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8019"},{"id":"INC-10567","date":"2025-03","year":2025,"title":"Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-7044"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7044"},{"id":"INC-10571","date":"2025-03","year":2025,"title":"Open WebUI Allows Arbitrary File Reading and Deletion","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7043"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7043"},{"id":"INC-10573","date":"2025-03","year":2025,"title":"LoLLMS Code Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6982"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6982"},{"id":"INC-10574","date":"2025-03","year":2025,"title":"llama-index-packs-finchat SQL Injection vulnerability","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12909"],"affected":"pip/llama-index-packs-finchat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12909"},{"id":"INC-10575","date":"2025-03","year":2025,"title":"Open WebUI has vulnerable dependency on starlette via fastapi","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w466-2wfc-8g58"},{"id":"INC-10576","date":"2025-03","year":2025,"title":"LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11958"],"affected":"pip/llama-index-retrievers-duckdb-retriever","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11958"},{"id":"INC-10577","date":"2025-03","year":2025,"title":"Feast Cross-Origin Resource Sharing vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-11602"],"affected":"pip/feast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11602"},{"id":"INC-10578","date":"2025-03","year":2025,"title":"InvokeAI Uncontrolled Resource Consumption vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11043"],"affected":"pip/InvokeAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11043"},{"id":"INC-10579","date":"2025-03","year":2025,"title":"InvokeAI Arbitrary File Deletion vulnerability","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11042"],"affected":"pip/InvokeAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11042"},{"id":"INC-10580","date":"2025-03","year":2025,"title":"InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10821"],"affected":"pip/InvokeAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10821"},{"id":"INC-10581","date":"2025-03","year":2025,"title":"DB-GPT vulnerable to Arbitrary File Upload with Path Traversal","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10902"],"affected":"pip/dbgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10902"},{"id":"INC-10582","date":"2025-03","year":2025,"title":"Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-2536"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2536"},{"id":"INC-10583","date":"2025-03","year":2025,"title":"Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-30152"],"affected":"composer/sylius/paypal-plugin, composer/sylius/paypal-plugin, composer/sylius/paypal-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30152"},{"id":"INC-10584","date":"2025-03","year":2025,"title":"Clickstorm SEO Allows Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-30081"],"affected":"composer/clickstorm/cs-seo, composer/clickstorm/cs-seo, composer/clickstorm/cs-seo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30081"},{"id":"INC-10585","date":"2025-03","year":2025,"title":"Additional TCA Allows Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-30083"],"affected":"composer/codingms/additional-tca, composer/codingms/additional-tca","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30083"},{"id":"INC-10586","date":"2025-03","year":2025,"title":"TastyIgniter Has an Incorrect Access Control Vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-44314"],"affected":"composer/tastyigniter/tastyigniter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-44314"},{"id":"INC-10587","date":"2025-03","year":2025,"title":"PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/PostQuantum-Feldman-VSS","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v432-7f47-9g94"},{"id":"INC-10588","date":"2025-03","year":2025,"title":"tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-30066"],"affected":"actions/tj-actions/changed-files","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-30066"},{"id":"INC-10589","date":"2025-03","year":2025,"title":"Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-29779"],"affected":"pip/PostQuantum-Feldman-VSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29779"},{"id":"INC-10590","date":"2025-03","year":2025,"title":"Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2025-29780"],"affected":"pip/PostQuantum-Feldman-VSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29780"},{"id":"INC-10591","date":"2025-03","year":2025,"title":"JS Html Sanitizer allows XSS when used with contentEditable","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-29771"],"affected":"npm/@jitbit/htmlsanitizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29771"},{"id":"INC-10592","date":"2025-03","year":2025,"title":"xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-29774","CVE-2025-29775"],"affected":"npm/xml-crypto, npm/xml-crypto, npm/xml-crypto","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-29775"},{"id":"INC-10593","date":"2025-03","year":2025,"title":"Froxlor has an HTML Injection Vulnerability","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-48958"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48958"},{"id":"INC-10594","date":"2025-03","year":2025,"title":"Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-24070"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.linux-x64, nuget/Microsoft.AspNetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24070"},{"id":"INC-10595","date":"2025-03","year":2025,"title":"Azure PromptFlow remote code execution related to Jinja templates","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-24986"],"affected":"pip/promptflow-core, pip/promptflow-tools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24986"},{"id":"INC-10596","date":"2025-03","year":2025,"title":"LF Edge eKuiper allows Stored XSS in Rules Functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52812"],"affected":"go/github.com/lf-edge/ekuiper, go/github.com/lf-edge/ekuiper/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52812"},{"id":"INC-10597","date":"2025-03","year":2025,"title":"LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-27136"],"affected":"maven/io.github.robothy:local-s3-rest","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-47qw-ccjm-9c2c"},{"id":"INC-10598","date":"2025-03","year":2025,"title":"qcp has possible crash/DOS in some build configurations","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-4432"],"affected":"rust/qcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fmwf-c46w-r8qm"},{"id":"INC-10599","date":"2025-03","year":2025,"title":"Vue I18n Allows Prototype Pollution in `handleFlatJson`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27597"],"affected":"npm/vue-i18n, npm/vue-i18n, npm/petite-vue-i18n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27597"},{"id":"INC-10600","date":"2025-03","year":2025,"title":"axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-27152"],"affected":"npm/axios, npm/axios","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27152"},{"id":"INC-10601","date":"2025-03","year":2025,"title":"Fleet has SAML authentication vulnerability due to improper SAML response validation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27509"],"affected":"go/github.com/fleetdm/fleet/v4, go/github.com/fleetdm/fleet/v4, go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27509"},{"id":"INC-10602","date":"2025-03","year":2025,"title":"Envoy Gateway Log Injection Vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25294"],"affected":"go/github.com/envoyproxy/gateway, go/github.com/envoyproxy/gateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25294"},{"id":"INC-10603","date":"2025-03","year":2025,"title":"Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-27622","CVE-2025-27623"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27623"},{"id":"INC-10604","date":"2025-03","year":2025,"title":"Spacy-LLM Server-Side Template Injection (SSTI) vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-25362"],"affected":"pip/spacy-llm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25362"},{"id":"INC-10605","date":"2025-03","year":2025,"title":"REDAXO allows Arbitrary File Upload in the mediapool page","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27411"],"affected":"composer/redaxo/source","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27411"},{"id":"INC-10606","date":"2025-03","year":2025,"title":"IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27507"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27507"},{"id":"INC-10607","date":"2025-03","year":2025,"title":"Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1716"],"affected":"pip/picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1716"},{"id":"INC-10608","date":"2025-03","year":2025,"title":"PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1889"],"affected":"pip/picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1889"},{"id":"INC-10609","date":"2025-03","year":2025,"title":"Magento LTS vulnerable to stored XSS in theme config fields","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27400"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27400"},{"id":"INC-10610","date":"2025-03","year":2025,"title":"mavo DOM Clobbering vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53388"],"affected":"npm/mavo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53388"},{"id":"INC-10611","date":"2025-03","year":2025,"title":"Stage.js DOM Clobbering vulnerabilty","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53386"],"affected":"npm/stage-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53386"},{"id":"INC-10612","date":"2025-03","year":2025,"title":"PrismJS DOM Clobbering vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53382"],"affected":"npm/prismjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53382"},{"id":"INC-10613","date":"2025-03","year":2025,"title":"Formwork has a cross-site scripting (XSS) vulnerability in Site title","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/getformwork/formwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vf6x-59hh-332f"},{"id":"INC-10618","date":"2025-03","year":2025,"title":"Malware in node-llama-cpp-project","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/node-llama-cpp-project","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f6xv-ph6q-v4cq"},{"id":"INC-10623","date":"2025-03","year":2025,"title":"Malware in auth0-langgraph-state-rag-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/auth0-langgraph-state-rag-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-23vc-p8vv-6cwc"},{"id":"INC-02307","date":"2025-02","year":2025,"title":"An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-55241"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55241"},{"id":"INC-03344","date":"2025-02","year":2025,"title":"vLLM — Vulnerability (CVE-2025-25183)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25183"],"affected":"vllm/vllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25183"},{"id":"INC-03012","date":"2025-02","year":2025,"title":"PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the int...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-12366"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12366"},{"id":"INC-02310","date":"2025-02","year":2025,"title":"An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which...","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-3303"],"affected":"gitlab/gitlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3303"},{"id":"INC-02973","date":"2025-02","year":2025,"title":"NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a model with an ext...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-53880"],"affected":"nvidia/triton_inference_server, linux/linux_kernel, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53880"},{"id":"INC-02164","date":"2025-02","year":2025,"title":"A use-after-free flaw was found in X.Org and Xwayland.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-26594"],"affected":"tigervnc/tigervnc, x.org/x_server, x.org/xwayland, redhat/enterprise_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26594"},{"id":"INC-02744","date":"2025-02","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/dp: Fix OOB read when handling Post Cursor2 register The link_status array was not large enough to read...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-49218"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-49218"},{"id":"INC-02749","date":"2025-02","year":2025,"title":"In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() drm_gem_object_lookup will call drm_gem_object...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-49467"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-49467"},{"id":"INC-10626","date":"2025-02","year":2025,"title":"Label Studio — Path Traversal (CVE-2025-25295)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-25295"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25295"},{"id":"INC-10627","date":"2025-02","year":2025,"title":"A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533.","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39272"],"affected":"clear/clearml_enterprise_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39272"},{"id":"INC-10628","date":"2025-02","year":2025,"title":"An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-43779"],"affected":"clear/clearml_enterprise_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43779"},{"id":"INC-10629","date":"2025-02","year":2025,"title":"Spotipy's cache file, containing spotify auth token, is created with overly broad permissions","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-27154"],"affected":"pip/spotipy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27154"},{"id":"INC-10630","date":"2025-02","year":2025,"title":"copyparty renders unsanitized filenames as HTML when user uploads empty files","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27145"],"affected":"pip/copyparty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27145"},{"id":"INC-10631","date":"2025-02","year":2025,"title":"DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27108"],"affected":"npm/dom-expressions","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27108"},{"id":"INC-10632","date":"2025-02","year":2025,"title":"Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27109"],"affected":"npm/solid-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27109"},{"id":"INC-10633","date":"2025-02","year":2025,"title":"Navidrome allows an authentication bypass in Subsonic API with non-existent username","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-27112"],"affected":"go/github.com/navidrome/navidrome","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27112"},{"id":"INC-10634","date":"2025-02","year":2025,"title":"Exiv2 allows Use After Free","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-26623"],"affected":"pip/Exiv2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26623"},{"id":"INC-10635","date":"2025-02","year":2025,"title":"S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-27088"],"affected":"go/github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27088"},{"id":"INC-10636","date":"2025-02","year":2025,"title":"Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5mwf-688x-mr7x"},{"id":"INC-10637","date":"2025-02","year":2025,"title":"Authelia applies regulation separately to Username-based logins to Email-based logins","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-24806"],"affected":"go/github.com/authelia/authelia/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24806"},{"id":"INC-10638","date":"2025-02","year":2025,"title":"AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-24895"],"affected":"nuget/CIE.AspNetCore.Authentication","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24895"},{"id":"INC-10639","date":"2025-02","year":2025,"title":"The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-24894"],"affected":"nuget/SPID.AspNetCore.Authentication","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24894"},{"id":"INC-10640","date":"2025-02","year":2025,"title":"@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25285"],"affected":"npm/@octokit/endpoint, npm/@octokit/endpoint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25285"},{"id":"INC-10641","date":"2025-02","year":2025,"title":"Uncaught Panic in ORML Rewards Pallet","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/orml-rewards","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5v93-9mqw-p9mh"},{"id":"INC-10644","date":"2025-02","year":2025,"title":"Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25202"],"affected":"erlang/ash_authentication","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25202"},{"id":"INC-10645","date":"2025-02","year":2025,"title":"Server-Side Request Forgery (SSRF) in activitypub_federation","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-25194"],"affected":"rust/activitypub_federation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25194"},{"id":"INC-10646","date":"2025-02","year":2025,"title":"xml2rfc has file inclusion irregularities","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/xml2rfc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-432c-wxpg-m4q3"},{"id":"INC-10647","date":"2025-02","year":2025,"title":"WhoDB has a path traversal opening Sqlite3 database","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-24786"],"affected":"go/github.com/clidey/whodb/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24786"},{"id":"INC-10648","date":"2025-02","year":2025,"title":"Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-24981"],"affected":"npm/@nuxtjs/mdc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24981"},{"id":"INC-10649","date":"2025-02","year":2025,"title":"Apache James vulnerable to denial of service through JMAP HTML to text conversion","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45626"],"affected":"maven/org.apache.james:james-server-jmap-draft, maven/org.apache.james:james-server-jmap-draft","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45626"},{"id":"INC-10650","date":"2025-02","year":2025,"title":"eazy-logger prototype pollution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-57075"],"affected":"npm/eazy-logger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-57075"},{"id":"INC-10651","date":"2025-02","year":2025,"title":"utils-extend Prototype Pollution","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-57077"],"affected":"npm/utils-extend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-57077"},{"id":"INC-10652","date":"2025-02","year":2025,"title":"Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/better-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9x4v-xfq5-m8x5"},{"id":"INC-10653","date":"2025-02","year":2025,"title":"Plenti - Code Injection - Denial of Services","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-26260"],"affected":"go/github.com/plentico/plenti","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-26260"},{"id":"INC-10654","date":"2025-02","year":2025,"title":"MobSF Partial Denial of Service (DoS)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-24803","CVE-2025-24804"],"affected":"pip/mobsf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24804"},{"id":"INC-10655","date":"2025-02","year":2025,"title":"Browsershot Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1022"],"affected":"composer/spatie/browsershot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1022"},{"id":"INC-10656","date":"2025-02","year":2025,"title":"Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-24370"],"affected":"pip/django-unicorn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24370"},{"id":"INC-10657","date":"2025-02","year":2025,"title":"PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23210"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23210"},{"id":"INC-10658","date":"2025-02","year":2025,"title":"Malware in openai-realtime-console","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openai-realtime-console","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7qqq-9qr8-xf2f"},{"id":"INC-10659","date":"2025-02","year":2025,"title":"Malware in autogen_studio","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/autogen_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p6xq-v995-xh2v"},{"id":"INC-10663","date":"2025-02","year":2025,"title":"Malware in auth0-langchain-rag-js","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/auth0-langchain-rag-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gr63-x6fg-h3wg"},{"id":"INC-02867","date":"2025-01","year":2025,"title":"MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG).","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56137"],"affected":"maxkb/maxkb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56137"},{"id":"INC-02803","date":"2025-01","year":2025,"title":"LangChain4j-AIDeepin — Vulnerability (CVE-2025-21604)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-21604"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21604"},{"id":"INC-03277","date":"2025-01","year":2025,"title":"The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in all versions up to,...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12852"],"affected":"wedevs/happy_addons_for_elementor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12852"},{"id":"INC-02827","date":"2025-01","year":2025,"title":"LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-15690"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-15690"},{"id":"INC-02946","date":"2025-01","year":2025,"title":"nbgrader — Vulnerability (CVE-2025-23205)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-23205"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23205"},{"id":"INC-03293","date":"2025-01","year":2025,"title":"The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing c...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12471"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12471"},{"id":"INC-02150","date":"2025-01","year":2025,"title":"A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) v...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24426","CVE-2024-24442","CVE-2024-24443","CVE-2024-24444","CVE-2024-24445","CVE-2024-24446","CVE-2024-24449","CVE-2024-24450","CVE-2024-24451"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24442"},{"id":"INC-03281","date":"2025-01","year":2025,"title":"The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_a...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-13698"],"affected":"astoundify/jobify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-13698"},{"id":"INC-03268","date":"2025-01","year":2025,"title":"The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12473","CVE-2024-12605","CVE-2024-12606"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12605"},{"id":"INC-02347","date":"2025-01","year":2025,"title":"Authenticated command injection in the filename of a <redacted>.exe request leads to remote code execution as the root user.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43649","CVE-2024-43650","CVE-2024-43651","CVE-2024-43653","CVE-2024-43654","CVE-2024-43655","CVE-2024-43656","CVE-2024-43657"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43649"},{"id":"INC-02983","date":"2025-01","year":2025,"title":"Open source machine learning framework.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49375"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49375"},{"id":"INC-10664","date":"2025-01","year":2025,"title":"Deep Java Library path traversal issue","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0851"],"affected":"maven/ai.djl:api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0851"},{"id":"INC-10665","date":"2025-01","year":2025,"title":"Dolibarr Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-55227","CVE-2024-55228"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55228"},{"id":"INC-10666","date":"2025-01","year":2025,"title":"ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-24359"],"affected":"pip/asteval","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24359"},{"id":"INC-10667","date":"2025-01","year":2025,"title":"XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45294","CVE-2024-52007","CVE-2024-52807"],"affected":"maven/org.hl7.fhir.publisher:org.hl7.fhir.publisher.core, maven/org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52807"},{"id":"INC-10668","date":"2025-01","year":2025,"title":"Directus has a DOM-Based cross-site scripting (XSS) via layout_options","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9qrm-48qf-r2rw"},{"id":"INC-10669","date":"2025-01","year":2025,"title":"Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-55488"],"affected":"nuget/Umbraco.Cms.Infrastructure","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55488"},{"id":"INC-10670","date":"2025-01","year":2025,"title":"DoS in Cilium agent DNS proxy from crafted DNS responses","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-23028"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23028"},{"id":"INC-10671","date":"2025-01","year":2025,"title":"gix-worktree-state nonexclusive checkout sets executable files world-writable","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-22620"],"affected":"rust/gix-worktree-state","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22620"},{"id":"INC-10672","date":"2025-01","year":2025,"title":"Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-22131"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22131"},{"id":"INC-10673","date":"2025-01","year":2025,"title":"Cross-Site Request Forgery in CodeChecker API","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-53829"],"affected":"pip/codechecker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53829"},{"id":"INC-10674","date":"2025-01","year":2025,"title":"Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10846"],"affected":"go/github.com/compose-spec/compose-go/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10846"},{"id":"INC-10675","date":"2025-01","year":2025,"title":"Authenticated Stored XSS in YesWiki","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-24017","CVE-2025-24018"],"affected":"composer/yeswiki/yeswiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24018"},{"id":"INC-10676","date":"2025-01","year":2025,"title":"XSS/HTML Injection Vulnerability in Umbraco Backoffice Components","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-24012"],"affected":"npm/@umbraco-cms/backoffice, npm/@umbraco-cms/backoffice, nuget/Umbraco.Cms.StaticAssets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24012"},{"id":"INC-10677","date":"2025-01","year":2025,"title":"Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23221"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23221"},{"id":"INC-10678","date":"2025-01","year":2025,"title":"Websites were able to send any requests to the development server and read the response in vite","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-24010"],"affected":"npm/vite, npm/vite, npm/vite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-24010"},{"id":"INC-10679","date":"2025-01","year":2025,"title":"KaTeX \\htmlData does not validate attribute names","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-23207"],"affected":"npm/katex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23207"},{"id":"INC-10680","date":"2025-01","year":2025,"title":"LibreNMS Misc Section Stored Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23200"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23200"},{"id":"INC-10681","date":"2025-01","year":2025,"title":"Sentry's improper authentication on SAML SSO process allows user impersonation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-22146"],"affected":"pip/sentry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22146"},{"id":"INC-10682","date":"2025-01","year":2025,"title":"Silverstripe Framework has a XSS in form messages","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53277"],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53277"},{"id":"INC-10683","date":"2025-01","year":2025,"title":"Silverstripe Framework has a XSS via insert media remote file oembed","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47605"],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47605"},{"id":"INC-10684","date":"2025-01","year":2025,"title":"Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-21176"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21176"},{"id":"INC-10685","date":"2025-01","year":2025,"title":"Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-21172"],"affected":"nuget/Microsoft.NetCore.App.Runtime.linux-arm, nuget/Microsoft.NetCore.App.Runtime.linux-arm64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21172"},{"id":"INC-10686","date":"2025-01","year":2025,"title":"Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-21171"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21171"},{"id":"INC-10687","date":"2025-01","year":2025,"title":"Denial of Service in Keycloak Server via Security Headers","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11734"],"affected":"maven/org.keycloak:keycloak-quarkus-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11734"},{"id":"INC-10688","date":"2025-01","year":2025,"title":"jte's HTML templates containing Javascript template strings are subject to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23026"],"affected":"maven/gg.jte:jte-runtime, maven/gg.jte:jte","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23026"},{"id":"INC-10689","date":"2025-01","year":2025,"title":"Vaultwarden HTML injection vulnerability","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-55224"],"affected":"rust/vaultwarden","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55224"},{"id":"INC-10690","date":"2025-01","year":2025,"title":"Composio Command Execution vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53526"],"affected":"pip/composio-julep, pip/composio-openai, pip/composio-claude","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53526"},{"id":"INC-10691","date":"2025-01","year":2025,"title":"Soft Serve vulnerable to path traversal attacks","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-22130"],"affected":"go/github.com/charmbracelet/soft-serve","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-22130"},{"id":"INC-10692","date":"2025-01","year":2025,"title":"Apache OpenMeetings vulnerable to Deserialization of Untrusted Data","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54676"],"affected":"maven/org.apache.openmeetings:openmeetings-parent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54676"},{"id":"INC-10693","date":"2025-01","year":2025,"title":"PHP-Textile has persistent XSS vulnerability in image link handling","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/netcarver/textile","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-95m2-chm4-mq7m"},{"id":"INC-10694","date":"2025-01","year":2025,"title":"fetch: Authorization headers not dropped when redirecting cross-origin","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-21620"],"affected":"rust/deno, rust/deno, rust/deno_fetch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21620"},{"id":"INC-10695","date":"2025-01","year":2025,"title":"Grav Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-35498"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35498"},{"id":"INC-10696","date":"2025-01","year":2025,"title":"REDAXO CMS Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-46209"],"affected":"composer/redaxo/source","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46209"},{"id":"INC-10697","date":"2025-01","year":2025,"title":"PhpSpreadsheet allows bypass XSS sanitizer using the javascript protocol and special characters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56410","CVE-2024-56411","CVE-2024-56412"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56412"},{"id":"INC-10698","date":"2025-01","year":2025,"title":"PhpSpreadsheet allows unauthorized Reflected XSS in Currency.php file","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56366","CVE-2024-56408","CVE-2024-56409"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56409"},{"id":"INC-10699","date":"2025-01","year":2025,"title":"Karmada PULL Mode Cluster Privilege Escalation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-56513"],"affected":"go/github.com/karmada-io/karmada","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56513"},{"id":"INC-10700","date":"2025-01","year":2025,"title":"phpMyFAQ Vulnerable to Stored HTML Injection at FAQ","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-56199"],"affected":"composer/thorsten/phpmyfaq, composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56199"},{"id":"INC-10703","date":"2025-01","year":2025,"title":"Malware in kubeflow-pipelines","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/kubeflow-pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fqxm-2574-xp7x"},{"id":"INC-03793","date":"2024-12","year":2024,"title":"free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-56516"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56516"},{"id":"INC-03785","date":"2024-12","year":2024,"title":"Firecrawl — Ssrf (CVE-2024-56800)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56800"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56800"},{"id":"INC-03901","date":"2024-12","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix address wraparound in move_page_tables() On 32-bit platforms, it is possible for the express...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-53111"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53111"},{"id":"INC-03676","date":"2024-12","year":2024,"title":"ComfyUI-Impact-Pack is vulnerable to Path Traversal.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21575"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21575"},{"id":"INC-03675","date":"2024-12","year":2024,"title":"ComfyUI-Bmad-Nodes is vulnerable to Code Injection.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21576"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21576"},{"id":"INC-03674","date":"2024-12","year":2024,"title":"ComfyUI-Ace-Nodes is vulnerable to Code Injection.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21577"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21577"},{"id":"INC-14617","date":"2024-12","year":2024,"title":"The Text Prompter – Unlimited chatgpt text prompts for openai tasks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'text_prompter' shortcode ...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11896"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11896"},{"id":"INC-03428","date":"2024-12","year":2024,"title":"A security issue exists in Vertex Gemini API for customers using VPC-SC.","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12236"],"affected":"google/vertex_gemini_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12236"},{"id":"INC-03689","date":"2024-12","year":2024,"title":"Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Request Forgery.This ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54306"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54306"},{"id":"INC-10706","date":"2024-12","year":2024,"title":"LGSL has a reflected XSS at /lgsl_files/lgsl_list.php","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56517"],"affected":"composer/tltneon/lgsl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56517"},{"id":"INC-10707","date":"2024-12","year":2024,"title":"khoj has an IDOR in subscription management allows unauthorized subscription modifications","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-52294"],"affected":"pip/khoj","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52294"},{"id":"INC-10708","date":"2024-12","year":2024,"title":"lgsl Stored Cross-Site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56361"],"affected":"composer/tltneon/lgsl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56361"},{"id":"INC-10709","date":"2024-12","year":2024,"title":"Marp Core allows XSS by improper neutralization of HTML sanitization","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-56510"],"affected":"npm/@marp-team/marp-core, npm/@marp-team/marp-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-56510"},{"id":"INC-10710","date":"2024-12","year":2024,"title":"Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-23945"],"affected":"maven/org.apache.spark:spark-hive-thriftserver_2.12, maven/org.apache.spark:spark-hive-thriftserver_2.11,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23945"},{"id":"INC-10711","date":"2024-12","year":2024,"title":"QOS.CH logback-core Server-Side Request Forgery vulnerability","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12801"],"affected":"maven/ch.qos.logback:logback-core, maven/ch.qos.logback:logback-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12801"},{"id":"INC-10712","date":"2024-12","year":2024,"title":"Non-linear parsing of case-insensitive content in golang.org/x/net/html","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45338"],"affected":"go/golang.org/x/net/html","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45338"},{"id":"INC-10713","date":"2024-12","year":2024,"title":"Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-37940"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37940"},{"id":"INC-10714","date":"2024-12","year":2024,"title":"Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11993","CVE-2024-25147"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11993"},{"id":"INC-10715","date":"2024-12","year":2024,"title":"thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-55889"],"affected":"composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55889"},{"id":"INC-10716","date":"2024-12","year":2024,"title":"Ucum-java has an XXE vulnerability in XML parsing","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-55887"],"affected":"maven/org.fhir:ucum","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55887"},{"id":"INC-10717","date":"2024-12","year":2024,"title":"http4k has a potential XXE (XML External Entity Injection) vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-55875"],"affected":"maven/org.http4k:http4k-format-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55875"},{"id":"INC-10718","date":"2024-12","year":2024,"title":"Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-55633"],"affected":"pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55633"},{"id":"INC-10719","date":"2024-12","year":2024,"title":"Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-12401"],"affected":"go/github.com/cert-manager/cert-manager, go/github.com/cert-manager/cert-manager,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12401"},{"id":"INC-10720","date":"2024-12","year":2024,"title":"sigstore has insufficient validation of integration timestamp during verification","severity":"Low","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-55655"],"affected":"pip/sigstore","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55655"},{"id":"INC-10721","date":"2024-12","year":2024,"title":"unstructured XML External Entity (XXE)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-46455"],"affected":"pip/unstructured","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46455"},{"id":"INC-10722","date":"2024-12","year":2024,"title":"Hugo does not escape some attributes in internal templates","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-55601"],"affected":"go/github.com/gohugoio/hugo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55601"},{"id":"INC-10723","date":"2024-12","year":2024,"title":"Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54149"],"affected":"composer/winter/wn-cms-module, composer/winter/wn-cms-module, composer/winter/wn-cms-module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54149"},{"id":"INC-10724","date":"2024-12","year":2024,"title":"LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53457"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53457"},{"id":"INC-10725","date":"2024-12","year":2024,"title":"Directus has an HTML Injection in Comment","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54128"],"affected":"npm/directus, npm/directus, npm/@directus/app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54128"},{"id":"INC-10726","date":"2024-12","year":2024,"title":"sigstore-java has a vulnerability with bundle verification","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54140"],"affected":"maven/dev.sigstore:sigstore-java","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54140"},{"id":"INC-10727","date":"2024-12","year":2024,"title":"Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-54131"],"affected":"go/github.com/kolide/launcher","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-54131"},{"id":"INC-10728","date":"2024-12","year":2024,"title":"Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in \"Diff or Compare\" Functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53999"],"affected":"pip/mobsf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53999"},{"id":"INC-10729","date":"2024-12","year":2024,"title":"Vitess allows HTML injection in /debug/querylogz & /debug/env","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-53257"],"affected":"go/vitess.io/vitess, go/vitess.io/vitess, go/vitess.io/vitess","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53257"},{"id":"INC-10730","date":"2024-12","year":2024,"title":"Access to Archived Argo Workflows with Fake Token in `client` mode","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-53862"],"affected":"go/github.com/argoproj/argo-workflows/v3, go/github.com/argoproj/argo-workflows/v3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53862"},{"id":"INC-10731","date":"2024-12","year":2024,"title":"SimpleSAMLphp vulnerable to XXE in parsing SAML messages","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52596"],"affected":"composer/simplesamlphp/simplesamlphp, composer/simplesamlphp/simplesamlphp, composer/simplesamlphp/simplesamlphp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j5g2-q29x-cw3h"},{"id":"INC-10732","date":"2024-12","year":2024,"title":"@intlify/shared Prototype Pollution vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52810"],"affected":"npm/vue-i18n, npm/@intlify/vue-i18n-core, npm/@intlify/shared","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52810"},{"id":"INC-10733","date":"2024-12","year":2024,"title":"SimpleSAMLphp SAML2 has an XXE in parsing SAML messages","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52806"],"affected":"composer/simplesamlphp/saml2-legacy, composer/simplesamlphp/saml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52806"},{"id":"INC-10734","date":"2024-12","year":2024,"title":"veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52800"],"affected":"maven/org.verapdf:library-arlington, maven/org.verapdf:library-jakarta, maven/org.verapdf:library","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52800"},{"id":"INC-03426","date":"2024-11","year":2024,"title":"A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/priv...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4343"],"affected":"pribai/privategpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4343"},{"id":"INC-04081","date":"2024-11","year":2024,"title":"Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enable escalation of privilege via local a...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21799"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21799"},{"id":"INC-03891","date":"2024-11","year":2024,"title":"Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49038"],"affected":"microsoft/copilot_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49038"},{"id":"INC-04290","date":"2024-11","year":2024,"title":"There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9526"],"affected":"kubeflow/pipelines","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9526"},{"id":"INC-04325","date":"2024-11","year":2024,"title":"Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-generator allows Uplo...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-52384"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52384"},{"id":"INC-03956","date":"2024-11","year":2024,"title":"Lobe Chat — Ssrf (CVE-2024-32965)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-32964","CVE-2024-32965","CVE-2024-47066"],"affected":"lobehub/lobe_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32965"},{"id":"INC-04009","date":"2024-11","year":2024,"title":"Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorrectly Configured A...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-52383"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52383"},{"id":"INC-14618","date":"2024-11","year":2024,"title":"The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to i...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10874"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10874"},{"id":"INC-10743","date":"2024-11","year":2024,"title":"langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sand...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-48061"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48061"},{"id":"INC-10744","date":"2024-11","year":2024,"title":"Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticated user to potentially enable denial...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32048"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32048"},{"id":"INC-10745","date":"2024-11","year":2024,"title":"zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4311"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4311"},{"id":"INC-10746","date":"2024-11","year":2024,"title":"@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53843"],"affected":"npm/@dapperduckling/keycloak-connector-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53843"},{"id":"INC-10747","date":"2024-11","year":2024,"title":"deno_doc's HTML generator vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32468"],"affected":"rust/deno_doc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32468"},{"id":"INC-10748","date":"2024-11","year":2024,"title":"@sveltejs/kit vulnerable to XSS on dev mode 404 page","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-53261","CVE-2024-53262"],"affected":"npm/@sveltejs/kit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53261"},{"id":"INC-10749","date":"2024-11","year":2024,"title":"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/smol-toml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pqhp-25j4-6hq9"},{"id":"INC-10750","date":"2024-11","year":2024,"title":"GeoNode Server Side Request forgery","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40017"],"affected":"pip/geonode","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40017"},{"id":"INC-10751","date":"2024-11","year":2024,"title":"Django Filer Unrestricted Upload of File with Dangerous Type","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11404"],"affected":"pip/django-filer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11404"},{"id":"INC-10752","date":"2024-11","year":2024,"title":"HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52595"],"affected":"pip/lxml-html-clean","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52595"},{"id":"INC-10753","date":"2024-11","year":2024,"title":"Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-52522"],"affected":"go/github.com/rclone/rclone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52522"},{"id":"INC-10754","date":"2024-11","year":2024,"title":"Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52587"],"affected":"actions/step-security/harden-runner","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52587"},{"id":"INC-10755","date":"2024-11","year":2024,"title":"XXE in PHPSpreadsheet's XLSX reader","severity":"High","attack_vector":"other","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-45293","CVE-2024-47873","CVE-2024-48917"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48917"},{"id":"INC-10756","date":"2024-11","year":2024,"title":"Kubernetes Nil pointer dereference in KCM after v1 HPA patch request","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0793"],"affected":"go/k8s.io/kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0793"},{"id":"INC-10757","date":"2024-11","year":2024,"title":"LibreNMS has an Authenticated OS Command Injection","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-51092"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51092"},{"id":"INC-10758","date":"2024-11","year":2024,"title":"LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-51497"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51497"},{"id":"INC-10759","date":"2024-11","year":2024,"title":"LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-51495"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51495"},{"id":"INC-10760","date":"2024-11","year":2024,"title":"Stored XSS using two files in usememos/memos","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-0109"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0109"},{"id":"INC-10761","date":"2024-11","year":2024,"title":"Improper Restriction of XML External Entity Reference in dompdf/dompdf","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-3902"],"affected":"composer/dompdf/dompdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-3902"},{"id":"INC-10762","date":"2024-11","year":2024,"title":"Remote Code Execution on click of <a> Link in markdown preview","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49362"],"affected":"npm/joplin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49362"},{"id":"INC-10763","date":"2024-11","year":2024,"title":"Harbor fails to validate the user permissions when updating p2p preheat policies","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31668"],"affected":"go/github.com/goharbor/harbor/src, go/github.com/goharbor/harbor, go/github.com/goharbor/harbor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31668"},{"id":"INC-10764","date":"2024-11","year":2024,"title":"Craft CMS Arbitrary System File Read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-52292"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52292"},{"id":"INC-10765","date":"2024-11","year":2024,"title":".NET Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-21808","CVE-2023-24895","CVE-2023-24897","CVE-2023-33128","CVE-2023-35390","CVE-2023-38180","CVE-2024-43498"],"affected":"nuget/System.Formats.Nrbf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43498"},{"id":"INC-10766","date":"2024-11","year":2024,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43499"],"affected":"nuget/System.Formats.Nrbf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43499"},{"id":"INC-10767","date":"2024-11","year":2024,"title":"powertac-server XML External Entity vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-51135"],"affected":"maven/org.powertac:server-interface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51135"},{"id":"INC-10768","date":"2024-11","year":2024,"title":"Git credentials are exposed in Atlantis logs","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-52009"],"affected":"go/github.com/runatlantis/atlantis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52009"},{"id":"INC-10769","date":"2024-11","year":2024,"title":"Devtron has SQL Injection in CreateUser API","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45794"],"affected":"go/github.com/devtron-labs/devtron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45794"},{"id":"INC-10770","date":"2024-11","year":2024,"title":"HAPI FHIR XML External Entity (XXE) vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-51132"],"affected":"maven/ca.uhn.hapi.fhir:org.hl7.fhir.validation, maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51132"},{"id":"INC-10771","date":"2024-11","year":2024,"title":"Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-51735"],"affected":"go/github.com/j3ssie/osmedeus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51735"},{"id":"INC-10772","date":"2024-11","year":2024,"title":"OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49377"],"affected":"pip/OctoPrint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49377"},{"id":"INC-10773","date":"2024-11","year":2024,"title":"AgentScope uses `eval`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-48050"],"affected":"pip/agentscope","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48050"},{"id":"INC-10774","date":"2024-11","year":2024,"title":"CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-51501"],"affected":"nuget/Refit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-51501"},{"id":"INC-03691","date":"2024-10","year":2024,"title":"Cursor — Prompt Injection (CVE-2024-48919)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-48919"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48919"},{"id":"INC-14619","date":"2024-10","year":2024,"title":"A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the A...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-48139"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48139"},{"id":"INC-03423","date":"2024-10","year":2024,"title":"A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previ...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-45989","CVE-2024-48140","CVE-2024-48142"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48140"},{"id":"INC-14620","date":"2024-10","year":2024,"title":"A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-48141"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48141"},{"id":"INC-03424","date":"2024-10","year":2024,"title":"A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previous and subsequent c...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-48144"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48144"},{"id":"INC-03425","date":"2024-10","year":2024,"title":"A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat dat...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-48145"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48145"},{"id":"INC-04050","date":"2024-10","year":2024,"title":"NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory region while it is in use.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0116"],"affected":"nvidia/triton_inference_server, linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0116"},{"id":"INC-03895","date":"2024-10","year":2024,"title":"In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-48063"],"affected":"linuxfoundation/pytorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48063"},{"id":"INC-04085","date":"2024-10","year":2024,"title":"Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calcu...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9333"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9333"},{"id":"INC-03763","date":"2024-10","year":2024,"title":"Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-43610"],"affected":"microsoft/copilot_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43610"},{"id":"INC-03410","date":"2024-10","year":2024,"title":"A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6673"],"affected":"lollms/lollms_web_ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6673"},{"id":"INC-04341","date":"2024-10","year":2024,"title":"Vulnerability in the XML Database component of Oracle Database Server.","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21242"],"affected":"oracle/xml_database","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21242"},{"id":"INC-04268","date":"2024-10","year":2024,"title":"The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism t...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8901"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8901"},{"id":"INC-04256","date":"2024-10","year":2024,"title":"Taipy — Vulnerability (CVE-2024-47833)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47833"],"affected":"avaiga/taipy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47833"},{"id":"INC-03439","date":"2024-10","year":2024,"title":"ACON — Rce (CVE-2024-49361)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-49361"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49361"},{"id":"INC-10786","date":"2024-10","year":2024,"title":"langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-42835"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42835"},{"id":"INC-10787","date":"2024-10","year":2024,"title":"NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0129"],"affected":"nvidia/nemo, apple/macos, linux/linux_kernel, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0129"},{"id":"INC-10788","date":"2024-10","year":2024,"title":"Lollms vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6581"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6581"},{"id":"INC-10789","date":"2024-10","year":2024,"title":"REXML ReDoS vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-49761"],"affected":"rubygems/rexml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49761"},{"id":"INC-10790","date":"2024-10","year":2024,"title":"useragent Regular Expression Denial of Service vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26311"],"affected":"npm/useragent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26311"},{"id":"INC-10791","date":"2024-10","year":2024,"title":"insane vulnerable to Regular Expression Denial of Service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26303"],"affected":"npm/insane","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26303"},{"id":"INC-10792","date":"2024-10","year":2024,"title":"Butterfly has path/URL confusion in resource handling leading to multiple weaknesses","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47883"],"affected":"maven/org.openrefine.dependencies:butterfly","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47883"},{"id":"INC-10793","date":"2024-10","year":2024,"title":"OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47882"],"affected":"maven/org.openrefine:openrefine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47882"},{"id":"INC-10794","date":"2024-10","year":2024,"title":"OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47879"],"affected":"maven/org.openrefine:main","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47879"},{"id":"INC-10795","date":"2024-10","year":2024,"title":"Apache Syncope: Stored XSS in Console and Enduser","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38503","CVE-2024-45031"],"affected":"maven/org.apache.syncope.client:syncope-client-console","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45031"},{"id":"INC-10796","date":"2024-10","year":2024,"title":"Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38002"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38002"},{"id":"INC-10797","date":"2024-10","year":2024,"title":"Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24826","CVE-2024-25112"],"affected":"pip/exiv2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25112"},{"id":"INC-10798","date":"2024-10","year":2024,"title":"Admidio Vulnerable to HTML Injection In The Messages Section","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-47836"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47836"},{"id":"INC-10799","date":"2024-10","year":2024,"title":"VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9594"],"affected":"go/github.com/kubernetes-sigs/image-builder","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9594"},{"id":"INC-10800","date":"2024-10","year":2024,"title":"ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9506"],"affected":"npm/vue","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9506"},{"id":"INC-10801","date":"2024-10","year":2024,"title":"Hono allows bypass of CSRF Middleware by a request without Content-Type header.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-48913"],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48913"},{"id":"INC-10802","date":"2024-10","year":2024,"title":"Agent Dart is missing certificate verification checks","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-48915"],"affected":"pub/agent_dart","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48915"},{"id":"INC-10803","date":"2024-10","year":2024,"title":"SAK-50571 Sakai Kernel users created with type roleview can login as a normal user","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47876"],"affected":"maven/org.sakaiproject.kernel:sakai-kernel-impl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47876"},{"id":"INC-10804","date":"2024-10","year":2024,"title":"Eclipse Jetty URI parsing of invalid authority","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6763"],"affected":"maven/org.eclipse.jetty:jetty-http","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763"},{"id":"INC-10805","date":"2024-10","year":2024,"title":"Keycloak has session fixation in Elytron SAML adapters","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7341"],"affected":"maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-services","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7341"},{"id":"INC-10806","date":"2024-10","year":2024,"title":"DOM Clobbering Gadget found in astro's client-side router that leads to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47885"],"affected":"npm/astro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47885"},{"id":"INC-10807","date":"2024-10","year":2024,"title":"Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6985"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6985"},{"id":"INC-10808","date":"2024-10","year":2024,"title":"SSOReady has an XML Signature Bypass via differential XML parsing","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47832"],"affected":"go/github.com/ssoready/ssoready","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47832"},{"id":"INC-10809","date":"2024-10","year":2024,"title":"Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6971"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6971"},{"id":"INC-10810","date":"2024-10","year":2024,"title":"Alist reflected Cross-Site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47067"],"affected":"go/github.com/alist-org/alist/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47067"},{"id":"INC-10813","date":"2024-10","year":2024,"title":"open-webui Insecure Direct Object Reference (IDOR) vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7041"],"affected":"pip/open-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7041"},{"id":"INC-10815","date":"2024-10","year":2024,"title":"Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47813"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47813"},{"id":"INC-10816","date":"2024-10","year":2024,"title":"Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-5661","CVE-2022-41704","CVE-2022-44729","CVE-2022-44730","CVE-2024-28168"],"affected":"maven/org.apache.xmlgraphics:fop-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28168"},{"id":"INC-10817","date":"2024-10","year":2024,"title":"Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43485"],"affected":"nuget/System.Text.Json, nuget/System.Text.Json","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43485"},{"id":"INC-10818","date":"2024-10","year":2024,"title":"Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43484"],"affected":"nuget/System.IO.Packaging, nuget/System.IO.Packaging, nuget/System.IO.Packaging","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43484"},{"id":"INC-10819","date":"2024-10","year":2024,"title":"Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43483"],"affected":"nuget/Microsoft.Extensions.Caching.Memory, nuget/Microsoft.Extensions.Caching.Memory,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43483"},{"id":"INC-10820","date":"2024-10","year":2024,"title":"Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38229"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38229"},{"id":"INC-10821","date":"2024-10","year":2024,"title":"PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45292"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45292"},{"id":"INC-10822","date":"2024-10","year":2024,"title":"PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-45291"],"affected":"composer/phpoffice/phpexcel, composer/phpoffice/phpspreadsheet, composer/phpoffice/phpspreadsheet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45291"},{"id":"INC-10823","date":"2024-10","year":2024,"title":"Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@saltcorn/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pf56-h9qf-rxq4"},{"id":"INC-10824","date":"2024-10","year":2024,"title":"Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47765"],"affected":"composer/dev-lancer/minecraft-motd-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47765"},{"id":"INC-10825","date":"2024-10","year":2024,"title":"@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@saltcorn/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-78p3-fwcq-62c2"},{"id":"INC-10826","date":"2024-10","year":2024,"title":"Vulnerable juju introspection abstract UNIX domain socket","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8038"],"affected":"go/github.com/juju/juju","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8038"},{"id":"INC-10827","date":"2024-10","year":2024,"title":"Pomerium service account access token may grant unintended access to databroker API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-47616"],"affected":"go/github.com/pomerium/pomerium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47616"},{"id":"INC-10828","date":"2024-10","year":2024,"title":"Slim Select has potential Cross-site Scripting issue","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9440"],"affected":"npm/slim-select","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9440"},{"id":"INC-10829","date":"2024-10","year":2024,"title":"LibreNMS has Stored Cross-site Scripting vulnerability in \"Alert Transports\" feature","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47523"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47523"},{"id":"INC-10830","date":"2024-10","year":2024,"title":"LibreNMS has Stored Cross-site Scripting vulnerability in \"Device Dependencies\" feature","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47527"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47527"},{"id":"INC-10837","date":"2024-10","year":2024,"title":"Malware in openai-examples","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openai-examples","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gxcx-943q-f69h"},{"id":"INC-10838","date":"2024-10","year":2024,"title":"Malware in openai-bun-test","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/openai-bun-test","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-262q-8gmf-79vg"},{"id":"INC-03561","date":"2024-09","year":2024,"title":"An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1.","severity":"Low","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-4099"],"affected":"gitlab/gitlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4099"},{"id":"INC-03788","date":"2024-09","year":2024,"title":"Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9148"],"affected":"flowiseai/embed, flowiseai/flowise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9148"},{"id":"INC-04337","date":"2024-09","year":2024,"title":"Vim — Vulnerability (CVE-2024-45306)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45306"],"affected":"vim/vim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45306"},{"id":"INC-03897","date":"2024-09","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Prevent unmapping active read buffers The kms paths keep a persistent map active to read and co...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-46710"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46710"},{"id":"INC-03896","date":"2024-09","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-46712"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46712"},{"id":"INC-03692","date":"2024-09","year":2024,"title":"Cursor — Rce (CVE-2024-45599)","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45599"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45599"},{"id":"INC-03558","date":"2024-09","year":2024,"title":"An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45846","CVE-2024-45848","CVE-2024-45856"],"affected":"mindsdb/mindsdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45848"},{"id":"INC-04278","date":"2024-09","year":2024,"title":"The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-6845"],"affected":"webdigit/chatbot_with_chatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6845"},{"id":"INC-04271","date":"2024-09","year":2024,"title":"The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI Cha...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7713","CVE-2024-7714"],"affected":"ays-pro/chatgpt_assistant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7714"},{"id":"INC-04274","date":"2024-09","year":2024,"title":"The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privil...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6722"],"affected":"mansurahamed/chatbot_support_ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6722"},{"id":"INC-04277","date":"2024-09","year":2024,"title":"The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6846"],"affected":"webdigit/chatbot_with_chatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6846"},{"id":"INC-03562","date":"2024-09","year":2024,"title":"An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1....","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-40441","CVE-2024-40442"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-40441"},{"id":"INC-10839","date":"2024-09","year":2024,"title":"mudler/localai version 2.17.1 is vulnerable to remote code execution.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6983"],"affected":"mudler/localai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6983"},{"id":"INC-10840","date":"2024-09","year":2024,"title":"Eclipse Glassfish improperly handles http parameters","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9329"],"affected":"maven/org.glassfish.main.admin:rest-service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9329"},{"id":"INC-10841","date":"2024-09","year":2024,"title":"Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47186"],"affected":"composer/filament/infolists, composer/filament/tables","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47186"},{"id":"INC-10842","date":"2024-09","year":2024,"title":"Rancher agents can be hijacked by taking over the Rancher Server URL","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22030"],"affected":"go/github.com/rancher/rancher, go/github.com/rancher/rancher, go/github.com/rancher/rancher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22030"},{"id":"INC-10843","date":"2024-09","year":2024,"title":"Agnai vulnerable to Relative Path Traversal in Image Upload","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47171"],"affected":"npm/agnai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47171"},{"id":"INC-10844","date":"2024-09","year":2024,"title":"Agnai File Disclosure Vulnerability: JSON via Path Traversal","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47170"],"affected":"npm/agnai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47170"},{"id":"INC-10845","date":"2024-09","year":2024,"title":"Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47169"],"affected":"npm/agnai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47169"},{"id":"INC-10846","date":"2024-09","year":2024,"title":"Layui has DOM Clobbering gadgets that leads to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47075"],"affected":"npm/layui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47075"},{"id":"INC-10847","date":"2024-09","year":2024,"title":"Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-45042"],"affected":"go/github.com/ory/kratos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45042"},{"id":"INC-10848","date":"2024-09","year":2024,"title":"Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-47197"],"affected":"maven/org.apache.maven.plugins:maven-archetype-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47197"},{"id":"INC-10849","date":"2024-09","year":2024,"title":"Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/camaleon_cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-75j2-9gmc-m855"},{"id":"INC-10850","date":"2024-09","year":2024,"title":"Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8996"],"affected":"go/github.com/grafana/agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8996"},{"id":"INC-10851","date":"2024-09","year":2024,"title":"Remote command execution in promptr","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-46489"],"affected":"npm/@ifnotnowwhen/promptr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46489"},{"id":"INC-10852","date":"2024-09","year":2024,"title":"Cross-site scripting (XSS) in the clipboard package","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45613"],"affected":"npm/@ckeditor/ckeditor5-clipboard, npm/ckeditor5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45613"},{"id":"INC-10853","date":"2024-09","year":2024,"title":"Cross site scripting in Concrete CMS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-7398"],"affected":"composer/concrete5/concrete5, composer/concrete5/concrete5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7398"},{"id":"INC-10854","date":"2024-09","year":2024,"title":"DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47068"],"affected":"npm/rollup, npm/rollup, npm/rollup","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47068"},{"id":"INC-10855","date":"2024-09","year":2024,"title":"Duplicate Advisory: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/camaleon_cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3hp8-6j24-m5gm"},{"id":"INC-10856","date":"2024-09","year":2024,"title":"DataEase has an XML External Entity Reference vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-46985"],"affected":"maven/io.dataease:common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46985"},{"id":"INC-10857","date":"2024-09","year":2024,"title":"DataEase's H2 datasource has a remote command execution risk","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-46997"],"affected":"maven/io.dataease:common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-46997"},{"id":"INC-10858","date":"2024-09","year":2024,"title":"Prevent XSS from Confidant API call","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-45793"],"affected":"pip/confidant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45793"},{"id":"INC-10859","date":"2024-09","year":2024,"title":"Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47061"],"affected":"npm/@udecode/plate-core, npm/@udecode/plate-core, npm/@udecode/plate-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47061"},{"id":"INC-10860","date":"2024-09","year":2024,"title":"DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@rspack/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-84jw-g43v-8gjm"},{"id":"INC-10861","date":"2024-09","year":2024,"title":"HTTP client can manipulate custom HTTP headers that are added by Traefik","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-45410"],"affected":"go/github.com/traefik/traefik, go/github.com/traefik/traefik/v2, go/github.com/traefik/traefik/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45410"},{"id":"INC-10862","date":"2024-09","year":2024,"title":"Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47058"],"affected":"composer/mautic/core-lib, composer/mautic/core-lib, composer/mautic/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47058"},{"id":"INC-10863","date":"2024-09","year":2024,"title":"Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-8796"],"affected":"rubygems/devise-two-factor, rubygems/devise-two-factor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8796"},{"id":"INC-10864","date":"2024-09","year":2024,"title":"Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45812"],"affected":"npm/vite, npm/vite, npm/vite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45812"},{"id":"INC-10865","date":"2024-09","year":2024,"title":"Kimai has an XXE Leading to Local File Read","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45048"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-534c-hcr7-67jg"},{"id":"INC-10866","date":"2024-09","year":2024,"title":"DOMPurify allows tampering by prototype pollution","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45801"],"affected":"npm/dompurify, npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45801"},{"id":"INC-10867","date":"2024-09","year":2024,"title":"Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39910"],"affected":"rubygems/decidim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39910"},{"id":"INC-10868","date":"2024-09","year":2024,"title":"Path traversal vulnerability in functional web frameworks","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38816"],"affected":"maven/org.springframework:spring-webflux, maven/org.springframework:spring-webmvc,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816"},{"id":"INC-10869","date":"2024-09","year":2024,"title":"omniauth-saml vulnerable to Improper Verification of Cryptographic Signature","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45409"],"affected":"rubygems/omniauth-saml, rubygems/omniauth-saml, rubygems/omniauth-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cvp8-5r8g-fhvq"},{"id":"INC-10870","date":"2024-09","year":2024,"title":"AWS SageMaker Training Toolkit logs CodeArtifact Authorization token","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/sagemaker-training","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-635v-pc42-fr74"},{"id":"INC-10871","date":"2024-09","year":2024,"title":"AutoGPT bypass of the shell commands denylist settings","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6091"],"affected":"pip/agpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6091"},{"id":"INC-10872","date":"2024-09","year":2024,"title":"pyload-ng vulnerable to RCE with js2py sandbox escape","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39205"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39205"},{"id":"INC-10873","date":"2024-09","year":2024,"title":"AngularJS allows attackers to bypass common image source restrictions","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8373"],"affected":"npm/angular","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8373"},{"id":"INC-10874","date":"2024-09","year":2024,"title":"Default installation of `synthetic-monitoring-agent` exposes sensitive information","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-46156"],"affected":"go/github.com/grafana/synthetic-monitoring-agent, go/github.com/grafana/synthetic-monitoring-agent/cmd/synthetic-monito…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46156"},{"id":"INC-10875","date":"2024-09","year":2024,"title":"HTML injection in JupyterLite leading to DOM Clobbering","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43805"],"affected":"pip/jupyterlite-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gj55-2xf9-67rq"},{"id":"INC-10876","date":"2024-09","year":2024,"title":"H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45758"],"affected":"pip/h2o, maven/ai.h2o:h2o-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45758"},{"id":"INC-10877","date":"2024-09","year":2024,"title":"Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45053"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45053"},{"id":"INC-10878","date":"2024-09","year":2024,"title":"Nuclei Template Signature Verification Bypass","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43405"],"affected":"go/github.com/projectdiscovery/nuclei/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43405"},{"id":"INC-10879","date":"2024-09","year":2024,"title":"gix-path uses local config across repos when it is the highest scope","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-45305"],"affected":"rust/gix-path","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45305"},{"id":"INC-10880","date":"2024-09","year":2024,"title":"DOM clobbering could escalate to Cross-site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43788","CVE-2024-45389"],"affected":"rust/pagefind, npm/@pagefind/modular-ui, npm/@pagefind/default-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45389"},{"id":"INC-03953","date":"2024-08","year":2024,"title":"llama.cpp provides LLM inference in C/C++.","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-41130","CVE-2024-42477","CVE-2024-42478","CVE-2024-42479"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42477"},{"id":"INC-03589","date":"2024-08","year":2024,"title":"Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6706"],"affected":"openwebui/open_webui, debian/debian_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6706"},{"id":"INC-03926","date":"2024-08","year":2024,"title":"Khoj — Xss (CVE-2024-43396)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43396"],"affected":"khoj/khoj","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43396"},{"id":"INC-04229","date":"2024-08","year":2024,"title":"stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection.","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-6331"],"affected":"stitionai/devika","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6331"},{"id":"INC-03563","date":"2024-08","year":2024,"title":"An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary comma...","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-7110"],"affected":"gitlab/gitlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7110"},{"id":"INC-04202","date":"2024-08","year":2024,"title":"Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from ...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29090","CVE-2024-38791"],"affected":"meowapps/ai_engine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38791"},{"id":"INC-04276","date":"2024-08","year":2024,"title":"The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting a...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6843"],"affected":"webdigit/chatbot_with_chatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6843"},{"id":"INC-04275","date":"2024-08","year":2024,"title":"The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitab...","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6847"],"affected":"webdigit/chatbot_with_chatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6847"},{"id":"INC-10887","date":"2024-08","year":2024,"title":"GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26043"],"affected":"pip/GeoNode","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26043"},{"id":"INC-10888","date":"2024-08","year":2024,"title":"Hyperledger Indy's update process of a DID does not check who signs the request","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-11093"],"affected":"pip/indy-node","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-11093"},{"id":"INC-10889","date":"2024-08","year":2024,"title":"Svelte has a potential mXSS vulnerability due to improper HTML escaping","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45047"],"affected":"npm/svelte","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45047"},{"id":"INC-10890","date":"2024-08","year":2024,"title":"CRLF Injection in RestSharp's `RestRequest.AddHeader` method","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-45302"],"affected":"nuget/RestSharp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45302"},{"id":"INC-10891","date":"2024-08","year":2024,"title":"OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45043"],"affected":"go/github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45043"},{"id":"INC-10892","date":"2024-08","year":2024,"title":"Directus has an insecure object reference via PATH presets","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6534"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6534"},{"id":"INC-10893","date":"2024-08","year":2024,"title":"AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45037"],"affected":"npm/aws-cdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45037"},{"id":"INC-10894","date":"2024-08","year":2024,"title":"Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43783"],"affected":"rust/apollo-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43783"},{"id":"INC-10895","date":"2024-08","year":2024,"title":"FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-42816","CVE-2024-42818"],"affected":"pip/fastapi-admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42816"},{"id":"INC-10896","date":"2024-08","year":2024,"title":"Mage AI Path Traversal vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45188","CVE-2024-45189","CVE-2024-45190"],"affected":"pip/mage-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45188"},{"id":"INC-10897","date":"2024-08","year":2024,"title":"Mage AI incorrectly gives privileges to users with deleted accounts","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45187"],"affected":"pip/mage-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45187"},{"id":"INC-10898","date":"2024-08","year":2024,"title":"pretix Stored Cross-site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8113"],"affected":"pip/pretix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8113"},{"id":"INC-10899","date":"2024-08","year":2024,"title":"gitoxide-core does not neutralize special characters for terminals","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43785"],"affected":"rust/gitoxide, rust/gitoxide-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43785"},{"id":"INC-10900","date":"2024-08","year":2024,"title":"REXML denial of service vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43398"],"affected":"rubygems/rexml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43398"},{"id":"INC-10901","date":"2024-08","year":2024,"title":"Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8072"],"affected":"pip/mage-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8072"},{"id":"INC-10902","date":"2024-08","year":2024,"title":"Apache SeaTunnel SQL Injection vulnerability","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49198"],"affected":"maven/org.apache.seatunnel:seatunnel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49198"},{"id":"INC-10903","date":"2024-08","year":2024,"title":"Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43403"],"affected":"go/github.com/kanisterio/kanister","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43403"},{"id":"INC-10904","date":"2024-08","year":2024,"title":"LF Edge eKuiper has a SQL Injection in sqlKvStore","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43406"],"affected":"pip/ekuiper, go/github.com/lf-edge/ekuiper","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43406"},{"id":"INC-10905","date":"2024-08","year":2024,"title":"apollo-portal has potential unauthorized access issue","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43397"],"affected":"maven/com.ctrip.framework.apollo:apollo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43397"},{"id":"INC-10906","date":"2024-08","year":2024,"title":"fugit parse and parse_nat stall on lengthy input","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43380"],"affected":"rubygems/fugit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43380"},{"id":"INC-10907","date":"2024-08","year":2024,"title":"Policy bypass for Host Firewall policy due to race condition in Cilium agent","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-42488"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42488"},{"id":"INC-10908","date":"2024-08","year":2024,"title":"Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7625"],"affected":"go/github.com/hashicorp/nomad, go/github.com/hashicorp/nomad, go/github.com/hashicorp/nomad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7625"},{"id":"INC-10910","date":"2024-08","year":2024,"title":"Microsoft Security Advisory CVE-2024-38168 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-38168"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38168"},{"id":"INC-10911","date":"2024-08","year":2024,"title":"Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-38167"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38167"},{"id":"INC-10912","date":"2024-08","year":2024,"title":"CometVisu Backend for openHAB has a sensitive information disclosure vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-42470"],"affected":"maven/org.openhab.ui.bundles:org.openhab.ui.cometvisu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42470"},{"id":"INC-10913","date":"2024-08","year":2024,"title":"Jenkins Remoting library arbitrary file read vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-43044"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43044"},{"id":"INC-10914","date":"2024-08","year":2024,"title":"Qwik has a potential mXSS vulnerability due to improper HTML escaping","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41677"],"affected":"npm/@builder.io/qwik","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41677"},{"id":"INC-10915","date":"2024-08","year":2024,"title":"Microweber Reflected Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-40101"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-40101"},{"id":"INC-10916","date":"2024-08","year":2024,"title":"Meshery SQL Injection vulnerability","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-35181","CVE-2024-35182"],"affected":"go/github.com/layer5io/meshery","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35182"},{"id":"INC-10917","date":"2024-08","year":2024,"title":"gotortc vulnerable to Cross-Site Request Forgery","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29192"],"affected":"go/github.com/AlexxIT/go2rtc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29192"},{"id":"INC-10918","date":"2024-08","year":2024,"title":"memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29028"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29028"},{"id":"INC-10919","date":"2024-08","year":2024,"title":"RobotsAndPencils go-saml authentication bypass vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-48703"],"affected":"go/github.com/RobotsAndPencils/go-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48703"},{"id":"INC-10920","date":"2024-08","year":2024,"title":"Editor.js vulnerable to Code Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23474"],"affected":"npm/@editorjs/editorjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23474"},{"id":"INC-10921","date":"2024-08","year":2024,"title":"Reposilite artifacts vulnerable to Stored Cross-site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-36115"],"affected":"maven/com.reposilite:reposilite-backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36115"},{"id":"INC-10922","date":"2024-08","year":2024,"title":"REXML DoS vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-35176","CVE-2024-39908","CVE-2024-41123","CVE-2024-41946"],"affected":"rubygems/rexml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41946"},{"id":"INC-03538","date":"2024-07","year":2024,"title":"All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21552"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21552"},{"id":"INC-03867","date":"2024-07","year":2024,"title":"Haystack — Rce (CVE-2024-41950)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41950"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41950"},{"id":"INC-03925","date":"2024-07","year":2024,"title":"Khoj — Prompt Injection (CVE-2024-25639)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-25639"],"affected":"khoj/khoj","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25639"},{"id":"INC-04227","date":"2024-07","year":2024,"title":"Starship — Command Injection (CVE-2024-41815)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41815"],"affected":"starship/starship","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41815"},{"id":"INC-04260","date":"2024-07","year":2024,"title":"TensorFlow — Vulnerability (CVE-2023-33976)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-41197","CVE-2021-41206","CVE-2021-41208","CVE-2021-41228","CVE-2022-23563","CVE-2022-23567","CVE-2022-23569","CVE-2022-23594","CVE-2022-29191","CVE-2022-29192","CVE-2022-29193","CVE-2022-29194","CVE-2022-29195","CVE-2022-29196","CVE-2022-29197","CVE-2022-29198","CVE-2022-29199","CVE-2022-29200","CVE-2022-29201","CVE-2022-29202","CVE-2022-29203","CVE-2022-29204","CVE-2022-29205","CVE-2022-29206","CVE-2022-29207","CVE-2022-29208","CVE-2022-29209","CVE-2022-29210","CVE-2022-29211","CVE-2022-29212","CVE-2022-29213","CVE-2022-29216","CVE-2022-35934","CVE-2022-35935","CVE-2022-35937","CVE-2022-35939","CVE-2022-35940","CVE-2022-35941","CVE-2022-35952","CVE-2022-35959","CVE-2022-35960","CVE-2022-35963","CVE-2022-35964","CVE-2022-35965","CVE-2022-35966","CVE-2022-35967","CVE-2022-35968","CVE-2022-35969","CVE-2022-35970","CVE-2022-35971","CVE-2022-35972","CVE-2022-35973","CVE-2022-35974","CVE-2022-35979","CVE-2022-35981","CVE-2022-35982","CVE-2022-35983","CVE-2022-35984","CVE-2022-35985","CVE-2022-35986","CVE-2022-35987","CVE-2022-35988","CVE-2022-35989","CVE-2022-35990","CVE-2022-35991","CVE-2022-35992","CVE-2022-35993","CVE-2022-35994","CVE-2022-35995","CVE-2022-35996","CVE-2022-35997","CVE-2022-35998","CVE-2022-35999","CVE-2022-36000","CVE-2022-36001","CVE-2022-36002","CVE-2022-36003","CVE-2022-36004","CVE-2022-36005","CVE-2022-36011","CVE-2022-36012","CVE-2022-36013","CVE-2022-36014","CVE-2022-36015","CVE-2022-36016","CVE-2022-36017","CVE-2022-36018","CVE-2022-36019","CVE-2022-36026","CVE-2022-36027","CVE-2022-41880","CVE-2022-41883","CVE-2022-41884","CVE-2022-41885","CVE-2022-41886","CVE-2022-41887","CVE-2022-41888","CVE-2022-41889","CVE-2022-41890","CVE-2022-41891","CVE-2022-41893","CVE-2022-41894","CVE-2022-41895","CVE-2022-41896","CVE-2022-41897","CVE-2022-41898","CVE-2022-41899","CVE-2022-41900","CVE-2022-41901","CVE-2022-41902","CVE-2022-41907","CVE-2022-41908","CVE-2022-41909","CVE-2022-41910","CVE-2022-41911","CVE-2023-25658","CVE-2023-25659","CVE-2023-25660","CVE-2023-25661","CVE-2023-25662","CVE-2023-25663","CVE-2023-25664","CVE-2023-25665","CVE-2023-25666","CVE-2023-25667","CVE-2023-25668","CVE-2023-25669","CVE-2023-25670","CVE-2023-25671","CVE-2023-25672","CVE-2023-25673","CVE-2023-25674","CVE-2023-25675","CVE-2023-25676","CVE-2023-25801","CVE-2023-27579","CVE-2023-33976"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33976"},{"id":"INC-03899","date":"2024-07","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the T...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-39480"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39480"},{"id":"INC-03838","date":"2024-07","year":2024,"title":"Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-39236"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39236"},{"id":"INC-04283","date":"2024-07","year":2024,"title":"The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-40594"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-40594"},{"id":"INC-04281","date":"2024-07","year":2024,"title":"The H2O machine learning platform uses \"Iced\" classes as the primary means of moving Java Objects around the cluster.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6960"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6960"},{"id":"INC-04079","date":"2024-07","year":2024,"title":"parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4897"],"affected":"lollms/lollms_web_ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4897"},{"id":"INC-10924","date":"2024-07","year":2024,"title":"Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7297"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7297"},{"id":"INC-10925","date":"2024-07","year":2024,"title":"A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI).","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6095"],"affected":"mudler/localai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6095"},{"id":"INC-10926","date":"2024-07","year":2024,"title":"LibreChat through 0.7.4-rc1 has incorrect access control for message updates.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-41703","CVE-2024-41704"],"affected":"librechat/librechat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41703"},{"id":"INC-10927","date":"2024-07","year":2024,"title":"PheonixAppAPI has visible Encoding Maps","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-41951"],"affected":"pip/PheonixAppAPI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41951"},{"id":"INC-10928","date":"2024-07","year":2024,"title":"ZITADEL \"ignoring unknown usernames\" vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-41952"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41952"},{"id":"INC-10929","date":"2024-07","year":2024,"title":"ZITADEL has improper HTML sanitization in emails and Console UI","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-41953"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41953"},{"id":"INC-10930","date":"2024-07","year":2024,"title":"Harbor fails to validate the user permissions when updating project configurations","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22278"],"affected":"go/github.com/goharbor/harbor, go/github.com/goharbor/harbor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22278"},{"id":"INC-10931","date":"2024-07","year":2024,"title":"pREST vulnerable to jwt bypass + sql injection","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/prest/prest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wm25-j4gw-6vr3"},{"id":"INC-10932","date":"2024-07","year":2024,"title":"Apache SeaTunnel Web Authentication vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-48396"],"affected":"maven/org.apache.seatunnel:seatunnel-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48396"},{"id":"INC-10933","date":"2024-07","year":2024,"title":"Twisted vulnerable to HTML injection in HTTP redirect body","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41810"],"affected":"pip/twisted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41810"},{"id":"INC-10934","date":"2024-07","year":2024,"title":"Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41676"],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41676"},{"id":"INC-10935","date":"2024-07","year":2024,"title":"Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38529"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38529"},{"id":"INC-10936","date":"2024-07","year":2024,"title":"Admidio has Blind SQL Injection in ecard_send.php","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37906"],"affected":"composer/admidio/admidio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37906"},{"id":"INC-10937","date":"2024-07","year":2024,"title":"The Argo CD web terminal session does not handle the revocation of user permissions properly","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-41666"],"affected":"go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41666"},{"id":"INC-10938","date":"2024-07","year":2024,"title":"XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48362"],"affected":"maven/org.apache.drill.exec:drill-java-exec","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48362"},{"id":"INC-10939","date":"2024-07","year":2024,"title":"Sentry vulnerable to stored Cross-Site Scripting (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41656"],"affected":"pip/sentry","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41656"},{"id":"INC-10940","date":"2024-07","year":2024,"title":"Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-41178"],"affected":"rust/object_store","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41178"},{"id":"INC-10941","date":"2024-07","year":2024,"title":"ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-41129"],"affected":"pip/ops","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41129"},{"id":"INC-10942","date":"2024-07","year":2024,"title":"DNSJava DNSSEC Bypass","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-25638"],"affected":"maven/dnsjava:dnsjava","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25638"},{"id":"INC-10943","date":"2024-07","year":2024,"title":"LoLLMS vulnerable to Expected Behavior Violation","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6281"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6281"},{"id":"INC-10944","date":"2024-07","year":2024,"title":"ProcessWire Cross Site Request Forgery vulnerability","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41597"],"affected":"composer/processwire/processwire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41597"},{"id":"INC-10945","date":"2024-07","year":2024,"title":"Calibre-Web Cross Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39123"],"affected":"pip/calibreweb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39123"},{"id":"INC-10946","date":"2024-07","year":2024,"title":"Woodpecker's custom workspace allow to overwrite plugin entrypoint executable","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-41121"],"affected":"go/go.woodpecker-ci.org/woodpecker, go/go.woodpecker-ci.org/woodpecker/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41121"},{"id":"INC-10947","date":"2024-07","year":2024,"title":"Woodpecker's custom environment variables allow to alter execution flow of plugins","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-41122"],"affected":"go/go.woodpecker-ci.org/woodpecker, go/go.woodpecker-ci.org/woodpecker/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41122"},{"id":"INC-10948","date":"2024-07","year":2024,"title":"Kubernetes sets incorrect permissions on Windows containers logs","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5321"],"affected":"go/k8s.io/kubernetes, go/k8s.io/kubernetes, go/k8s.io/kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5321"},{"id":"INC-10949","date":"2024-07","year":2024,"title":"Sliver Allows Authenticated Operator-to-Server Remote Code Execution","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-41111"],"affected":"go/github.com/bishopfox/sliver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-41111"},{"id":"INC-10950","date":"2024-07","year":2024,"title":"The OpenSearch reporting plugin improperly controls tenancy access to reporting resources","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-39900","CVE-2024-39901"],"affected":"maven/org.opensearch.plugin:opensearch-reports-scheduler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39900"},{"id":"INC-10951","date":"2024-07","year":2024,"title":"projectdiscovery/nuclei allows unsigned code template execution through workflows","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-40641"],"affected":"go/github.com/projectdiscovery/nuclei/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-40641"},{"id":"INC-10952","date":"2024-07","year":2024,"title":"BlastRADIUS also affects eduMFA","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/edumfa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vhmj-5q9r-mm9g"},{"id":"INC-10953","date":"2024-07","year":2024,"title":"Sylius has a security vulnerability via adjustments API endpoint","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-40633"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-40633"},{"id":"INC-10954","date":"2024-07","year":2024,"title":"Next.js Denial of Service (DoS) condition","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-39693"],"affected":"npm/next","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39693"},{"id":"INC-10955","date":"2024-07","year":2024,"title":"Decidim cross-site scripting (XSS) in the admin panel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27095"],"affected":"rubygems/decidim-admin, rubygems/decidim-admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27095"},{"id":"INC-10956","date":"2024-07","year":2024,"title":"audify vulnerable to Improper Validation of Array Index","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21522"],"affected":"npm/audify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21522"},{"id":"INC-10957","date":"2024-07","year":2024,"title":"Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-38095"],"affected":"nuget/System.Formats.Asn1, nuget/System.Formats.Asn1, nuget/Microsoft.NetCore.App.Runtime.win-x86","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38095"},{"id":"INC-10958","date":"2024-07","year":2024,"title":"Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-38081"],"affected":"nuget/Microsoft.IO.Redist","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38081"},{"id":"INC-10959","date":"2024-07","year":2024,"title":"Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-35264"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35264"},{"id":"INC-10960","date":"2024-07","year":2024,"title":"Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-30105"],"affected":"nuget/System.Text.Json","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-30105"},{"id":"INC-10961","date":"2024-07","year":2024,"title":"Directus GraphQL Field Duplication Denial of Service (DoS)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-39895"],"affected":"npm/@directus/env","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39895"},{"id":"INC-10962","date":"2024-07","year":2024,"title":"Directus Blind SSRF On File Import","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-39699"],"affected":"npm/@directus/api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39699"},{"id":"INC-10963","date":"2024-07","year":2024,"title":"yt-dlp has dependency on potentially malicious third-party code in Douyu extractors","severity":"Low","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/yt-dlp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3v33-3wmw-3785"},{"id":"INC-10964","date":"2024-07","year":2024,"title":"RailsAdmin Cross-site Scripting vulnerability in the list view","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39308"],"affected":"rubygems/rails_admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39308"},{"id":"INC-10965","date":"2024-07","year":2024,"title":"Server Side Request Forgery (SSRF) attack in Fedify","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-39687"],"affected":"npm/@fedify/fedify, npm/@fedify/fedify, npm/@fedify/fedify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39687"},{"id":"INC-10966","date":"2024-07","year":2024,"title":"ZITADEL Vulnerable to Session Information Leakage","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-39683"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39683"},{"id":"INC-10967","date":"2024-07","year":2024,"title":"aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-39323"],"affected":"composer/aimeos/ai-admin-graphql, composer/aimeos/ai-admin-graphql, composer/aimeos/ai-admin-graphql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39323"},{"id":"INC-03957","date":"2024-06","year":2024,"title":"Lobe Chat — Vulnerability (CVE-2024-37895)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-37895"],"affected":"lobehub/lobe_chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37895"},{"id":"INC-03409","date":"2024-06","year":2024,"title":"A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4839"],"affected":"lollms/lollms-webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4839"},{"id":"INC-04051","date":"2024-06","year":2024,"title":"NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable commands by injecting arbitrary data as a new lo...","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2023-31036","CVE-2024-0095","CVE-2024-0103"],"affected":"nvidia/triton_inference_server, linux/linux_kernel, microsoft/windows","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0095"},{"id":"INC-04138","date":"2024-06","year":2024,"title":"qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3829"],"affected":"qdrant/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3829"},{"id":"INC-03406","date":"2024-06","year":2024,"title":"A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow.","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-4253"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4253"},{"id":"INC-04269","date":"2024-06","year":2024,"title":"The 'deploy-website.yml' workflow in the gradio-app/gradio repository, specifically in the 'main' branch, is vulnerable to secrets exfiltration due to improper authorization.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4254"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4254"},{"id":"INC-04280","date":"2024-06","year":2024,"title":"The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-3234"],"affected":"gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3234"},{"id":"INC-03560","date":"2024-06","year":2024,"title":"An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-3033"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3033"},{"id":"INC-03930","date":"2024-06","year":2024,"title":"kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5552"],"affected":"kubeflow/kubeflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5552"},{"id":"INC-04038","date":"2024-06","year":2024,"title":"NextChat — Ssrf (CVE-2024-38514)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38514"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38514"},{"id":"INC-03727","date":"2024-06","year":2024,"title":"DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-37902"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37902"},{"id":"INC-10973","date":"2024-06","year":2024,"title":"Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the \"POST /api/v1/custom_component\" endpoint and provide a Python script.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37014"],"affected":"langflow/langflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37014"},{"id":"INC-10974","date":"2024-06","year":2024,"title":"A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1879","CVE-2024-1880","CVE-2024-1881"],"affected":"agpt/autogpt_classic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1879"},{"id":"INC-10975","date":"2024-06","year":2024,"title":"A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-2032"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2032"},{"id":"INC-10976","date":"2024-06","year":2024,"title":"An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-2035"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2035"},{"id":"INC-10977","date":"2024-06","year":2024,"title":"A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2171","CVE-2024-2260"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2171"},{"id":"INC-10978","date":"2024-06","year":2024,"title":"An issue was discovered in zenml-io/zenml versions up to and including 0.55.4.","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-2213"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2213"},{"id":"INC-10979","date":"2024-06","year":2024,"title":"A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-2383"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2383"},{"id":"INC-10980","date":"2024-06","year":2024,"title":"A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4680"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4680"},{"id":"INC-10981","date":"2024-06","year":2024,"title":"A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5062"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5062"},{"id":"INC-10982","date":"2024-06","year":2024,"title":"lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5824"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5824"},{"id":"INC-10983","date":"2024-06","year":2024,"title":"lollms vulnerable to dot-dot-slash path traversal in XTTS server","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6139"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6139"},{"id":"INC-10984","date":"2024-06","year":2024,"title":"lollms vulnerable to path traversal due to unauthenticated root folder settings change","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6085"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6085"},{"id":"INC-10985","date":"2024-06","year":2024,"title":"Cross-site Scripting in ZenUML","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38527"],"affected":"npm/@zenuml/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38527"},{"id":"INC-10986","date":"2024-06","year":2024,"title":"October System module has a Reflected XSS via X-October-Request-Handler Header","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-25637"],"affected":"composer/october/system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25637"},{"id":"INC-10987","date":"2024-06","year":2024,"title":"Aimeos HTML client may potentially reveal sensitive information in error log","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-38516"],"affected":"composer/aimeos/ai-client-html, composer/aimeos/ai-client-html, composer/aimeos/ai-client-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38516"},{"id":"INC-10988","date":"2024-06","year":2024,"title":"DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38364"],"affected":"maven/org.dspace:dspace-server-webapp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38364"},{"id":"INC-10989","date":"2024-06","year":2024,"title":"Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38374"],"affected":"maven/org.cyclonedx:cyclonedx-core-java","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38374"},{"id":"INC-10990","date":"2024-06","year":2024,"title":"XWiki programming rights may be inherited by inclusion","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-38369"],"affected":"maven/org.xwiki.platform:xwiki-platform-rendering-macro-include","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38369"},{"id":"INC-10992","date":"2024-06","year":2024,"title":"Remote Code Execution in create_conda_env function in lollms","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3121"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3121"},{"id":"INC-10993","date":"2024-06","year":2024,"title":"Remote Code Execution via path traversal bypass in lollms","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5443"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5443"},{"id":"INC-10994","date":"2024-06","year":2024,"title":"Cross site scripting in opencart","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21515","CVE-2024-21516","CVE-2024-21517"],"affected":"composer/opencart/opencart","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21517"},{"id":"INC-10995","date":"2024-06","year":2024,"title":"ClassGraph XML External Entity Reference","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-47621"],"affected":"maven/io.github.classgraph:classgraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-47621"},{"id":"INC-10996","date":"2024-06","year":2024,"title":"LocalAI path traversal vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5182"],"affected":"go/github.com/go-skynet/LocalAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5182"},{"id":"INC-10997","date":"2024-06","year":2024,"title":"TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-38356"],"affected":"pip/django-tinymce, composer/tinymce/tinymce, composer/tinymce/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-38356"},{"id":"INC-10998","date":"2024-06","year":2024,"title":"Vulnerabilities with the k8sGPT","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/k8sgpt-ai/k8sgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-85rg-8m6h-825p"},{"id":"INC-10999","date":"2024-06","year":2024,"title":"Rhai stack overflow vulenrability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-36760"],"affected":"rust/rhai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36760"},{"id":"INC-11000","date":"2024-06","year":2024,"title":"Magento Open Source Server-Side Request Forgery (SSRF) vulnerability","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-34102","CVE-2024-34103","CVE-2024-34104","CVE-2024-34105","CVE-2024-34106","CVE-2024-34107","CVE-2024-34111"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34111"},{"id":"INC-11001","date":"2024-06","year":2024,"title":"WooCommerce has a Cross-Site Scripting (XSS) Vulnerability in checkout & registration forms","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37297"],"affected":"composer/woocommerce/woocommerce, composer/woocommerce/woocommerce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37297"},{"id":"INC-11002","date":"2024-06","year":2024,"title":"@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-31217"],"affected":"npm/@strapi/plugin-upload","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31217"},{"id":"INC-11003","date":"2024-06","year":2024,"title":"parisneo/lollms Local File Inclusion (LFI) attack","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4315","CVE-2024-4881"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4315"},{"id":"INC-11004","date":"2024-06","year":2024,"title":"ghtml Cross-Site Scripting (XSS) vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37166"],"affected":"npm/ghtml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37166"},{"id":"INC-11005","date":"2024-06","year":2024,"title":"lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5389"],"affected":"npm/lunary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5389"},{"id":"INC-11006","date":"2024-06","year":2024,"title":"Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework1, composer/zendframework/zendframework1, composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4vf6-mq7w-3hp6"},{"id":"INC-11007","date":"2024-06","year":2024,"title":"Zend-Navigation vulnerable to Cross-site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zend-navigation, composer/zendframework/zend-navigation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6v7p-5qcq-268c"},{"id":"INC-11008","date":"2024-06","year":2024,"title":"Zendframework Potential XSS or HTML Injection vector in Zend_Json","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework1, composer/zendframework/zendframework1, composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vvm3-rv48-j3g5"},{"id":"INC-11009","date":"2024-06","year":2024,"title":"Zend-JSON vulnerable to XXE/XEE attacks","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/zendframework/zend-json, composer/zendframework/zend-json","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8x2v-pcg7-94f4"},{"id":"INC-11010","date":"2024-06","year":2024,"title":"Zendframework Local file disclosure via XXE injection in Zend_XmlRpc","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-229x-22xc-2f2w"},{"id":"INC-11011","date":"2024-06","year":2024,"title":"Zendframework Denial of Service vector via XEE injection","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2012-6532"],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2jx7-xg83-j2m7"},{"id":"INC-11012","date":"2024-06","year":2024,"title":"ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gwpm-pm6x-h7rj"},{"id":"INC-11013","date":"2024-06","year":2024,"title":"ebookmeta XML External Entity vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-36827","CVE-2024-37388"],"affected":"pip/ebookmeta","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37388"},{"id":"INC-11014","date":"2024-06","year":2024,"title":"Zend-Session session validation vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/zendframework/zend-session, composer/zendframework/zend-session","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-96c6-m98x-hxjx"},{"id":"INC-11015","date":"2024-06","year":2024,"title":"ZendFramework Potential Cross-site Scripting in Development Environment Error View Script","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g52p-86j5-xr8q"},{"id":"INC-11016","date":"2024-06","year":2024,"title":"ZendFramework potential XML eXternal Entity injection vectors","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2012-5657","CVE-2014-2681","CVE-2014-2682","CVE-2014-2683"],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mhpx-3rv8-wrjm"},{"id":"INC-11017","date":"2024-06","year":2024,"title":"ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hg35-vqp3-fv39"},{"id":"INC-11018","date":"2024-06","year":2024,"title":"ZendFramework vulnerable to XXE/XEE attacks","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/zendframework/zend-xmlrpc, composer/zendframework/zend-xmlrpc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f4fj-q6m4-cc52"},{"id":"INC-11019","date":"2024-06","year":2024,"title":"ZendFramework vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/zendframework/zendframework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5gmf-3c43-q73v"},{"id":"INC-11020","date":"2024-06","year":2024,"title":"Zendframework session validation vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/zendframework/zendframework, composer/zendframework/zendframework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-62f6-h68r-3jpw"},{"id":"INC-11021","date":"2024-06","year":2024,"title":"TYPO3 Cross-Site Scripting in Frontend User Login","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2rcw-9hrm-8q7q"},{"id":"INC-11022","date":"2024-06","year":2024,"title":"Cross-site scripting (XSS) vulnerability in Description metadata","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37160"],"affected":"composer/getformwork/formwork, composer/getformwork/formwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37160"},{"id":"INC-11023","date":"2024-06","year":2024,"title":"TYPO3 Arbitrary Code Execution via File List Module","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8h4m-r4wm-xj7r"},{"id":"INC-11024","date":"2024-06","year":2024,"title":"TYPO3 Broken Access Control in Localization Handling","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-772m-43f3-hmf8"},{"id":"INC-11025","date":"2024-06","year":2024,"title":"Tornado has a CRLF injection in CurlAsyncHTTPClient headers","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/tornado","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w235-7p84-xx57"},{"id":"INC-11026","date":"2024-06","year":2024,"title":"LoLLMS Path Traversal vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3429"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3429"},{"id":"INC-11027","date":"2024-06","year":2024,"title":"Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5478"],"affected":"npm/lunary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5478"},{"id":"INC-11028","date":"2024-06","year":2024,"title":"Evmos allows unvested token delegations","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-37154"],"affected":"go/github.com/evmos/evmos/v6, go/github.com/evmos/evmos/v7, go/github.com/evmos/evmos/v8","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37154"},{"id":"INC-11029","date":"2024-06","year":2024,"title":"Typo3 Arbitrary file upload and XML External Entity processing","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"composer/typo3/flow, composer/typo3/flow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2p4f-vc9q-r5vp"},{"id":"INC-11030","date":"2024-06","year":2024,"title":"Privilege Escalation in TYPO3 Neos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/typo3/neos, composer/typo3/neos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wr3c-6c22-m9v6"},{"id":"INC-11031","date":"2024-06","year":2024,"title":"Typo3 Broken Access Control in Import Module","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-f5rr-9r84-wwqf"},{"id":"INC-11032","date":"2024-06","year":2024,"title":"Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hww5-6x85-mc24"},{"id":"INC-11033","date":"2024-06","year":2024,"title":"Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-36129"],"affected":"go/go.opentelemetry.io/collector/config/configgrpc, go/go.opentelemetry.io/collector/config/confighttp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36129"},{"id":"INC-11034","date":"2024-06","year":2024,"title":"Insecure Deserialization in TYPO3 CMS","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8h28-f46f-m87h"},{"id":"INC-11035","date":"2024-06","year":2024,"title":"Arbitrary JavaScript execution due to using outdated libraries","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/gradio_pdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4m3g-6r7g-jv4f"},{"id":"INC-11036","date":"2024-06","year":2024,"title":"Digital products download without proper payment status check","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-37296"],"affected":"composer/aimeos/ai-client-html, composer/aimeos/ai-client-html, composer/aimeos/ai-client-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37296"},{"id":"INC-11037","date":"2024-06","year":2024,"title":"Vulnerable embedded jQuery Version","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/pimcore/admin-ui-classic-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jmh9-6rjq-gjh9"},{"id":"INC-11038","date":"2024-06","year":2024,"title":"Missing security headers in Action Pack on non-HTML responses","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28103"],"affected":"rubygems/actionpack, rubygems/actionpack, rubygems/actionpack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28103"},{"id":"INC-11039","date":"2024-06","year":2024,"title":"ActionText ContentAttachment can Contain Unsanitized HTML","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32464"],"affected":"rubygems/actiontext, rubygems/actiontext","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32464"},{"id":"INC-11040","date":"2024-06","year":2024,"title":"apko Exposure of HTTP basic auth credentials in log output","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-36127"],"affected":"go/chainguard.dev/apko","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36127"},{"id":"INC-11041","date":"2024-06","year":2024,"title":"Flooding Server with Thumbnail files","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32871"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32871"},{"id":"INC-11042","date":"2024-06","year":2024,"title":"Cross-Site Scripting (XSS) in TYPO3 component CSS styled content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8j9v-4hhh-x43c"},{"id":"INC-11043","date":"2024-06","year":2024,"title":"XML External Entity (XXE) Processing in TYPO3 Core","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qffc-gwpp-m2xr"},{"id":"INC-11044","date":"2024-06","year":2024,"title":"Reflected Cross-Site Scripting (XSS) in Dolibarr","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34051"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34051"},{"id":"INC-11045","date":"2024-06","year":2024,"title":"Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8755"],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5cxf-xx9j-54jc"},{"id":"INC-11046","date":"2024-06","year":2024,"title":"activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37031"],"affected":"rubygems/activeadmin, rubygems/activeadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37031"},{"id":"INC-11047","date":"2024-06","year":2024,"title":"Password confirmation stored in plain text via registration form in statamic/cms","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-36119"],"affected":"composer/statamic/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36119"},{"id":"INC-11048","date":"2024-06","year":2024,"title":"path traversal vulnerability was identified in the parisneo/lollms-webui","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4330"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4330"},{"id":"INC-11049","date":"2024-06","year":2024,"title":"code injection vulnerability exists in the huggingface/text-generation-inference repository","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3924"],"affected":"pip/text-generation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3924"},{"id":"INC-11050","date":"2024-06","year":2024,"title":"Reflected Cross-site Scripting in yiisoft/yii2 Debug mode","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32877"],"affected":"composer/yiisoft/yii2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32877"},{"id":"INC-04279","date":"2024-05","year":2024,"title":"The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks.","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5185"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5185"},{"id":"INC-04287","date":"2024-05","year":2024,"title":"The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code ins...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2024-5565"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5565"},{"id":"INC-04052","date":"2024-05","year":2024,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file.","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-0087","CVE-2024-0088","CVE-2024-0100"],"affected":"nvidia/triton_inference_server, linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0087"},{"id":"INC-03898","date":"2024-05","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Unmap the surface before resetting it on a plane state Switch to a new plane state requires unr...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52648"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-52648"},{"id":"INC-03903","date":"2024-05","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26951"],"affected":"linux/linux_kernel, debian/debian_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26951"},{"id":"INC-04139","date":"2024-05","year":2024,"title":"qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3584"],"affected":"qdrant/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3584"},{"id":"INC-03569","date":"2024-05","year":2024,"title":"ansibleguy-webui — Vulnerability (CVE-2024-36110)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-36110"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36110"},{"id":"INC-04042","date":"2024-05","year":2024,"title":"NocoDB is software for building databases as spreadsheets.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-50717"],"affected":"nocodb/nocodb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-50717"},{"id":"INC-04174","date":"2024-05","year":2024,"title":"sagemaker-python-sdk — Deserialization (CVE-2024-34072)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34072"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34072"},{"id":"INC-04173","date":"2024-05","year":2024,"title":"sagemaker-python-sdk — Command Injection (CVE-2024-34073)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34073"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34073"},{"id":"INC-04215","date":"2024-05","year":2024,"title":"spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-34527"],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34527"},{"id":"INC-04270","date":"2024-05","year":2024,"title":"The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up t...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0451","CVE-2024-0452","CVE-2024-0453"],"affected":"quantumcloud/wpbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0451"},{"id":"INC-04286","date":"2024-05","year":2024,"title":"The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option...","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4858"],"affected":"uapp/testimonial_carousel_for_elementor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4858"},{"id":"INC-04324","date":"2024-05","year":2024,"title":"Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-51409","CVE-2024-29100","CVE-2024-34440"],"affected":"meowapps/ai_engine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34440"},{"id":"INC-11056","date":"2024-05","year":2024,"title":"TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wp8j-c736-c5r3"},{"id":"INC-11057","date":"2024-05","year":2024,"title":"symfony/validator XML Entity Expansion vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/symfony/validator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4vf2-qfg3-7598"},{"id":"INC-11058","date":"2024-05","year":2024,"title":"Symfony XML decoding attack vector through external entities","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/symfony/symfony","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mmcv-fvq8-r9x3"},{"id":"INC-11059","date":"2024-05","year":2024,"title":"SimpleSAMLphp Reflected Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/simplesamlphp/simplesamlphp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vpr3-cw3h-prw8"},{"id":"INC-11060","date":"2024-05","year":2024,"title":"Duplicate Advisory: SimpleSAMLphp signature validation bypass","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-12874","CVE-2017-18122"],"affected":"composer/simplesamlphp/simplesamlphp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fjr2-r2mp-484p"},{"id":"INC-11061","date":"2024-05","year":2024,"title":"SimpleSAMLphp exposes credentials in session storage","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/simplesamlphp/simplesamlphp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7wh8-jrq7-p27f"},{"id":"INC-11062","date":"2024-05","year":2024,"title":"formwork Cross-site scripting vulnerability in Markdown fields","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-35621"],"affected":"composer/getformwork/formwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35621"},{"id":"INC-11063","date":"2024-05","year":2024,"title":"silverstripe/framework's User-Agent header not correctly invalidating user session","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4qx8-j9vh-2628"},{"id":"INC-11064","date":"2024-05","year":2024,"title":"silverstripe/framework's `Member.Name` is not escaped","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r9vp-fp72-xgf7"},{"id":"INC-11065","date":"2024-05","year":2024,"title":"Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mpqj-f4v3-334h"},{"id":"INC-11066","date":"2024-05","year":2024,"title":"Silverstripe XSS in CMS Edit Page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m8v7-x398-pxrf"},{"id":"INC-11067","date":"2024-05","year":2024,"title":"Silverstripe Missing security check on dev/build/defaults","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x5w2-wcr8-9q45"},{"id":"INC-11068","date":"2024-05","year":2024,"title":"Silverstripe XSS in Director::force_redirect()","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jqp8-v74p-g8px"},{"id":"INC-11069","date":"2024-05","year":2024,"title":"Silverstripe XSS In rewritten hash links","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-34q6-xqxh-gq39"},{"id":"INC-11070","date":"2024-05","year":2024,"title":"Silverstripe XSS In GridField print","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-88jp-9jrv-6368"},{"id":"INC-11071","date":"2024-05","year":2024,"title":"Silverstripe XSS in TreeDropdownField and TreeMultiSelectField","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r32j-mr8p-hfp8"},{"id":"INC-11072","date":"2024-05","year":2024,"title":"SilverStripe framework XML Quadratic Blowup Attack","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g43w-98wp-m694"},{"id":"INC-11073","date":"2024-05","year":2024,"title":"jupyter-scheduler's endpoint is missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28188"],"affected":"pip/jupyter-scheduler, pip/jupyter-scheduler, pip/jupyter-scheduler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28188"},{"id":"INC-11074","date":"2024-05","year":2024,"title":"Eclipse Ditto vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5165"],"affected":"maven/org.eclipse.ditto:ditto, maven/org.eclipse.ditto:ditto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5165"},{"id":"INC-11075","date":"2024-05","year":2024,"title":"Silverstripe XSS vulnerability via VirtualPage","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r97r-64vp-fghm"},{"id":"INC-11076","date":"2024-05","year":2024,"title":"Silverstripe History XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/silverstripe/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6hh6-59j2-qrxw"},{"id":"INC-11077","date":"2024-05","year":2024,"title":"gix traversal outside working tree enables arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-35186"],"affected":"rust/gix-index, rust/gitoxide-core, rust/gix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-35186"},{"id":"INC-11078","date":"2024-05","year":2024,"title":"ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-31989"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31989"},{"id":"INC-11079","date":"2024-05","year":2024,"title":"AVideo cross-site scripting vulnerability in the view/about.php page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34899"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34899"},{"id":"INC-11080","date":"2024-05","year":2024,"title":"Passbolt Api E-mail HTML injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/passbolt/passbolt_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v86m-j5f7-ccwh"},{"id":"INC-11081","date":"2024-05","year":2024,"title":"onelogin/php-saml signature wrapping attacks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-1000253"],"affected":"composer/onelogin/php-saml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000253"},{"id":"INC-11082","date":"2024-05","year":2024,"title":"onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/onelogin/php-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9wrw-p9rm-r782"},{"id":"INC-11083","date":"2024-05","year":2024,"title":"nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/nzo/url-encryptor-bundle, composer/nzo/url-encryptor-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r2r8-36pq-27cm"},{"id":"INC-11084","date":"2024-05","year":2024,"title":"Cross-site Scripting vulnerabilities in Neos","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"composer/neos/neos, composer/neos/neos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6cj3-rc4p-f38f"},{"id":"INC-11086","date":"2024-05","year":2024,"title":"LoLLMS Command Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4078"],"affected":"pip/lollms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4078"},{"id":"INC-11087","date":"2024-05","year":2024,"title":"Magento RCE,XSS and other vulnerabilities","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8j7c-682x-r9f2"},{"id":"INC-11088","date":"2024-05","year":2024,"title":"Magento Cross-Site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mcfc-67vm-j568"},{"id":"INC-11089","date":"2024-05","year":2024,"title":"Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5gmh-85x8-5cx7"},{"id":"INC-11090","date":"2024-05","year":2024,"title":"Magento Open Source Security Advisory: Patch SUPEE-10975","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cv25-3pxr-4q7x"},{"id":"INC-11091","date":"2024-05","year":2024,"title":"Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-26hq-7286-mg8f"},{"id":"INC-11092","date":"2024-05","year":2024,"title":"Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6wm4-3rjj-c8xx"},{"id":"INC-11093","date":"2024-05","year":2024,"title":"Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-prpf-cj87-hwvr"},{"id":"INC-11094","date":"2024-05","year":2024,"title":"Read private customer data reclaiming carts in Klaviyo Magento","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/klaviyo/magento2-extension","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hvgw-gg3p-295j"},{"id":"INC-11095","date":"2024-05","year":2024,"title":"Laravel Encrypter Failure to decryption vulnerability","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/illuminate/encryption, composer/illuminate/encryption","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6wjw-qf87-fv5v"},{"id":"INC-11096","date":"2024-05","year":2024,"title":"EZsystems Remote code execution in file uploads","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/ezsystems/ezpublish-legacy, composer/ezsystems/ezpublish-legacy, composer/ezsystems/ezpublish-legacy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9895-26wr-4fgv"},{"id":"INC-11097","date":"2024-05","year":2024,"title":"eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/ezsystems/ezpublish-legacy, composer/ezsystems/ezpublish-legacy, composer/ezsystems/ezpublish-legacy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-82rv-45pc-v28w"},{"id":"INC-11098","date":"2024-05","year":2024,"title":"eZ Platform Prevent accepting app.php in URL in Platform.sh","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/ezsystems/ezplatform, composer/ezsystems/ezplatform, composer/ezsystems/ezplatform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qhjc-hg94-245v"},{"id":"INC-11099","date":"2024-05","year":2024,"title":"eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/ezsystems/ezplatform, composer/ezsystems/ezplatform, composer/ezsystems/ezplatform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6xch-2vxx-5pvr"},{"id":"INC-11100","date":"2024-05","year":2024,"title":"eZ Platform CSRF token in login form is disabled by default","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/ezsystems/ezplatform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-45qm-j4m9-whv9"},{"id":"INC-11101","date":"2024-05","year":2024,"title":"Doctrine SQL injection vulnerability","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/doctrine/orm, composer/doctrine/orm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6q9v-4hq6-5m67"},{"id":"INC-11102","date":"2024-05","year":2024,"title":"doctrine/doctrine-module zero-valued authentication credentials vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"composer/doctrine/doctrine-module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9wv8-3h8h-x2wc"},{"id":"INC-11103","date":"2024-05","year":2024,"title":"Grafana proxy Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-21702"],"affected":"go/github.com/grafana/grafana, go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21702"},{"id":"INC-11104","date":"2024-05","year":2024,"title":"Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-30046"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-30046"},{"id":"INC-11105","date":"2024-05","year":2024,"title":"Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-30045"],"affected":"nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm64, nuget/Microsoft.NetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-30045"},{"id":"INC-11106","date":"2024-05","year":2024,"title":"OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32977"],"affected":"pip/OctoPrint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32977"},{"id":"INC-11107","date":"2024-05","year":2024,"title":"TYPO3 vulnerable to an HTML Injection in the History Module","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-34355"],"affected":"composer/typo3/cms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34355"},{"id":"INC-11108","date":"2024-05","year":2024,"title":"Cockpit CMS contains an arbitrary file upload vulenrability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4825"],"affected":"composer/cockpit-hq/cockpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4825"},{"id":"INC-11109","date":"2024-05","year":2024,"title":"Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34707"],"affected":"pip/nautobot, pip/nautobot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34707"},{"id":"INC-11110","date":"2024-05","year":2024,"title":"NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-49781"],"affected":"npm/nocodb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49781"},{"id":"INC-11111","date":"2024-05","year":2024,"title":"Sylius potentially vulnerable to Cross Site Scripting via \"Name\" field (Taxons, Products, Options, Variants) in Admin Panel","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34349"],"affected":"composer/sylius/sylius, composer/sylius/sylius, composer/sylius/sylius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34349"},{"id":"INC-11112","date":"2024-05","year":2024,"title":"1Panel arbitrary file write vulnerability","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34352"],"affected":"go/github.com/1Panel-dev/1Panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34352"},{"id":"INC-11113","date":"2024-05","year":2024,"title":"@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-34345"],"affected":"npm/@cyclonedx/cyclonedx-library","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34345"},{"id":"INC-11114","date":"2024-05","year":2024,"title":"Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-34084"],"affected":"go/github.com/stacklok/minder","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34084"},{"id":"INC-11115","date":"2024-05","year":2024,"title":"Arbitrary HTML present after sanitization because of unicode normalization","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-34078"],"affected":"pip/html-sanitizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34078"},{"id":"INC-11116","date":"2024-05","year":2024,"title":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-22195","CVE-2024-34064"],"affected":"pip/Jinja2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"id":"INC-11117","date":"2024-05","year":2024,"title":"libxmljs2 type confusion vulnerability when parsing specially crafted XML","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-34393"],"affected":"npm/libxmljs2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34393"},{"id":"INC-11118","date":"2024-05","year":2024,"title":"libxmljs2 vulnerable to type confusion when parsing specially crafted XML","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34394"],"affected":"npm/libxmljs2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34394"},{"id":"INC-11119","date":"2024-05","year":2024,"title":"libxmljs vulnerable to type confusion when parsing specially crafted XML","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2024-34391","CVE-2024-34392"],"affected":"npm/libxmljs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34392"},{"id":"INC-11120","date":"2024-05","year":2024,"title":"pgAdmin is affected by a multi-factor authentication bypass vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4215"],"affected":"pip/pgadmin4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4215"},{"id":"INC-11121","date":"2024-05","year":2024,"title":"Apache ActiveMQ's default configuration doesn't secure the API web context","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32114"],"affected":"maven/org.apache.activemq:apache-activemq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32114"},{"id":"INC-11122","date":"2024-05","year":2024,"title":"Apollo Router vulnerable to Critical Regression In Query Plan Cache","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32971"],"affected":"rust/apollo-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32971"},{"id":"INC-11123","date":"2024-05","year":2024,"title":"xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32962"],"affected":"npm/xml-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32962"},{"id":"INC-11124","date":"2024-05","year":2024,"title":"XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31573"],"affected":"maven/org.xmlunit:xmlunit-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31573"},{"id":"INC-11125","date":"2024-05","year":2024,"title":"static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32966"],"affected":"rust/static-web-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32966"},{"id":"INC-04062","date":"2024-04","year":2024,"title":"Open WebUI — Ssrf (CVE-2024-30256)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-30256"],"affected":"openwebui/open_webui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-30256"},{"id":"INC-03952","date":"2024-04","year":2024,"title":"Llama.cpp is LLM inference in C/C++.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32878"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32878"},{"id":"INC-04134","date":"2024-04","year":2024,"title":"Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-31584"],"affected":"linuxfoundation/pytorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31584"},{"id":"INC-03432","date":"2024-04","year":2024,"title":"A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScri...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3570"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3570"},{"id":"INC-03900","date":"2024-04","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the mes...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52636"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-52636"},{"id":"INC-03729","date":"2024-04","year":2024,"title":"Deno — Vulnerability (CVE-2024-32477)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32477"],"affected":"deno/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32477"},{"id":"INC-04137","date":"2024-04","year":2024,"title":"qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `...","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2221"],"affected":"qdrant/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2221"},{"id":"INC-03928","date":"2024-04","year":2024,"title":"Kohya_ss — Command Injection (CVE-2024-32022)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32022","CVE-2024-32023","CVE-2024-32024","CVE-2024-32025","CVE-2024-32026","CVE-2024-32027"],"affected":"bmaltais/kohya_ss","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32022"},{"id":"INC-11127","date":"2024-04","year":2024,"title":"NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttling.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0081"],"affected":"nvidia/nemo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0081"},{"id":"INC-11128","date":"2024-04","year":2024,"title":"A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perfor...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3135"],"affected":"mudler/localai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3135"},{"id":"INC-11129","date":"2024-04","year":2024,"title":"A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2083"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2083"},{"id":"INC-11130","date":"2024-04","year":2024,"title":"Passbolt API allows HTML injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-33670"],"affected":"composer/passbolt/passbolt_api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-33670"},{"id":"INC-11131","date":"2024-04","year":2024,"title":"pyLoad allows upload to arbitrary folder lead to RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32880"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32880"},{"id":"INC-11132","date":"2024-04","year":2024,"title":"social-auth-app-django affected by Improper Handling of Case Sensitivity","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32879"],"affected":"pip/social-auth-app-django","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879"},{"id":"INC-11133","date":"2024-04","year":2024,"title":"Umbraco Workflow's Backoffice users can execute arbitrary SQL","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32872"],"affected":"nuget/Plumber.Workflow, nuget/Umbraco.Workflow, nuget/Umbraco.Workflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32872"},{"id":"INC-11134","date":"2024-04","year":2024,"title":"@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34347"],"affected":"npm/@hoppscotch/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34347"},{"id":"INC-11135","date":"2024-04","year":2024,"title":"JADX file override vulnerability","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/io.github.skylot:jadx-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hvp5-5x4f-33fq"},{"id":"INC-11136","date":"2024-04","year":2024,"title":"Authelia's Group Changes may not have the expected results (YAML file backend)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"go/github.com/authelia/authelia/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-x883-2vmg-xwf7"},{"id":"INC-11137","date":"2024-04","year":2024,"title":"Apache Answer: XSS vulnerability when changing personal website","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29217"],"affected":"go/github.com/apache/incubator-answer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29217"},{"id":"INC-11138","date":"2024-04","year":2024,"title":"TCPDF vulnerable to Regular Expression Denial of Service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22640"],"affected":"composer/tecnickcom/tcpdf","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22640"},{"id":"INC-11139","date":"2024-04","year":2024,"title":"Dolibarr Application Home Page has HTML injection vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23817"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23817"},{"id":"INC-11140","date":"2024-04","year":2024,"title":"Prototype pollution in emit function","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/derby, npm/derby, npm/derby","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-82jv-9wjw-pqh6"},{"id":"INC-11141","date":"2024-04","year":2024,"title":"Stored Cross-site Scripting (XSS) in excalidraw's web embed component","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-32472"],"affected":"npm/@excalidraw/excalidraw, npm/@excalidraw/excalidraw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32472"},{"id":"INC-11142","date":"2024-04","year":2024,"title":"Keycloak vulnerable to session hijacking via re-authentication","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-6717","CVE-2023-6787"],"affected":"maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-services","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6787"},{"id":"INC-11143","date":"2024-04","year":2024,"title":".NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21409"],"affected":"nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86, nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21409"},{"id":"INC-11144","date":"2024-04","year":2024,"title":"MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-27086"],"affected":"nuget/Microsoft.Identity.Client, nuget/Microsoft.Identity.Client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27086"},{"id":"INC-11145","date":"2024-04","year":2024,"title":"Spring Framework URL Parsing with Host Validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-22262"],"affected":"maven/org.springframework:spring-web, maven/org.springframework:spring-web, maven/org.springframework:spring-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22262"},{"id":"INC-11146","date":"2024-04","year":2024,"title":"Duplicate Advisory: Scrapy decompression bomb vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/scrapy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rmqv-7v3j-mr7p"},{"id":"INC-11147","date":"2024-04","year":2024,"title":"TCPDF Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32489"],"affected":"composer/tecnickcom/tcpdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32489"},{"id":"INC-11148","date":"2024-04","year":2024,"title":"Cosign malicious artifacts can cause machine-wide DoS","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29903"],"affected":"go/github.com/sigstore/cosign/v2, go/github.com/sigstore/cosign","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29903"},{"id":"INC-11149","date":"2024-04","year":2024,"title":"LocalAI Command Injection in audioToWav","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2029"],"affected":"go/github.com/go-skynet/LocalAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2029"},{"id":"INC-11150","date":"2024-04","year":2024,"title":"XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31996"],"affected":"maven/org.xwiki.commons:xwiki-commons-velocity, maven/org.xwiki.commons:xwiki-commons-velocity,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31996"},{"id":"INC-11151","date":"2024-04","year":2024,"title":"XWiki Platform CSRF remote code execution through the realtime HTML Converter API","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31988"],"affected":"maven/org.xwiki.platform:xwiki-platform-realtime-ui, maven/org.xwiki.platform:xwiki-platform-realtime-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31988"},{"id":"INC-11152","date":"2024-04","year":2024,"title":"XWiki Platform CSRF remote code execution through scheduler job's document reference","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31985","CVE-2024-31986"],"affected":"maven/org.xwiki.platform:xwiki-platform-scheduler-ui, maven/org.xwiki.platform:xwiki-platform-scheduler-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31986"},{"id":"INC-11153","date":"2024-04","year":2024,"title":"XWiki Platform: Remote code execution through space title and Solr space facet","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31984"],"affected":"maven/org.xwiki.platform:xwiki-platform-search-solr-ui, maven/org.xwiki.platform:xwiki-platform-search-solr-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31984"},{"id":"INC-11154","date":"2024-04","year":2024,"title":"Magento Open Source allows Improper Input Validation","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-20758","CVE-2024-20759"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-20758"},{"id":"INC-11155","date":"2024-04","year":2024,"title":"Apache Zeppelin vulnerable to cross-site scripting in the helium module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31868"],"affected":"maven/org.apache.zeppelin:zeppelin-interpreter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31868"},{"id":"INC-11156","date":"2024-04","year":2024,"title":"gin-vue-admin background arbitrary code coverage vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-31457"],"affected":"go/github.com/flipped-aurora/gin-vue-admin/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-31457"},{"id":"INC-11157","date":"2024-04","year":2024,"title":"Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29834"],"affected":"maven/org.apache.pulsar:pulsar-broker, maven/org.apache.pulsar:pulsar-broker, maven/org.apache.pulsar:pulsar-broker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29834"},{"id":"INC-11158","date":"2024-04","year":2024,"title":"Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-30248"],"affected":"pip/piccolo-admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-30248"},{"id":"INC-03438","date":"2024-03","year":2024,"title":"A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1455"],"affected":"langchain/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1455"},{"id":"INC-03698","date":"2024-03","year":2024,"title":"datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-29037"],"affected":"datahub/datahub-helm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29037"},{"id":"INC-04285","date":"2024-03","year":2024,"title":"The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to i...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2238"],"affected":"leap13/premium_addons","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2238"},{"id":"INC-03672","date":"2024-03","year":2024,"title":"codeium-chrome — Deepfake (CVE-2024-28120)","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-28120"],"affected":"codeium/codeium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28120"},{"id":"INC-03405","date":"2024-03","year":2024,"title":"A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-1540"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1540"},{"id":"INC-03429","date":"2024-03","year":2024,"title":"A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests.","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27565"],"affected":"dirk1983/chatgpt-wechat-personal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27565"},{"id":"INC-11160","date":"2024-03","year":2024,"title":"Moby — Data Exfiltration (CVE-2024-29018)","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29018"],"affected":"mobyproject/moby","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29018"},{"id":"INC-11161","date":"2024-03","year":2024,"title":"zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28424"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28424"},{"id":"INC-11162","date":"2024-03","year":2024,"title":"Kimai API returns timesheet entries a user should not be authorized to view","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-29200"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29200"},{"id":"INC-11163","date":"2024-03","year":2024,"title":"ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29891"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29891"},{"id":"INC-11164","date":"2024-03","year":2024,"title":"web3-utils Prototype Pollution vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21505"],"affected":"npm/web3-utils","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21505"},{"id":"INC-11165","date":"2024-03","year":2024,"title":"TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29881"],"affected":"nuget/TinyMCE, npm/tinymce, composer/tinymce/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29881"},{"id":"INC-11166","date":"2024-03","year":2024,"title":"Unauthenticated views may expose information to anonymous users","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-29199"],"affected":"pip/nautobot, pip/nautobot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29199"},{"id":"INC-11167","date":"2024-03","year":2024,"title":"phpMyFAQ stored Cross-site Scripting at user email","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27300"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27300"},{"id":"INC-11168","date":"2024-03","year":2024,"title":"phpMyFAQ's File Upload Bypass at Category Image Leads to RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28105"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28105"},{"id":"INC-11169","date":"2024-03","year":2024,"title":"phpMyFAQ Stored Cross-site Scripting at FAQ News Content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28106"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28106"},{"id":"INC-11170","date":"2024-03","year":2024,"title":"phpMyFAQ SQL injections at insertentry & saveentry","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-28107"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28107"},{"id":"INC-11171","date":"2024-03","year":2024,"title":"phpMyFAQ Stored HTML Injection at contentLink","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-28108"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28108"},{"id":"INC-11172","date":"2024-03","year":2024,"title":"phpMyFAQ Stored Cross-site Scripting at File Attachments","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29179"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29179"},{"id":"INC-11173","date":"2024-03","year":2024,"title":"phpMyFAQ SQL Injection at \"Save News\"","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-27299"],"affected":"composer/phpmyfaq/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27299"},{"id":"INC-11174","date":"2024-03","year":2024,"title":"WiX based installers are vulnerable to binary hijack when run as SYSTEM","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29187"],"affected":"nuget/WixToolset.Sdk, nuget/wix, nuget/wix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29187"},{"id":"INC-11175","date":"2024-03","year":2024,"title":"WP Crontrol vulnerable to possible RCE when combined with a pre-condition","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28850"],"affected":"composer/johnbillion/wp-crontrol","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28850"},{"id":"INC-11176","date":"2024-03","year":2024,"title":"KaTeX's `\\includegraphics` does not escape filename","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28245"],"affected":"npm/katex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28245"},{"id":"INC-11177","date":"2024-03","year":2024,"title":"ansys-geometry-core OS Command Injection vulnerability","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29189"],"affected":"pip/ansys-geometry-core, pip/ansys-geometry-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29189"},{"id":"INC-11178","date":"2024-03","year":2024,"title":"OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-29194"],"affected":"npm/@oneuptime/common-server, npm/@oneuptime/model","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29194"},{"id":"INC-11179","date":"2024-03","year":2024,"title":"RDoc RCE vulnerability with .rdoc_options","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27281"],"affected":"rubygems/rdoc, rubygems/rdoc, rubygems/rdoc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27281"},{"id":"INC-11180","date":"2024-03","year":2024,"title":"WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/PanelSwWix4.Sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-g4v6-69p6-q3p4"},{"id":"INC-11181","date":"2024-03","year":2024,"title":"SSRF Vulnerability on assetlinks_check(act_name, well_knowns)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-29190"],"affected":"pip/mobsfscan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-29190"},{"id":"INC-11182","date":"2024-03","year":2024,"title":"Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28861"],"affected":"composer/friendsofsymfony1/symfony1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28861"},{"id":"INC-11183","date":"2024-03","year":2024,"title":"Grav File Upload Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27921"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27921"},{"id":"INC-11184","date":"2024-03","year":2024,"title":"Cross-site Scripting in Moodle Chat","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28593"],"affected":"composer/moodle/moodle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28593"},{"id":"INC-11185","date":"2024-03","year":2024,"title":"Jupyter Server Proxy's Websocket Proxying does not require authentication","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28179"],"affected":"pip/jupyter-server-proxy, pip/jupyter-server-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28179"},{"id":"INC-11186","date":"2024-03","year":2024,"title":"GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23821"],"affected":"maven/org.geoserver:gs-gwc, maven/org.geoserver:gs-gwc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23821"},{"id":"INC-11187","date":"2024-03","year":2024,"title":"GeoServer's MapML HTML Page vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23819"],"affected":"maven/org.geoserver.extension:gs-mapml, maven/org.geoserver.extension:gs-mapml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23819"},{"id":"INC-11188","date":"2024-03","year":2024,"title":"GeoServer's WMS OpenLayers Format vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23818"],"affected":"maven/org.geoserver:gs-wms, maven/org.geoserver:gs-wms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23818"},{"id":"INC-11189","date":"2024-03","year":2024,"title":"GeoServer's GWC Seed Form vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23643"],"affected":"maven/org.geoserver:gs-gwc-rest, maven/org.geoserver:gs-gwc-rest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23643"},{"id":"INC-11190","date":"2024-03","year":2024,"title":"GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23642"],"affected":"maven/org.geoserver:gs-wms, maven/org.geoserver:gs-wms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23642"},{"id":"INC-11191","date":"2024-03","year":2024,"title":"GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23640"],"affected":"maven/org.geoserver:gs-ows, maven/org.geoserver:gs-main","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23640"},{"id":"INC-11192","date":"2024-03","year":2024,"title":"GeoServer Arbitrary file renaming vulnerability in REST Coverage/Data Store API","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-23634"],"affected":"maven/org.geoserver:gs-restconfig, maven/org.geoserver:gs-restconfig","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23634"},{"id":"INC-11193","date":"2024-03","year":2024,"title":"Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-51445"],"affected":"maven/org.geoserver:gs-restconfig","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51445"},{"id":"INC-11194","date":"2024-03","year":2024,"title":"Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-51444"],"affected":"maven/org.geoserver:gs-restconfig, maven/org.geoserver:gs-platform, maven/org.geoserver:gs-restconfig","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51444"},{"id":"INC-11195","date":"2024-03","year":2024,"title":"Cross-site Scripting in livewire/livewire","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21504"],"affected":"composer/livewire/livewire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21504"},{"id":"INC-11196","date":"2024-03","year":2024,"title":"Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri, rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vcc3-rw6f-jv97"},{"id":"INC-11197","date":"2024-03","year":2024,"title":"Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28859"],"affected":"composer/swiftmailer/swiftmailer, composer/friendsofsymfony1/swiftmailer, composer/friendsofsymfony1/swiftmailer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28859"},{"id":"INC-11198","date":"2024-03","year":2024,"title":"Improper HTML sanitization in ZITADEL","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28855"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28855"},{"id":"INC-11199","date":"2024-03","year":2024,"title":"XSS via the \"Snapshot Test\" feature in Classic Webcam plugin settings","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28237"],"affected":"pip/OctoPrint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28237"},{"id":"INC-11200","date":"2024-03","year":2024,"title":"Spring Framework URL Parsing with Host Validation Vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-22259"],"affected":"maven/org.springframework:spring-web, maven/org.springframework:spring-web, maven/org.springframework:spring-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22259"},{"id":"INC-11201","date":"2024-03","year":2024,"title":"Regular expression denial-of-service in Django","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2011-4104","CVE-2015-3630","CVE-2018-19653","CVE-2019-16760","CVE-2023-43665","CVE-2024-27351"],"affected":"pip/django, pip/django, pip/django","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351"},{"id":"INC-11202","date":"2024-03","year":2024,"title":"Cross-site scripting on application summary component","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28175"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28175"},{"id":"INC-11203","date":"2024-03","year":2024,"title":"Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27317"],"affected":"maven/org.apache.pulsar:pulsar-functions-worker, maven/org.apache.pulsar:pulsar-functions-worker,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27317"},{"id":"INC-11204","date":"2024-03","year":2024,"title":"Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-34321"],"affected":"maven/org.apache.pulsar:pulsar-proxy, maven/org.apache.pulsar:pulsar-proxy, maven/org.apache.pulsar:pulsar-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34321"},{"id":"INC-11205","date":"2024-03","year":2024,"title":"Apache Pulsar: Improper Authorization For Topic-Level Policy Management","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-28098"],"affected":"maven/org.apache.pulsar:pulsar-broker, maven/org.apache.pulsar:pulsar-broker, maven/org.apache.pulsar:pulsar-broker","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28098"},{"id":"INC-11206","date":"2024-03","year":2024,"title":"Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21392"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x64, nuget/Microsoft.NETCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21392"},{"id":"INC-11207","date":"2024-03","year":2024,"title":"Account Takeover via Session Fixation in Zitadel [Bypassing MFA]","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28197"],"affected":"go/github.com/zitadel/zitadel, go/github.com/zitadel/zitadel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28197"},{"id":"INC-11208","date":"2024-03","year":2024,"title":"Jenkins HTML Publisher Plugin Stored XSS vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-28149","CVE-2024-28150","CVE-2024-28151"],"affected":"maven/org.jenkins-ci.plugins:htmlpublisher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-28150"},{"id":"INC-11209","date":"2024-03","year":2024,"title":"Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27933"],"affected":"rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27933"},{"id":"INC-11210","date":"2024-03","year":2024,"title":"RSSHub vulnerable to Server-Side Request Forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27927"],"affected":"npm/rsshub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27927"},{"id":"INC-11211","date":"2024-03","year":2024,"title":"1Panel open source panel project has an unauthorized vulnerability.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-27288"],"affected":"go/github.com/1Panel-dev/1Panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27288"},{"id":"INC-11212","date":"2024-03","year":2024,"title":"esphome vulnerable to stored Cross-site Scripting in edit configuration file API","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27287"],"affected":"pip/esphome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27287"},{"id":"INC-11213","date":"2024-03","year":2024,"title":"Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27936"],"affected":"rust/deno_runtime, rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27936"},{"id":"INC-11214","date":"2024-03","year":2024,"title":"Insufficient permission checking in `Deno.makeTemp*` APIs","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27931"],"affected":"rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27931"},{"id":"INC-11215","date":"2024-03","year":2024,"title":"ESPHome vulnerable to remote code execution via arbitrary file write","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-27081"],"affected":"pip/esphome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27081"},{"id":"INC-11216","date":"2024-03","year":2024,"title":"Apache Archiva Incorrect Authorization vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-27139"],"affected":"maven/org.apache.archiva:archiva","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27139"},{"id":"INC-03890","date":"2024-02","year":2024,"title":"Improper buffer restrictions in Intel(R) Optimization for TensorFlow before version 2.13.0 may allow an authenticated user to potentially enable escalation of privilege via loca...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30767"],"affected":"intel/optimization_for_tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30767"},{"id":"INC-04282","date":"2024-02","year":2024,"title":"The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL ``` http:...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-0455"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0455"},{"id":"INC-04203","date":"2024-02","year":2024,"title":"Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internal...","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0759"],"affected":"mintplexlabs/anythingllm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0759"},{"id":"INC-03902","date":"2024-02","year":2024,"title":"In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyon...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52451"],"affected":"linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-52451"},{"id":"INC-03690","date":"2024-02","year":2024,"title":"Cross-Site Request Forgery (CSRF) vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: fr...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-51528"],"affected":"aipower/aipower","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51528"},{"id":"INC-04370","date":"2024-02","year":2024,"title":"ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endp...","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-25723"],"affected":"zenml/zenml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25723"},{"id":"INC-03417","date":"2024-02","year":2024,"title":"A heap-based buffer overflow vulnerability exists in the GGUF library info-&gt;ne functionality of llama.cpp Commit 18c2e17.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21802"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21802"},{"id":"INC-03414","date":"2024-02","year":2024,"title":"A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21825"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21825"},{"id":"INC-03416","date":"2024-02","year":2024,"title":"A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21836"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21836"},{"id":"INC-03413","date":"2024-02","year":2024,"title":"A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23496"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23496"},{"id":"INC-03415","date":"2024-02","year":2024,"title":"A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23605"],"affected":"ggml/llama.cpp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23605"},{"id":"INC-11217","date":"2024-02","year":2024,"title":"Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM05","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2024-24590","CVE-2024-24591","CVE-2024-24592","CVE-2024-24593","CVE-2024-24594","CVE-2024-24595"],"affected":"clear/clearml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24595"},{"id":"INC-11218","date":"2024-02","year":2024,"title":"Docassemble HTML and javascript injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-27290"],"affected":"pip/docassemble.webapp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27290"},{"id":"INC-11219","date":"2024-02","year":2024,"title":"YARD's default template vulnerable to Cross-site Scripting in generated frames.html","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-27285"],"affected":"rubygems/yard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-27285"},{"id":"INC-11220","date":"2024-02","year":2024,"title":"Apache Superset: Improper authorization validation on dashboards and charts import","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26016"],"affected":"pip/apache-superset, pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26016"},{"id":"INC-11221","date":"2024-02","year":2024,"title":"Magento LTS vulnerable to stored XSS in admin file form","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/openmage/magento-lts, composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gp6m-fq6h-cjcx"},{"id":"INC-11222","date":"2024-02","year":2024,"title":"Apache Ambari XML External Entity injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-50380"],"affected":"maven/org.apache.ambari.contrib.views:wfmanager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-50380"},{"id":"INC-11223","date":"2024-02","year":2024,"title":"Bagisto Cross-Site Request Forgery vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36237"],"affected":"composer/bagisto/bagisto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36237"},{"id":"INC-11224","date":"2024-02","year":2024,"title":"@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-1631"],"affected":"npm/@nfid/embed","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-84c3-j8r2-mcm8"},{"id":"INC-11225","date":"2024-02","year":2024,"title":"SAML authentication bypass due to missing validation on unsigned SAML messages","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1735"],"affected":"maven/com.linecorp.centraldogma:centraldogma-server-auth-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hx5q-v6pj-533r"},{"id":"INC-11226","date":"2024-02","year":2024,"title":"Kirby vulnerable to unrestricted file upload of user avatar images","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-26483"],"affected":"composer/getkirby/cms, composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26483"},{"id":"INC-11227","date":"2024-02","year":2024,"title":"sanitize-html Information Exposure vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-21501"],"affected":"npm/sanitize-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21501"},{"id":"INC-11228","date":"2024-02","year":2024,"title":"pypqc private key retrieval vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/pypqc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rc4p-p3j9-6577"},{"id":"INC-11229","date":"2024-02","year":2024,"title":"Potentially untrusted input is rendered as HTML in final output","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26151"],"affected":"pip/mjml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26151"},{"id":"INC-11230","date":"2024-02","year":2024,"title":"Helm's Missing YAML Content Leads To Panic","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26147"],"affected":"go/helm.sh/helm/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26147"},{"id":"INC-11231","date":"2024-02","year":2024,"title":"Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25117"],"affected":"composer/phenx/php-svg-lib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-97m3-52wr-xvv2"},{"id":"INC-11232","date":"2024-02","year":2024,"title":"Enhavo Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25874","CVE-2024-25875","CVE-2024-25876"],"affected":"composer/enhavo/enhavo-app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25876"},{"id":"INC-11233","date":"2024-02","year":2024,"title":"Apache Answer Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23349"],"affected":"go/github.com/apache/incubator-answer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23349"},{"id":"INC-11234","date":"2024-02","year":2024,"title":"Withdrawn Advisory: Kirby CMS HTML injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-26482"],"affected":"composer/getkirby/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26482"},{"id":"INC-11235","date":"2024-02","year":2024,"title":"Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47795"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.portal.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47795"},{"id":"INC-11236","date":"2024-02","year":2024,"title":"Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25151"],"affected":"maven/com.liferay.portal:release.portal.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25151"},{"id":"INC-11237","date":"2024-02","year":2024,"title":"Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-26269"],"affected":"maven/com.liferay.portal:release.portal.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26269"},{"id":"INC-11238","date":"2024-02","year":2024,"title":"Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25603"],"affected":"maven/com.liferay.portal:release.portal.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25603"},{"id":"INC-11239","date":"2024-02","year":2024,"title":"Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25601"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25601"},{"id":"INC-11240","date":"2024-02","year":2024,"title":"Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25152"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25152"},{"id":"INC-11241","date":"2024-02","year":2024,"title":"Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25602"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25602"},{"id":"INC-11242","date":"2024-02","year":2024,"title":"Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-42498"],"affected":"maven/com.liferay.portal:release.portal.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-42498"},{"id":"INC-11243","date":"2024-02","year":2024,"title":"Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40191","CVE-2023-42496"],"affected":"maven/com.liferay.portal:release.portal.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-42496"},{"id":"INC-11244","date":"2024-02","year":2024,"title":"MeshCentral cross-site websocket hijacking (CSWSH) vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-26135"],"affected":"npm/meshcentral","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26135"},{"id":"INC-11245","date":"2024-02","year":2024,"title":"Cross-site scripting (XSS) in the dynamic file uploads","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-51447"],"affected":"rubygems/decidim-core, rubygems/decidim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51447"},{"id":"INC-11246","date":"2024-02","year":2024,"title":"Possible CSRF attack at questionnaire templates preview","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-47635"],"affected":"rubygems/decidim-templates","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47635"},{"id":"INC-11247","date":"2024-02","year":2024,"title":"Liferay Portal and Liferay DXP vulnerable to theft of hashed password","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26270"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26270"},{"id":"INC-11248","date":"2024-02","year":2024,"title":"Liferay Portal vulnerable to Denial of Service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-26265"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-26265"},{"id":"INC-11249","date":"2024-02","year":2024,"title":"Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25610"],"affected":"maven/com.liferay.portal:com.liferay.portal.web, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25610"},{"id":"INC-11250","date":"2024-02","year":2024,"title":"Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-22234"],"affected":"maven/org.springframework.security:spring-security-core, maven/org.springframework.security:spring-security-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22234"},{"id":"INC-11251","date":"2024-02","year":2024,"title":"Cross-site Scripting in electron-pdf","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1648"],"affected":"npm/electron-pdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1648"},{"id":"INC-11252","date":"2024-02","year":2024,"title":"Cross-site Scripting in Pyhtml2pdf","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1647"],"affected":"pip/pyhtml2pdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1647"},{"id":"INC-11253","date":"2024-02","year":2024,"title":"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@scrypted/core, npm/@scrypted/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-w4hv-vmv9-hgcr"},{"id":"INC-11254","date":"2024-02","year":2024,"title":"Magento Open Source allows OS Command Injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-20716","CVE-2024-20718","CVE-2024-20719","CVE-2024-20720"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-20720"},{"id":"INC-11255","date":"2024-02","year":2024,"title":"NuGet Client Security Feature Bypass Vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0057"],"affected":"nuget/NuGet.Packaging, nuget/NuGet.CommandLine, nuget/NuGet.Packaging","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0057"},{"id":"INC-11256","date":"2024-02","year":2024,"title":"Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21386"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21386"},{"id":"INC-11257","date":"2024-02","year":2024,"title":"Cross-site scripting (XSS) vulnerability in Grav","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31506"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31506"},{"id":"INC-11258","date":"2024-02","year":2024,"title":"DIRAC's TokenManager does not check permissions on cached tokens","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24825"],"affected":"pip/dirac, pip/DIRAC","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24825"},{"id":"INC-11259","date":"2024-02","year":2024,"title":"CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24815"],"affected":"composer/ckeditor/ckeditor, npm/ckeditor4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24815"},{"id":"INC-11260","date":"2024-02","year":2024,"title":"Liferay Portal stored cross-site scripting (XSS) vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-25145"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-25145"},{"id":"INC-11261","date":"2024-02","year":2024,"title":"Sulu HTML Injection via Autocomplete Suggestion","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24807"],"affected":"composer/sulu/sulu, composer/sulu/sulu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24807"},{"id":"INC-11262","date":"2024-02","year":2024,"title":"Malicious input can provoke XSS when preserving comments","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23635"],"affected":"maven/org.owasp.antisamy:antisamy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23635"},{"id":"INC-11263","date":"2024-02","year":2024,"title":"Central Dogma Authentication Bypass Vulnerability via Session Leakage","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1143"],"affected":"maven/com.linecorp.centraldogma:centraldogma-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1143"},{"id":"INC-11264","date":"2024-02","year":2024,"title":"Dash apps vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21485"],"affected":"pip/dash-core-components, pip/dash-html-components, npm/dash-html-components","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21485"},{"id":"INC-11265","date":"2024-02","year":2024,"title":"Statmic CMS vulnerable to account takeover via XSS and password reset link","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-24570"],"affected":"composer/statamic/cms, composer/statamic/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24570"},{"id":"INC-04289","date":"2024-01","year":2024,"title":"The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as ad...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-5911"],"affected":"hamidrezasepehr/wp_custom_cursors_\\|_wordpress_cursor_plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-5911"},{"id":"INC-03412","date":"2024-01","year":2024,"title":"A flaw was found in the X.Org server.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0409"],"affected":"tigervnc/tigervnc, x.org/x_server, x.org/xwayland, fedoraproject/fedora","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0409"},{"id":"INC-03882","date":"2024-01","year":2024,"title":"IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is used.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45193","CVE-2023-46167"],"affected":"ibm/db2, ibm/aix, ibm/linux_on_ibm_z, linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45193"},{"id":"INC-03893","date":"2024-01","year":2024,"title":"In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chu...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-48622"],"affected":"gnome/gdkpixbuf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-48622"},{"id":"INC-04284","date":"2024-01","year":2024,"title":"The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23730"],"affected":"llamahub/llamahub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23730"},{"id":"INC-11266","date":"2024-01","year":2024,"title":"MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23750"],"affected":"deepwisdom/metagpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23750"},{"id":"INC-11267","date":"2024-01","year":2024,"title":"Moby (Docker Engine) Insufficiently restricted permissions on data directory","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41091"],"affected":"go/github.com/docker/docker, go/github.com/moby/moby","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41091"},{"id":"INC-11268","date":"2024-01","year":2024,"title":"moby Access to remapped root allows privilege escalation to real root","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-21284"],"affected":"go/github.com/moby/moby, go/github.com/moby/moby","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21284"},{"id":"INC-11269","date":"2024-01","year":2024,"title":"Grafana Arbitrary File Read","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-19499"],"affected":"go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19499"},{"id":"INC-11270","date":"2024-01","year":2024,"title":"runc vulnerable to container breakout through process.cwd trickery and leaked fds","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21626"],"affected":"go/github.com/opencontainers/runc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21626"},{"id":"INC-11271","date":"2024-01","year":2024,"title":"@lobehub/chat vulnerable to unauthorized access to plugins","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-24566"],"affected":"npm/@lobehub/chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24566"},{"id":"INC-11272","date":"2024-01","year":2024,"title":"`goreleaser release --debug` shows secrets","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-23840"],"affected":"go/github.com/goreleaser/goreleaser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23840"},{"id":"INC-11273","date":"2024-01","year":2024,"title":"@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23841"],"affected":"npm/@apollo/experimental-nextjs-app-support","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23841"},{"id":"INC-11274","date":"2024-01","year":2024,"title":"react-query-streamed-hydration Cross-site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-24558"],"affected":"npm/@tanstack/react-query-next-experimental","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-24558"},{"id":"INC-11275","date":"2024-01","year":2024,"title":"Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-23827"],"affected":"go/github.com/0xJacky/Nginx-UI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23827"},{"id":"INC-11276","date":"2024-01","year":2024,"title":"Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-23656"],"affected":"go/github.com/dexidp/dex, go/github.com/dexidp/dex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23656"},{"id":"INC-11277","date":"2024-01","year":2024,"title":"Cross-site Scripting in Apache superset","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49657"],"affected":"pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49657"},{"id":"INC-11278","date":"2024-01","year":2024,"title":"html injection vulnerability in the `tuitse_html` function.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-23341"],"affected":"pip/TuiTse-TsuSin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23341"},{"id":"INC-11279","date":"2024-01","year":2024,"title":"Code execution in pandasai","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-23752"],"affected":"pip/pandasai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-23752"},{"id":"INC-11280","date":"2024-01","year":2024,"title":"Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-23687"],"affected":"maven/org.folio:mod-data-export-spring, maven/org.folio:mod-data-export-spring","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9rhq-86fm-qxqc"},{"id":"INC-11281","date":"2024-01","year":2024,"title":"github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22424"],"affected":"go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22424"},{"id":"INC-11282","date":"2024-01","year":2024,"title":"Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22416"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22416"},{"id":"INC-11283","date":"2024-01","year":2024,"title":"Cross-site scripting (XSS) in Action messages on Avo","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-22191","CVE-2024-22411"],"affected":"rubygems/avo, rubygems/avo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22411"},{"id":"INC-11284","date":"2024-01","year":2024,"title":"Broken Access Control order API in Shopware","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22407"],"affected":"composer/shopware/platform, composer/shopware/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22407"},{"id":"INC-11285","date":"2024-01","year":2024,"title":"CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-21670"],"affected":"rust/anoncreds-clsignatures, rust/ursa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21670"},{"id":"INC-11286","date":"2024-01","year":2024,"title":"readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/readthedocs-sphinx-search","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xgfm-fjx6-62mj"},{"id":"INC-11287","date":"2024-01","year":2024,"title":"Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-22197","CVE-2024-22198"],"affected":"go/github.com/0xJacky/Nginx-UI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22198"},{"id":"INC-11288","date":"2024-01","year":2024,"title":"Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-21669"],"affected":"pip/aries-cloudagent, pip/aries-cloudagent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21669"},{"id":"INC-11289","date":"2024-01","year":2024,"title":"Microsoft ASP.NET Core project templates vulnerable to denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21319"],"affected":"nuget/Microsoft.IdentityModel.JsonWebTokens, nuget/Microsoft.IdentityModel.JsonWebTokens,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21319"},{"id":"INC-11290","date":"2024-01","year":2024,"title":"fonttools XML External Entity Injection (XXE) Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45139"],"affected":"pip/fonttools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45139"},{"id":"INC-11291","date":"2024-01","year":2024,"title":"Qualys Jenkins Plugin for WAS XML External Entity vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-6147","CVE-2023-6149"],"affected":"maven/com.qualys.plugins:qualys-was","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6149"},{"id":"INC-11292","date":"2024-01","year":2024,"title":"XWiki Remote Code Execution Vulnerability via User Registration","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21650"],"affected":"maven/org.xwiki.platform:xwiki-platform-administration-ui, maven/org.xwiki.platform:xwiki-platform-administration-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21650"},{"id":"INC-11293","date":"2024-01","year":2024,"title":"Flarum's logout Route allows open redirects","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-21641"],"affected":"composer/flarum/framework, composer/flarum/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21641"},{"id":"INC-11294","date":"2024-01","year":2024,"title":"Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-30617"],"affected":"go/github.com/openkruise/kruise, go/github.com/openkruise/kruise, go/github.com/openkruise/kruise","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30617"},{"id":"INC-11295","date":"2024-01","year":2024,"title":"Firefly III allows webhooks HTML Injection.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22075"],"affected":"composer/grumpydictator/firefly-iii","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22075"},{"id":"INC-11296","date":"2024-01","year":2024,"title":"Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-22048"],"affected":"rubygems/govuk_tech_docs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4mvm-xh8j-fv27"},{"id":"INC-11297","date":"2024-01","year":2024,"title":"PrestaShop XSS can be stored in DB from \"add a message form\" in order detail page (FO)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21628"],"affected":"composer/prestashop/prestashop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21628"},{"id":"INC-11298","date":"2024-01","year":2024,"title":"PrestaShop some attribute not escaped in Validate::isCleanHTML method","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21627"],"affected":"composer/prestashop/prestashop, composer/prestashop/prestashop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-21627"},{"id":"INC-11299","date":"2024-01","year":2024,"title":"Withdrawn Advisory: User-provided environment values allow execution on macOS agents","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/gravitational/teleport, go/github.com/gravitational/teleport, go/github.com/gravitational/teleport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vfxf-76hv-v4w4"},{"id":"INC-11300","date":"2024-01","year":2024,"title":"Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"go/github.com/gravitational/teleport, go/github.com/gravitational/teleport, go/github.com/gravitational/teleport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hw4x-mcx5-9q36"},{"id":"INC-11301","date":"2024-01","year":2024,"title":"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q5pp-5q2h-g8rv"},{"id":"INC-11302","date":"2024-01","year":2024,"title":"OWASP.AntiSamy mXSS when preserving comments","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-51652"],"affected":"nuget/OWASP.AntiSamy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51652"},{"id":"INC-04861","date":"2023-12","year":2023,"title":"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-6570"],"affected":"kubeflow/kubeflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6570"},{"id":"INC-04583","date":"2023-12","year":2023,"title":"Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-6571"],"affected":"kubeflow/kubeflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6571"},{"id":"INC-04636","date":"2023-12","year":2023,"title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pa...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-51527"],"affected":"aipower/aipower","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-51527"},{"id":"INC-04478","date":"2023-12","year":2023,"title":"Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-35625"],"affected":"microsoft/azure_machine_learning_software_development_kit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35625"},{"id":"INC-11305","date":"2023-12","year":2023,"title":"Buildkite Elastic CI for AWS symbolic link following vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-43116","CVE-2023-43741"],"affected":"go/github.com/buildkite/elastic-ci-stack-for-aws/v6","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43116"},{"id":"INC-11306","date":"2023-12","year":2023,"title":"unsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platforms","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/unsafe-libyaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r24f-hg58-vfrw"},{"id":"INC-11307","date":"2023-12","year":2023,"title":"Apache Airflow has a stored cross-site scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47265"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47265"},{"id":"INC-11308","date":"2023-12","year":2023,"title":"Expired tokens can be renewed without validating the account password","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"pip/emailproxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9wgg-m99q-hhfc"},{"id":"INC-11309","date":"2023-12","year":2023,"title":"Velocity execution without script right through tree macro","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-50732"],"affected":"maven/org.xwiki.platform:xwiki-platform-index-tree-macro, maven/org.xwiki.platform:xwiki-platform-index-tree-macro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-50732"},{"id":"INC-11310","date":"2023-12","year":2023,"title":"Apache StreamPark: Authenticated system users could trigger remote command execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49898"],"affected":"maven/org.apache.streampark:streampark","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49898"},{"id":"INC-11311","date":"2023-12","year":2023,"title":"Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-6837"],"affected":"maven/org.wso2.identity.apps:authentication-portal, maven/org.wso2.carbon.identity.framework:org.wso2.carbon.identity.a…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6837"},{"id":"INC-11312","date":"2023-12","year":2023,"title":"WSO2 products vulnerable to XML External Entity attack","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-6836"],"affected":"maven/org.wso2.carbon.governance:org.wso2.carbon.governance.common, maven/org.wso2.carbon.analytics-common:org.wso2.car…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-6836"},{"id":"INC-11313","date":"2023-12","year":2023,"title":"Cube API denial of service attack","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-50709"],"affected":"npm/@cubejs-backend/api-gateway","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-50709"},{"id":"INC-11314","date":"2023-12","year":2023,"title":"Tokens stored in plain text by Dingding JSON Pusher Plugin","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-50766","CVE-2023-50767","CVE-2023-50772","CVE-2023-50776"],"affected":"maven/com.zintow:dingding-json-pusher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-50772"},{"id":"INC-11315","date":"2023-12","year":2023,"title":"Cross Site Request Forgery in Silverpeas","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-47322"],"affected":"maven/org.silverpeas.core:silverpeas-core-web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47322"},{"id":"INC-11316","date":"2023-12","year":2023,"title":"Improper validation in meraki","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49081"],"affected":"pip/meraki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6x4h-9622-fqr6"},{"id":"INC-11317","date":"2023-12","year":2023,"title":"Backoffice User can bypass \"Publish\" restriction","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48227"],"affected":"nuget/Umbraco.CMS, nuget/Umbraco.CMS, nuget/Umbraco.CMS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48227"},{"id":"INC-11318","date":"2023-12","year":2023,"title":"Possible injection of HTML into user invite mails","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38694"],"affected":"nuget/Umbraco.CMS, nuget/Umbraco.CMS, nuget/Umbraco.CMS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38694"},{"id":"INC-11319","date":"2023-12","year":2023,"title":"Elastic Beats inserts sensitive information into log file","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49922"],"affected":"go/github.com/elastic/beats, go/github.com/elastic/beats/v7, go/github.com/elastic/beats","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49922"},{"id":"INC-11320","date":"2023-12","year":2023,"title":"Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9j5w-2cqc-cwj9"},{"id":"INC-11321","date":"2023-12","year":2023,"title":"mockjs vulnerable to Prototype Pollution via the Util.extend function","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26158"],"affected":"npm/mockjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26158"},{"id":"INC-11322","date":"2023-12","year":2023,"title":"PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-49297"],"affected":"pip/PyDrive2, pip/PyDrive2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49297"},{"id":"INC-11323","date":"2023-12","year":2023,"title":"Vite XSS vulnerability in `server.transformIndexHtml` via URL payload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49293"],"affected":"npm/vite, npm/vite, npm/vite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49293"},{"id":"INC-11324","date":"2023-12","year":2023,"title":"github.com/ecies/go vulnerable to possible private key restoration","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49292"],"affected":"go/github.com/ecies/go/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49292"},{"id":"INC-11325","date":"2023-12","year":2023,"title":"Data leak of password hash through change requests","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49280"],"affected":"maven/org.xwiki.contrib.changerequest:application-changerequest-default","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49280"},{"id":"INC-11326","date":"2023-12","year":2023,"title":"Ajax Pro Cross-site Scripting","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-43853","CVE-2023-49289"],"affected":"nuget/AjaxNetProfessional","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49289"},{"id":"INC-11327","date":"2023-12","year":2023,"title":"Apache Tiles: Unvalidated input may lead to path traversal and XXE","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49735"],"affected":"maven/struts:struts, maven/org.apache.struts:struts-tiles, maven/org.apache.tiles:tiles-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49735"},{"id":"INC-04948","date":"2023-11","year":2023,"title":"The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identit...","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-29062"],"affected":"bd/facschorus, hp/hp_z2_tower_g9, hp/hp_z2_tower_g5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29062"},{"id":"INC-04960","date":"2023-11","year":2023,"title":"TorchServe — Vulnerability (CVE-2023-48299)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48299"],"affected":"pytorch/torchserve","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48299"},{"id":"INC-04640","date":"2023-11","year":2023,"title":"FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-5245"],"affected":"combust/mleap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-5245"},{"id":"INC-04582","date":"2023-11","year":2023,"title":"Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-32739"],"affected":"hamidrezasepehr/custom_cursors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32739"},{"id":"INC-04952","date":"2023-11","year":2023,"title":"The XWiki Admin Tools Application provides tools to help the administration of XWiki.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48293"],"affected":"xwiki/xwiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48293"},{"id":"INC-11328","date":"2023-11","year":2023,"title":"Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may allow an authenticated user to potentially enable information...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-25080","CVE-2023-31203"],"affected":"intel/openvino","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25080"},{"id":"INC-11329","date":"2023-11","year":2023,"title":"Eclipse IDE XXE in eclipse.platform","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-4218"],"affected":"maven/org.eclipse.jdt:org.eclipse.jdt.ui, maven/org.eclipse.platform:org.eclipse.urischeme,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4218"},{"id":"INC-11330","date":"2023-11","year":2023,"title":"Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49733"],"affected":"maven/org.apache.cocoon:cocoon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49733"},{"id":"INC-11331","date":"2023-11","year":2023,"title":"Jenkins MATLAB Plugin cross-site request forgery vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-49654","CVE-2023-49655","CVE-2023-49656"],"affected":"maven/org.jenkins-ci.plugins:matlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49655"},{"id":"INC-11332","date":"2023-11","year":2023,"title":"Apache Superset - Elevation of Privilege","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40610"],"affected":"pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40610"},{"id":"INC-11333","date":"2023-11","year":2023,"title":"Validation of SignedInfo","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49087"],"affected":"composer/simplesamlphp/saml2, composer/simplesamlphp/xml-security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49087"},{"id":"INC-11334","date":"2023-11","year":2023,"title":"Apache ActiveMQ Deserialization of Untrusted Data vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-41678"],"affected":"maven/org.apache.activemq:apache-activemq, maven/org.apache.activemq:apache-activemq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41678"},{"id":"INC-11335","date":"2023-11","year":2023,"title":"aiohttp's ClientSession is vulnerable to CRLF injection via method","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-49082"],"affected":"pip/aiohttp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-49082"},{"id":"INC-11336","date":"2023-11","year":2023,"title":"Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/org.owasp.esapi:esapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r68h-jhhj-9jvm"},{"id":"INC-11337","date":"2023-11","year":2023,"title":"Cross-site Scripting via uploaded assets","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48701"],"affected":"composer/statamic/cms, composer/statamic/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48701"},{"id":"INC-07295","date":"2023-11","year":2023,"title":"APM Java Agent Local Privilege Escalation issue","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-6439","CVE-2018-17247","CVE-2018-3823","CVE-2018-3824","CVE-2019-7611","CVE-2019-7615","CVE-2019-7617","CVE-2021-22143","CVE-2021-37942"],"affected":"maven/co.elastic.apm:elastic-apm-agent, maven/co.elastic.apm:apm-agent-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37942"},{"id":"INC-11338","date":"2023-11","year":2023,"title":"Eval Injection in fastbots","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-48699"],"affected":"pip/fastbots","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48699"},{"id":"INC-11339","date":"2023-11","year":2023,"title":"Cookies are sent to external images in rendered diff (and server side request forgery)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-48240"],"affected":"maven/org.xwiki.platform:xwiki-platform-diff-xml, maven/org.xwiki.platform:xwiki-platform-diff-xml,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48240"},{"id":"INC-11340","date":"2023-11","year":2023,"title":"Deserialization of Untrusted Data in apache-submarine","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46302"],"affected":"pip/apache-submarine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46302"},{"id":"INC-11341","date":"2023-11","year":2023,"title":"Cross-site Scripting in OpenCRX","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-40809","CVE-2023-40810","CVE-2023-40812","CVE-2023-40813","CVE-2023-40814","CVE-2023-40815","CVE-2023-40816","CVE-2023-40817"],"affected":"maven/org.opencrx:opencrx-core-models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40816"},{"id":"INC-11342","date":"2023-11","year":2023,"title":"json-web-token library is vulnerable to a JWT algorithm confusion attack","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-48238"],"affected":"npm/json-web-token","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48238"},{"id":"INC-11343","date":"2023-11","year":2023,"title":"Liferay Portal XSS with `p_l_back_url_title` on edit content page","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47797"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47797"},{"id":"INC-11344","date":"2023-11","year":2023,"title":"Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-48224"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48224"},{"id":"INC-11345","date":"2023-11","year":2023,"title":"Apache Hadoop allows local user to gain root privileges","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26031"],"affected":"maven/org.apache.hadoop:hadoop-yarn-project","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26031"},{"id":"INC-11346","date":"2023-11","year":2023,"title":"TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-48219"],"affected":"nuget/TinyMCE, nuget/TinyMCE, composer/tinymce/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48219"},{"id":"INC-11347","date":"2023-11","year":2023,"title":"vantage6-server node accepts non-whitelisted algorithms from malicious server","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-47631"],"affected":"pip/vantage6-node, pip/vantage6-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47631"},{"id":"INC-11348","date":"2023-11","year":2023,"title":"DOMPurify Open Redirect vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-25155"],"affected":"npm/dompurify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-25155"},{"id":"INC-11349","date":"2023-11","year":2023,"title":"Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36049"],"affected":"nuget/System.Net.Requests, nuget/System.Net.Requests, nuget/System.Net.Requests","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36049"},{"id":"INC-11350","date":"2023-11","year":2023,"title":"Microsoft Security Advisory CVE-2023-36558: .NET Security Feature Bypass Vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-36558"],"affected":"nuget/Microsoft.AspNetCore.Components, nuget/Microsoft.AspNetCore.Components, nuget/Microsoft.AspNetCore.Components","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36558"},{"id":"INC-11351","date":"2023-11","year":2023,"title":"Bypassing Cross-Site Scripting Protection in TYPO3 HTML Sanitizer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47125"],"affected":"composer/typo3/html-sanitizer, composer/typo3/html-sanitizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47125"},{"id":"INC-11352","date":"2023-11","year":2023,"title":"Fabric vulnerable to crosslinking transaction attack","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46132"],"affected":"go/github.com/hyperledger/fabric, go/github.com/hyperledger/fabric","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46132"},{"id":"INC-11353","date":"2023-11","year":2023,"title":"Cross-site Scripting in cesium","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-48094"],"affected":"npm/cesium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-48094"},{"id":"INC-11354","date":"2023-11","year":2023,"title":"Bootbox.js Cross Site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46998"],"affected":"npm/bootbox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46998"},{"id":"INC-11355","date":"2023-11","year":2023,"title":"Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-47163"],"affected":"pip/remarshal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47163"},{"id":"INC-11356","date":"2023-11","year":2023,"title":"piccolo SQL Injection via named transaction savepoints","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47128"],"affected":"pip/piccolo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47128"},{"id":"INC-11357","date":"2023-11","year":2023,"title":"Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-40611","CVE-2023-47037"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47037"},{"id":"INC-11358","date":"2023-11","year":2023,"title":"AsyncSSH Rogue Session Attack","severity":"High","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-46446"],"affected":"pip/asyncssh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46446"},{"id":"INC-11359","date":"2023-11","year":2023,"title":"Any value can be changed in the configuration table by an employee having access to block reassurance module","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-47109","CVE-2023-47110"],"affected":"composer/prestashop/blockreassurance","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47110"},{"id":"INC-11360","date":"2023-11","year":2023,"title":"Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47114"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47114"},{"id":"INC-11361","date":"2023-11","year":2023,"title":"XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-46243"],"affected":"maven/org.xwiki.platform:xwiki-platform-oldcore, maven/org.xwiki.platform:xwiki-platform-oldcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46243"},{"id":"INC-11362","date":"2023-11","year":2023,"title":"XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-46242"],"affected":"maven/org.xwiki.platform:xwiki-platform-oldcore, maven/org.xwiki.platform:xwiki-platform-oldcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46242"},{"id":"INC-11363","date":"2023-11","year":2023,"title":"FoodCoopShop Server-Side Request Forgery vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46725"],"affected":"composer/foodcoopshop/foodcoopshop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46725"},{"id":"INC-11364","date":"2023-11","year":2023,"title":"cordova-plugin-fingerprint-aio DoS vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-43849"],"affected":"npm/cordova-plugin-fingerprint-aio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43849"},{"id":"INC-11365","date":"2023-11","year":2023,"title":"transmute-core unsafe YAML deserialization vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-47204"],"affected":"pip/transmute-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-47204"},{"id":"INC-04953","date":"2023-10","year":2023,"title":"The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Diffusion web UI), if Gradio authentica...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-46315"],"affected":"zanllp/stable_diffusion_webui_infinite_image_browsing","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46315"},{"id":"INC-04581","date":"2023-10","year":2023,"title":"Cross-Site Request Forgery (CSRF) vulnerability in ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin <= 1.1.5 versions.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45063"],"affected":"rayhan1/ai_content_writing_assistant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45063"},{"id":"INC-11366","date":"2023-10","year":2023,"title":"Possible Infinite Loop when PdfWriter(clone_from) is used with a PDF","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-46250"],"affected":"pip/pypdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46250"},{"id":"INC-11367","date":"2023-10","year":2023,"title":"Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46245"],"affected":"composer/kimai/kimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46245"},{"id":"INC-11368","date":"2023-10","year":2023,"title":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-46233"],"affected":"npm/crypto-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46233"},{"id":"INC-11369","date":"2023-10","year":2023,"title":"crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-46133"],"affected":"npm/crypto-es","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46133"},{"id":"INC-11370","date":"2023-10","year":2023,"title":"XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-45137"],"affected":"maven/org.xwiki.platform:xwiki-platform-web, maven/org.xwiki.platform:xwiki-platform-web-templates,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45137"},{"id":"INC-11371","date":"2023-10","year":2023,"title":"org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-32070","CVE-2023-37908"],"affected":"maven/org.xwiki.rendering:xwiki-rendering-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37908"},{"id":"INC-11372","date":"2023-10","year":2023,"title":"Command Injection in pip when used with Mercurial","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-5752"],"affected":"pip/pip","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-5752"},{"id":"INC-11373","date":"2023-10","year":2023,"title":"Jenkins CloudBees CD Plugin vulnerable to arbitrary file read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-46654","CVE-2023-46655"],"affected":"maven/org.jenkins-ci.plugins:electricflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46655"},{"id":"INC-11375","date":"2023-10","year":2023,"title":"Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-46124"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46124"},{"id":"INC-11376","date":"2023-10","year":2023,"title":"svg_optimizer rubygem external XML entity (XXE) vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-46035"],"affected":"rubygems/svg_optimizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-46035"},{"id":"INC-11377","date":"2023-10","year":2023,"title":"Apache Santuario - XML Security for Java are vulnerable to private key disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-44483"],"affected":"maven/org.apache.santuario:xmlsec, maven/org.apache.santuario:xmlsec, maven/org.apache.santuario:xmlsec","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-44483"},{"id":"INC-11378","date":"2023-10","year":2023,"title":"Yamcs Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-45280"],"affected":"maven/org.yamcs:yamcs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45280"},{"id":"INC-11379","date":"2023-10","year":2023,"title":"Artifact Hub allows unsafe rego built-in","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45822"],"affected":"go/github.com/artifacthub/hub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45822"},{"id":"INC-11380","date":"2023-10","year":2023,"title":"TinyMCE XSS vulnerability in notificationManager.open API","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-45818","CVE-2023-45819"],"affected":"composer/tinymce/tinymce, nuget/TinyMCE, npm/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45819"},{"id":"INC-11381","date":"2023-10","year":2023,"title":"Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-45815"],"affected":"pip/archivebox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45815"},{"id":"INC-11382","date":"2023-10","year":2023,"title":"Wagtail vulnerable to disclosure of user names via admin bulk action views","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45809"],"affected":"pip/wagtail, pip/wagtail, pip/wagtail","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45809"},{"id":"INC-11383","date":"2023-10","year":2023,"title":"Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-45811"],"affected":"npm/deobfuscator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45811"},{"id":"INC-11384","date":"2023-10","year":2023,"title":"Arduino Create Agent path traversal - arbitrary file deletion vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-43800","CVE-2023-43801","CVE-2023-43802","CVE-2023-43803"],"affected":"go/github.com/arduino/arduino-create-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43803"},{"id":"INC-11385","date":"2023-10","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-42627","CVE-2023-42628","CVE-2023-42629"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-42627"},{"id":"INC-11386","date":"2023-10","year":2023,"title":"Cross-site Scripting via missing Binding syntax validation","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-45683"],"affected":"go/github.com/crewjam/saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45683"},{"id":"INC-11387","date":"2023-10","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-44311"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.oauth2.provider.rest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-44311"},{"id":"INC-11388","date":"2023-10","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-44310"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-44310"},{"id":"INC-11389","date":"2023-10","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-44309"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.fragment.entry.processor.impl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-44309"},{"id":"INC-11390","date":"2023-10","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-42497"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.translation.web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-42497"},{"id":"INC-11391","date":"2023-10","year":2023,"title":"Cachet vulnerable to Authenticated Remote Code Execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43661"],"affected":"composer/cachethq/cachet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43661"},{"id":"INC-11392","date":"2023-10","year":2023,"title":"OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45142"],"affected":"go/go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45142"},{"id":"INC-11393","date":"2023-10","year":2023,"title":"Magento Open Source allows Uncontrolled Resource Consumption","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-26366","CVE-2023-26367","CVE-2023-38218","CVE-2023-38219","CVE-2023-38220","CVE-2023-38221","CVE-2023-38249","CVE-2023-38250","CVE-2023-38251"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38251"},{"id":"INC-11394","date":"2023-10","year":2023,"title":"mXSS in AntiSamy","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43643"],"affected":"maven/org.owasp.antisamy:antisamy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43643"},{"id":"INC-11395","date":"2023-10","year":2023,"title":"ThingsBoard Server-Side Template Injection","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-45303"],"affected":"maven/org.thingsboard:thingsboard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-45303"},{"id":"INC-11396","date":"2023-10","year":2023,"title":"geokit-rails Command Injection vulnerability","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26153"],"affected":"rubygems/geokit-rails","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26153"},{"id":"INC-11397","date":"2023-10","year":2023,"title":"gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/consensys/gnark-crypto","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-pffg-92cg-xf5c"},{"id":"INC-11398","date":"2023-10","year":2023,"title":"CefSharp affected by libvpx's heap buffer overflow in vp8 encoding","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/CefSharp.Common.NETCore, nuget/CefSharp.Common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4c29-gfrp-g6x9"},{"id":"INC-11399","date":"2023-10","year":2023,"title":"HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-44390"],"affected":"nuget/HtmlSanitizer, nuget/HtmlSanitizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-44390"},{"id":"INC-11400","date":"2023-10","year":2023,"title":"Presto JDBC Server-Side Request Forgery by nextUri","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/com.facebook.presto:presto-jdbc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-86q5-qcjc-7pv4"},{"id":"INC-11401","date":"2023-10","year":2023,"title":"Presto JDBC Server-Side Request Forgery by redirect","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/com.facebook.presto:presto-jdbc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xm7x-f3w2-4hjm"},{"id":"INC-11402","date":"2023-10","year":2023,"title":"TorchServe Pre-Auth Remote Code Execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/torchserve","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4mqg-h5jf-j9m7"},{"id":"INC-11406","date":"2023-09","year":2023,"title":"CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/cometbft/cometbft, go/github.com/cometbft/cometbft, go/github.com/cometbft/cometbft","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hq58-p9mv-338c"},{"id":"INC-11407","date":"2023-09","year":2023,"title":"Electron affected by libvpx's heap buffer overflow in vp8 encoding","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-5217"],"affected":"npm/electron, npm/electron, npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-5217"},{"id":"INC-11408","date":"2023-09","year":2023,"title":"Subrion CMS Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43884"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43884"},{"id":"INC-11409","date":"2023-09","year":2023,"title":"pydash Command Injection vulnerability","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26145"],"affected":"pip/pydash","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26145"},{"id":"INC-11410","date":"2023-09","year":2023,"title":"Subrion CMS Cross-site Scripting vulnerability in /panel/languages","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43828"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43828"},{"id":"INC-11411","date":"2023-09","year":2023,"title":"Subrion CMS XSS in /panel/configuration/financial/","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-43830"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-43830"},{"id":"INC-11412","date":"2023-09","year":2023,"title":"OpenCart Path Traversal vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-2315"],"affected":"composer/opencart/opencart","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2315"},{"id":"INC-11413","date":"2023-09","year":2023,"title":"Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41333"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41333"},{"id":"INC-11414","date":"2023-09","year":2023,"title":"Specific Cilium configurations vulnerable to DoS via Kubernetes annotations","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41332"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41332"},{"id":"INC-11415","date":"2023-09","year":2023,"title":"x/net/html Vulnerable to DoS During HTML Parsing","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-17846"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17846"},{"id":"INC-11416","date":"2023-09","year":2023,"title":"CefSharp affected by heap buffer overflow in WebP","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"nuget/CefSharp.Common.NETCore, nuget/CefSharp.Common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-j646-gj5p-p45g"},{"id":"INC-11417","date":"2023-09","year":2023,"title":"ReportLab vulnerable to remote code execution via paraparser","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-19450"],"affected":"pip/reportlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19450"},{"id":"INC-11418","date":"2023-09","year":2023,"title":"Magento Open Source affected by Improper Input Validation","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-24093"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24093"},{"id":"INC-11419","date":"2023-09","year":2023,"title":"Apache Commons Compress denial of service vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-42503"],"affected":"maven/org.apache.commons:commons-compress","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-42503"},{"id":"INC-11420","date":"2023-09","year":2023,"title":"Strapi Improper Rate Limiting vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38507"],"affected":"npm/@strapi/plugin-users-permissions, npm/@strapi/admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38507"},{"id":"INC-11421","date":"2023-09","year":2023,"title":"Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36792"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36792"},{"id":"INC-11422","date":"2023-09","year":2023,"title":"Microsoft Security Advisory CVE-2023-36794: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36794"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36794"},{"id":"INC-11423","date":"2023-09","year":2023,"title":"Microsoft Security Advisory CVE-2023-36793: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36793"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36793"},{"id":"INC-11424","date":"2023-09","year":2023,"title":"Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36796"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36796"},{"id":"INC-11425","date":"2023-09","year":2023,"title":"Microsoft Security Advisory CVE-2023-36799: .NET Denial of Service Vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-36799"],"affected":"nuget/Microsoft.NETCore.App.Runtime.linux-musl-arm64, nuget/Microsoft.NETCore.App.Runtime.linux-arm64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36799"},{"id":"INC-11426","date":"2023-09","year":2023,"title":"libwebp: OOB write in BuildHuffmanTable","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-4863"],"affected":"go/github.com/chai2010/webp, go/github.com/chai2010/webp, go/github.com/chai2010/webp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4863"},{"id":"INC-11427","date":"2023-09","year":2023,"title":"Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-41885"],"affected":"pip/piccolo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41885"},{"id":"INC-11428","date":"2023-09","year":2023,"title":"Magento LTS's guest order \"protect code\" can be brute-forced too easily","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-41879"],"affected":"composer/openmage/magento-lts, composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41879"},{"id":"INC-11429","date":"2023-09","year":2023,"title":"Remote Code Execution in Custom Integration Upload","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-41319"],"affected":"pip/ethyca-fides","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41319"},{"id":"INC-11430","date":"2023-09","year":2023,"title":"Apollo Router Unnamed \"Subscription\" operation results in Denial-of-Service","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-41317"],"affected":"rust/apollo-router","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41317"},{"id":"INC-11432","date":"2023-09","year":2023,"title":"Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41933","CVE-2023-41944"],"affected":"maven/org.jenkins-ci.plugins:jobConfigHistory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41933"},{"id":"INC-11433","date":"2023-09","year":2023,"title":"Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-41058"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41058"},{"id":"INC-11434","date":"2023-09","year":2023,"title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41057"],"affected":"pip/hyper-bump-it","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41057"},{"id":"INC-11435","date":"2023-09","year":2023,"title":"Vyper: reversed order of side effects for some operations","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-40015"],"affected":"pip/vyper","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40015"},{"id":"INC-04377","date":"2023-08","year":2023,"title":"A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-47636"],"affected":"outsystems/service_studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-47636"},{"id":"INC-04449","date":"2023-08","year":2023,"title":"An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-39659"],"affected":"langchain/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39659"},{"id":"INC-04689","date":"2023-08","year":2023,"title":"Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privile...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27506"],"affected":"intel/optimization_for_tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27506"},{"id":"INC-04692","date":"2023-08","year":2023,"title":"In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-21276"],"affected":"google/android","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-21276"},{"id":"INC-04453","date":"2023-08","year":2023,"title":"An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38976"],"affected":"weaviate/weaviate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38976"},{"id":"INC-04373","date":"2023-08","year":2023,"title":"* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38975"],"affected":"qdrant/qdrant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38975"},{"id":"INC-04451","date":"2023-08","year":2023,"title":"An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-39662"],"affected":"llamaindex_project/llamaindex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39662"},{"id":"INC-11437","date":"2023-08","year":2023,"title":"Uncontrolled search path in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2022.3.0 may allow an authenticated user to potentially enable escalation of privile...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28405"],"affected":"intel/openvino","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28405"},{"id":"INC-11438","date":"2023-08","year":2023,"title":"DDFFileParser is vulnerable to XXE Attacks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41034"],"affected":"maven/org.eclipse.leshan:leshan-core, maven/org.eclipse.leshan:leshan-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41034"},{"id":"INC-11439","date":"2023-08","year":2023,"title":"Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"actions/https://github.com/pytorch/pytorch/.github/actions/filter-test-configs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hw6r-g8gj-2987"},{"id":"INC-11440","date":"2023-08","year":2023,"title":"Apache Airflow vulnerable arbitrary code execution via Spark server","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40195"],"affected":"pip/apache-airflow-providers-apache-spark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40195"},{"id":"INC-11441","date":"2023-08","year":2023,"title":"Esoteric YamlBeans XML Entity Expansion vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-24620","CVE-2023-24621"],"affected":"maven/com.esotericsoftware.yamlbeans:yamlbeans","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24620"},{"id":"INC-11442","date":"2023-08","year":2023,"title":"Pyramid static view path traversal up one directory","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40587"],"affected":"pip/pyramid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40587"},{"id":"INC-11443","date":"2023-08","year":2023,"title":"@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-41167"],"affected":"npm/@webiny/react-rich-text-renderer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-41167"},{"id":"INC-11444","date":"2023-08","year":2023,"title":"Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-40030"],"affected":"rust/cargo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40030"},{"id":"INC-11445","date":"2023-08","year":2023,"title":"XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40573"],"affected":"maven/org.xwiki.platform:xwiki-platform-scheduler-api, maven/com.xpn.xwiki.platform.plugins:xwiki-plugin-scheduler,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40573"},{"id":"INC-11446","date":"2023-08","year":2023,"title":"json2xml Uncaught Exception vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25024"],"affected":"pip/json2xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25024"},{"id":"INC-11447","date":"2023-08","year":2023,"title":"Jenkins Fortify Plugin HTML injection vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-4303"],"affected":"maven/org.jenkins-ci.plugins:fortify","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4303"},{"id":"INC-11448","date":"2023-08","year":2023,"title":"@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-40178"],"affected":"npm/@node-saml/node-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40178"},{"id":"INC-11449","date":"2023-08","year":2023,"title":"XWiki Platform privilege escalation (PR) from account through AWM content fields","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-40177"],"affected":"maven/org.xwiki.platform:xwiki-platform-appwithinminutes-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40177"},{"id":"INC-11450","date":"2023-08","year":2023,"title":"Craft CMS vulnerable to Remote Code Execution via validatePath bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-40035"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40035"},{"id":"INC-11451","date":"2023-08","year":2023,"title":"pandasai vulnerable to prompt injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-39660"],"affected":"pip/pandasai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39660"},{"id":"INC-11452","date":"2023-08","year":2023,"title":"Apache Ivy External Entity Reference vulnerability","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-46751"],"affected":"maven/org.apache.ivy:ivy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46751"},{"id":"INC-11453","date":"2023-08","year":2023,"title":"PandasAI vulnerable to arbitrary code execution","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2023-39661"],"affected":"pip/pandasai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39661"},{"id":"INC-11454","date":"2023-08","year":2023,"title":"Svelecte item names vulnerable to execution of arbitrary JavaScript","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38687"],"affected":"npm/svelecte","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38687"},{"id":"INC-11455","date":"2023-08","year":2023,"title":"lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/treeverse/lakefs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9phh-r37v-34wh"},{"id":"INC-11456","date":"2023-08","year":2023,"title":"OpenNMS vulnerable to Cross-site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-0871","CVE-2023-40312"],"affected":"maven/org.opennms:opennms-webapp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40312"},{"id":"INC-11457","date":"2023-08","year":2023,"title":".NET Information Disclosure Vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-35391"],"affected":"nuget/Microsoft.AspNetCore.SignalR.Redis, nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35391"},{"id":"INC-11458","date":"2023-08","year":2023,"title":"Critters Cross-site Scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-3481"],"affected":"npm/critters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-3481"},{"id":"INC-11459","date":"2023-08","year":2023,"title":"xuxueli xxl-job Cross-Site Request Forgery Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-24922"],"affected":"maven/com.xuxueli:xxl-job","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-24922"},{"id":"INC-11460","date":"2023-08","year":2023,"title":"ScanCode.io command injection in docker image fetch process","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-39523"],"affected":"pip/scancodeio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39523"},{"id":"INC-11461","date":"2023-08","year":2023,"title":"PrestaShop XSS injection through Validate::isCleanHTML method","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-39527"],"affected":"composer/prestashop/prestashop, composer/prestashop/prestashop, composer/prestashop/prestashop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-39527"},{"id":"INC-11462","date":"2023-08","year":2023,"title":"lol-html panics on certain HTML inputs","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-4241"],"affected":"rust/lol-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4241"},{"id":"INC-11463","date":"2023-08","year":2023,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38178"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38178"},{"id":"INC-11464","date":"2023-08","year":2023,"title":"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@nguniversal/common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-r3hf-q8q7-fv2p"},{"id":"INC-11465","date":"2023-08","year":2023,"title":"Magento Open Source allows Incorrect Authorization","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38207","CVE-2023-38208","CVE-2023-38209"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38209"},{"id":"INC-11466","date":"2023-08","year":2023,"title":"Cockpit Cross-site Scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-4196"],"affected":"composer/cockpit-hq/cockpit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4196"},{"id":"INC-11467","date":"2023-08","year":2023,"title":"Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38708"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38708"},{"id":"INC-11468","date":"2023-08","year":2023,"title":"pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-4145"],"affected":"composer/pimcore/customer-management-framework-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-4145"},{"id":"INC-11469","date":"2023-08","year":2023,"title":"Improper rendering of text nodes in golang.org/x/net/html","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-3978"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-3978"},{"id":"INC-11470","date":"2023-08","year":2023,"title":"Keylime's registrar vulnerable to Denial-of-service attack via a single open connection","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38200"],"affected":"pip/keylime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38200"},{"id":"INC-11471","date":"2023-08","year":2023,"title":"MindsDB can be made to not verify SSL certificates","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38699"],"affected":"pip/MindsDB","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38699"},{"id":"INC-04471","date":"2023-07","year":2023,"title":"Auto-GPT — Path Traversal (CVE-2023-37274)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-37274"],"affected":"agpt/autogpt_classic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37274"},{"id":"INC-04473","date":"2023-07","year":2023,"title":"Auto-GPT — Vulnerability (CVE-2023-37275)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37275"],"affected":"agpt/autogpt_classic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37275"},{"id":"INC-04472","date":"2023-07","year":2023,"title":"Auto-GPT — Vulnerability (CVE-2023-37273)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37273"],"affected":"agpt/autogpt_classic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37273"},{"id":"INC-11476","date":"2023-07","year":2023,"title":"XML External Entity (XXE) vulnerability in the XML data handler","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38490","CVE-2023-38491"],"affected":"composer/getkirby/cms, composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38490"},{"id":"INC-11477","date":"2023-07","year":2023,"title":"Anyone with a share link can RESET all website data in Umami","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/umami","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8www-cffh-4q98"},{"id":"INC-11478","date":"2023-07","year":2023,"title":"Obfuscated email addresses should not be sorted","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38509"],"affected":"maven/org.xwiki.platform:xwiki-platform-livetable-ui, maven/org.xwiki.platform:xwiki-platform-livetable-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38509"},{"id":"INC-11479","date":"2023-07","year":2023,"title":"Deserialization vulnerability in Helix workflow and REST","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38647"],"affected":"maven/org.apache.helix:helix-rest, maven/org.apache.helix:helix-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38647"},{"id":"INC-11480","date":"2023-07","year":2023,"title":"By-passing Cross-Site Scripting Protection in HTML Sanitizer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38500"],"affected":"composer/typo3/html-sanitizer, composer/typo3/html-sanitizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38500"},{"id":"INC-11481","date":"2023-07","year":2023,"title":"Making all attributes on a content-type public without noticing it","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-34093"],"affected":"npm/@strapi/database, npm/@strapi/utils, npm/@strapi/strapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34093"},{"id":"INC-11482","date":"2023-07","year":2023,"title":"Removal of e-Tugra root certificate","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37920"],"affected":"pip/certifi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37920"},{"id":"INC-11483","date":"2023-07","year":2023,"title":"Indico vulnerable to Cross-Site-Scripting via confirmation prompts","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37901"],"affected":"pip/indico","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37901"},{"id":"INC-11484","date":"2023-07","year":2023,"title":"Dapr API token authentication bypass in HTTP endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37918"],"affected":"go/github.com/dapr/dapr, go/github.com/dapr/dapr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37918"},{"id":"INC-11485","date":"2023-07","year":2023,"title":"OpenAM vulnerable to user impersonation using SAMLv1.x SSO process","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37471"],"affected":"maven/org.openidentityplatform.openam:openam-federation-library","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37471"},{"id":"INC-11486","date":"2023-07","year":2023,"title":"Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28754"],"affected":"maven/org.apache.shardingsphere:shardingsphere","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28754"},{"id":"INC-11487","date":"2023-07","year":2023,"title":"rswag vulnerable to arbitrary JSON and YAML file read via directory traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38337"],"affected":"rubygems/rswag","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38337"},{"id":"INC-11488","date":"2023-07","year":2023,"title":"SwiftTerm Code Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23465"],"affected":"swift/github.com/migueldeicaza/SwiftTerm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23465"},{"id":"INC-11489","date":"2023-07","year":2023,"title":"Spring-boot-admin sandbox bypass via crafted HTML","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-38286"],"affected":"maven/de.codecentric:spring-boot-admin-server, maven/de.codecentric:spring-boot-admin-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38286"},{"id":"INC-11490","date":"2023-07","year":2023,"title":"ImpressCMS Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-4036","CVE-2023-37785"],"affected":"composer/impresscms/impresscms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37785"},{"id":"INC-11491","date":"2023-07","year":2023,"title":"Jenkins SAML Single Sign On(SSO) Plugin missing permission check","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-37942","CVE-2023-37945"],"affected":"maven/io.jenkins.plugins:miniorange-saml-sp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37945"},{"id":"INC-11492","date":"2023-07","year":2023,"title":"Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-37280"],"affected":"composer/pimcore/admin-ui-classic-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37280"},{"id":"INC-11493","date":"2023-07","year":2023,"title":"Apache Ambari Expression Language Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-42009"],"affected":"maven/org.apache.ambari:ambari","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-42009"},{"id":"INC-11494","date":"2023-07","year":2023,"title":"Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33127"],"affected":"nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86, nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33127"},{"id":"INC-11495","date":"2023-07","year":2023,"title":"Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-33170"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64, nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33170"},{"id":"INC-11496","date":"2023-07","year":2023,"title":"Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/Whatsapp-Chat-Exporter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8c6x-g4fw-8rf4"},{"id":"INC-11497","date":"2023-07","year":2023,"title":"Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-3574"],"affected":"composer/pimcore/customer-management-framework-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-3574"},{"id":"INC-11498","date":"2023-07","year":2023,"title":"RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-37271"],"affected":"pip/restrictedpython, pip/RestrictedPython, pip/RestrictedPython","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37271"},{"id":"INC-11499","date":"2023-07","year":2023,"title":"XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-37277"],"affected":"maven/org.xwiki.platform:xwiki-platform-rest-server, maven/com.xpn.xwiki.platform:xwiki-rest,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37277"},{"id":"INC-11500","date":"2023-07","year":2023,"title":"Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/org.eclipse.jetty:jetty-xml, maven/org.eclipse.jetty:jetty-xml, maven/org.eclipse.jetty:jetty-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-58qw-p7qm-5rvh"},{"id":"INC-11501","date":"2023-07","year":2023,"title":"Pipelines do not validate child UIDs","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-37264"],"affected":"go/github.com/tektoncd/pipeline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-37264"},{"id":"INC-11502","date":"2023-07","year":2023,"title":"Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36828"],"affected":"composer/statamic/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36828"},{"id":"INC-11503","date":"2023-07","year":2023,"title":"Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36823"],"affected":"rubygems/sanitize","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36823"},{"id":"INC-11504","date":"2023-07","year":2023,"title":"Apache StreamPark Improper Input Validation vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-46365"],"affected":"maven/org.apache.streampark:streampark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46365"},{"id":"INC-11505","date":"2023-07","year":2023,"title":"Apache Linkis Authentication Bypass vulnerability","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27987"],"affected":"maven/org.apache.linkis:linkis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27987"},{"id":"INC-11506","date":"2023-07","year":2023,"title":"Magento Open Source allows Cross-Site Scripting (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-22247","CVE-2023-22249","CVE-2023-22250","CVE-2023-22251"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22249"},{"id":"INC-11507","date":"2023-07","year":2023,"title":"Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-28680","CVE-2023-28681","CVE-2023-28682","CVE-2023-28683","CVE-2023-28684","CVE-2023-28685"],"affected":"maven/org.jenkins-ci.plugins:absint-a3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28685"},{"id":"INC-11508","date":"2023-07","year":2023,"title":"@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/@vendure/admin-ui-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gm68-572p-q28r"},{"id":"INC-11509","date":"2023-07","year":2023,"title":"Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-36809"],"affected":"pip/kiwitcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36809"},{"id":"INC-11510","date":"2023-07","year":2023,"title":"1Panel vulnerable to command injection when entering the container terminal","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36457","CVE-2023-36458"],"affected":"go/github.com/1Panel-dev/1Panel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36458"},{"id":"INC-11511","date":"2023-07","year":2023,"title":"MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34457"],"affected":"pip/MechanicalSoup","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34457"},{"id":"INC-11512","date":"2023-07","year":2023,"title":"Apache Airflow Hive Provider Beeline remote code execution with Principal","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-35797"],"affected":"pip/apache-airflow-providers-apache-hive","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35797"},{"id":"INC-04569","date":"2023-06","year":2023,"title":"ChuanhuChatGPT — Vulnerability (CVE-2023-34094)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-34094"],"affected":"chuanhuchatgpt_project/chuanhuchatgpt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34094"},{"id":"INC-04716","date":"2023-06","year":2023,"title":"Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper).","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-34540"],"affected":"langchain/langchain","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34540"},{"id":"INC-04951","date":"2023-06","year":2023,"title":"The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-3150","CVE-2023-2221"],"affected":"wp_custom_cursors_project/wp_custom_cursors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2221"},{"id":"INC-04672","date":"2023-06","year":2023,"title":"Gradio — Vulnerability (CVE-2023-34239)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34239"],"affected":"gradio_project/gradio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34239"},{"id":"INC-04908","date":"2023-06","year":2023,"title":"Syncthing — Xss (CVE-2022-46165)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-46165"],"affected":"syncthing/syncthing","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46165"},{"id":"INC-11513","date":"2023-06","year":2023,"title":"PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-36807"],"affected":"pip/PyPDF2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36807"},{"id":"INC-11514","date":"2023-06","year":2023,"title":"XWiki Platform vulnerable to Code Injection in icon themes","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36470"],"affected":"maven/org.xwiki.platform:xwiki-platform-icon-ui, maven/org.xwiki.platform:xwiki-platform-icon-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36470"},{"id":"INC-11515","date":"2023-06","year":2023,"title":"org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-36471"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml, maven/org.xwiki.commons:xwiki-commons-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36471"},{"id":"INC-11516","date":"2023-06","year":2023,"title":"pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-36464"],"affected":"pip/PyPDF2, pip/pypdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-36464"},{"id":"INC-11517","date":"2023-06","year":2023,"title":"py-xml XML External Entity Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-26709"],"affected":"pip/py-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26709"},{"id":"INC-11518","date":"2023-06","year":2023,"title":"easy-parse XML External Entity Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-26710"],"affected":"pip/easy-parse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26710"},{"id":"INC-11519","date":"2023-06","year":2023,"title":"requests-xml XML External Entity Injection vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-26708"],"affected":"pip/requests-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26708"},{"id":"INC-11520","date":"2023-06","year":2023,"title":"PlantUML Server-Side Request Forgery vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-3431","CVE-2023-3432"],"affected":"maven/net.sourceforge.plantuml:plantuml, maven/net.sourceforge.plantuml:plantuml-mit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-3432"},{"id":"INC-11521","date":"2023-06","year":2023,"title":"Coraza has potential denial of service vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-40586"],"affected":"go/github.com/corazawaf/coraza/v2, go/github.com/corazawaf/coraza/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-40586"},{"id":"INC-11522","date":"2023-06","year":2023,"title":"Shescape potential environment variable exposure on Windows with CMD","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-35931"],"affected":"npm/shescape","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35931"},{"id":"INC-11523","date":"2023-06","year":2023,"title":"passport-wsfed-saml2 Signature Bypass vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/passport-wsfed-saml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5wrg-8fxp-cx9r"},{"id":"INC-11524","date":"2023-06","year":2023,"title":"Backstage Scaffolder plugin has insecure sandbox","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-35926"],"affected":"npm/@backstage/plugin-scaffolder-backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35926"},{"id":"INC-11525","date":"2023-06","year":2023,"title":"passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-16897"],"affected":"npm/passport-wsfed-saml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-16897"},{"id":"INC-11526","date":"2023-06","year":2023,"title":"XWiki Platform may retrieve email addresses of all users","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34467"],"affected":"maven/org.xwiki.platform:xwiki-platform-livetable-ui, maven/org.xwiki.platform:xwiki-platform-livetable-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34467"},{"id":"INC-11527","date":"2023-06","year":2023,"title":"XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-34464"],"affected":"maven/org.xwiki.platform:xwiki-platform-web-templates, maven/org.xwiki.platform:xwiki-platform-web-templates,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34464"},{"id":"INC-11528","date":"2023-06","year":2023,"title":"Craft CMS vulnerable to HTML injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-33495"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33495"},{"id":"INC-11529","date":"2023-06","year":2023,"title":"Grav Server Side Template Injection (SSTI) vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-34251"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34251"},{"id":"INC-11531","date":"2023-06","year":2023,"title":"fast-xml-parser regex vulnerability patch could be improved from a safety perspective","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34104"],"affected":"npm/fast-xml-parser","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gpv5-7x3g-ghjv"},{"id":"INC-11532","date":"2023-06","year":2023,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-3193"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-3193"},{"id":"INC-11533","date":"2023-06","year":2023,"title":"Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33126"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33126"},{"id":"INC-11534","date":"2023-06","year":2023,"title":".NET Denial of Service vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-29331"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29331"},{"id":"INC-11535","date":"2023-06","year":2023,"title":".NET Elevation of Privilege Vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-24936"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24936"},{"id":"INC-11536","date":"2023-06","year":2023,"title":"NuGet Client Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-29337"],"affected":"nuget/NuGet.Protocol, nuget/NuGet.Common, nuget/NuGet.CommandLine","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29337"},{"id":"INC-11537","date":"2023-06","year":2023,"title":"Jenkins Digital.ai App Management Publisher Plugin vulnerable to Cross-Site Request Forgery","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-35148","CVE-2023-35149"],"affected":"maven/org.jenkins-ci.plugins:ease-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-35148"},{"id":"INC-11538","date":"2023-06","year":2023,"title":"fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26920"],"affected":"npm/fast-xml-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26920"},{"id":"INC-11539","date":"2023-06","year":2023,"title":"Grafana has Broken Access Control in Alert manager: Viewer can send test alerts","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-2183"],"affected":"go/github.com/grafana/grafana, go/github.com/grafana/grafana, go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2183"},{"id":"INC-11540","date":"2023-06","year":2023,"title":"rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-23913"],"affected":"rubygems/actionview, rubygems/actionview","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23913"},{"id":"INC-11541","date":"2023-06","year":2023,"title":"Hashicorp Vault vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-2121"],"affected":"go/github.com/hashicorp/vault, go/github.com/hashicorp/vault, go/github.com/hashicorp/vault","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2121"},{"id":"INC-11542","date":"2023-06","year":2023,"title":"Synapse has improper checks for deactivated users during login","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-32682"],"affected":"pip/matrix-synapse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32682"},{"id":"INC-11543","date":"2023-06","year":2023,"title":"avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-34103"],"affected":"rubygems/avo, rubygems/avo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34103"},{"id":"INC-11544","date":"2023-06","year":2023,"title":"Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-2984"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2984"},{"id":"INC-11545","date":"2023-06","year":2023,"title":"JStachio XSS vulnerability: Unescaped single quotes","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-33962"],"affected":"maven/io.jstach:jstachio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33962"},{"id":"INC-11546","date":"2023-06","year":2023,"title":"xml-rs vulnerable to denial of service via invalid token in XML document","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34411"],"affected":"rust/xml-rs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34411"},{"id":"INC-11547","date":"2023-06","year":2023,"title":"Hashicorp Consul allows user with service:write permissions to patch remote proxy instances","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-2816"],"affected":"go/github.com/hashicorp/consul","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2816"},{"id":"INC-04622","date":"2023-05","year":2023,"title":"Directory traversal vulnerability in ESS REC Agent Server Edition series allows an authenticated attacker to view or alter an arbitrary file on the server.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28382"],"affected":"et-x/ess_rec","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28382"},{"id":"INC-04376","date":"2023-05","year":2023,"title":"A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path param...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30172"],"affected":"lfprojects/mlflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30172"},{"id":"INC-04945","date":"2023-05","year":2023,"title":"The n8n package 0.218.0 for Node.js allows Directory Traversal.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2023-27562","CVE-2023-27563","CVE-2023-27564"],"affected":"n8n/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27562"},{"id":"INC-04943","date":"2023-05","year":2023,"title":"The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users,...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-1651"],"affected":"quantumcloud/wpbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-1651"},{"id":"INC-04668","date":"2023-05","year":2023,"title":"gpt_academic provides a graphical interface for ChatGPT/GLM.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-33979"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33979"},{"id":"INC-11548","date":"2023-05","year":2023,"title":"Phishing attack vulnerability by uploading malicious HTML file","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-32689"],"affected":"npm/parse-server, npm/parse-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32689"},{"id":"INC-11549","date":"2023-05","year":2023,"title":"Dcat-Admin vulnerable to Stored Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33736"],"affected":"composer/dcat/laravel-admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33736"},{"id":"INC-11550","date":"2023-05","year":2023,"title":"Signature validation bypass in github.com/moov-io/signedxml","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-34205"],"affected":"go/github.com/moov-io/signedxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-34205"},{"id":"INC-11551","date":"2023-05","year":2023,"title":"ruby-saml vulnerable to XPath injection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-20108"],"affected":"rubygems/ruby-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-20108"},{"id":"INC-11552","date":"2023-05","year":2023,"title":"keep-module-latest vulnerable to Command Injection due to missing input sanitization","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26128"],"affected":"npm/keep-module-latest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26128"},{"id":"INC-11553","date":"2023-05","year":2023,"title":"CraftCMS stored XSS in Quick Post widget error message","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33194"],"affected":"composer/craftcms/cms, composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33194"},{"id":"INC-11554","date":"2023-05","year":2023,"title":"html inputs of type password recorded in plaintext when converted to text inputs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-33187"],"affected":"npm/highlight.run","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33187"},{"id":"INC-11555","date":"2023-05","year":2023,"title":"Cross-site scripting in Liferay Portal","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33937","CVE-2023-33938","CVE-2023-33939","CVE-2023-33940","CVE-2023-33941","CVE-2023-33942","CVE-2023-33943","CVE-2023-33944"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33944"},{"id":"INC-11556","date":"2023-05","year":2023,"title":"SQL injection in Liferay Portal","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-33945"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-33945"},{"id":"INC-11557","date":"2023-05","year":2023,"title":"Administration Console authentication bypass in openfire xmppserver","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-32315"],"affected":"maven/org.igniterealtime.openfire:xmppserver, maven/org.igniterealtime.openfire:xmppserver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32315"},{"id":"INC-11558","date":"2023-05","year":2023,"title":"Potential for cross-site scripting in PostHog-js","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-32325"],"affected":"npm/posthog-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32325"},{"id":"INC-11559","date":"2023-05","year":2023,"title":"alkacon-OpenCMS vulnerable to stored Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31544"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31544"},{"id":"INC-11560","date":"2023-05","year":2023,"title":"Moodle vulnerable to stored Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-27131"],"affected":"composer/moodle/moodle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-27131"},{"id":"INC-11562","date":"2023-05","year":2023,"title":"glazedlists XML Deserialization vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31890"],"affected":"maven/com.glazedlists:glazedlists","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31890"},{"id":"INC-11563","date":"2023-05","year":2023,"title":"Any file can be included with the pymdown-snippets extension","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-32309"],"affected":"pip/pymdown-extensions","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32309"},{"id":"INC-11564","date":"2023-05","year":2023,"title":"Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-29401"],"affected":"go/github.com/gin-gonic/gin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29401"},{"id":"INC-11566","date":"2023-05","year":2023,"title":"Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-2629"],"affected":"composer/pimcore/customer-management-framework-bundle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2629"},{"id":"INC-11567","date":"2023-05","year":2023,"title":"Wings vulnerable to escape to host from installation container","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-32080"],"affected":"go/github.com/pterodactyl/wings, go/github.com/pterodactyl/wings","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-32080"},{"id":"INC-11568","date":"2023-05","year":2023,"title":"Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31126"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31126"},{"id":"INC-11569","date":"2023-05","year":2023,"title":"On a compromised node, the fluid-csi service account can be used to modify node specs","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-30840"],"affected":"go/github.com/fluid-cloudnative/fluid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30840"},{"id":"INC-11570","date":"2023-05","year":2023,"title":"teampass vulnerable to code injection","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-2591"],"affected":"composer/nilsteampassnet/teampass","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2591"},{"id":"INC-11571","date":"2023-05","year":2023,"title":"jsreport vulnerable to code injection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-2583"],"affected":"npm/jsreport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2583"},{"id":"INC-11572","date":"2023-05","year":2023,"title":"Mage-ai missing user authentication","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-31143"],"affected":"pip/mage-ai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31143"},{"id":"INC-14621","date":"2023-05","year":2023,"title":"ONOS vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30093"],"affected":"maven/org.onosproject:onos-archetypes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30093"},{"id":"INC-14622","date":"2023-05","year":2023,"title":"Cross-site scripting in TotalJS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30094"],"affected":"npm/total4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30094"},{"id":"INC-11573","date":"2023-05","year":2023,"title":"Stored cross site scripting in Microbin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-27075"],"affected":"rust/microbin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27075"},{"id":"INC-11574","date":"2023-05","year":2023,"title":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30861"],"affected":"pip/flask, pip/flask","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30861"},{"id":"INC-11575","date":"2023-05","year":2023,"title":"editor.md vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29641"],"affected":"npm/editor.md","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29641"},{"id":"INC-11576","date":"2023-05","year":2023,"title":"Apache StreamPark LDAP Injection vulnerability","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-45801"],"affected":"maven/org.apache.streampark:streampark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-45801"},{"id":"INC-04480","date":"2023-04","year":2023,"title":"Azure Machine Learning Information Disclosure Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-28312"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28312"},{"id":"INC-04759","date":"2023-04","year":2023,"title":"mindsdb — Vulnerability (CVE-2023-30620)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30620"],"affected":"mindsdb/mindsdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30620"},{"id":"INC-04683","date":"2023-04","year":2023,"title":"IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF).","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30444"],"affected":"ibm/watson_machine_learning_on_cloud_pak_for_data","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30444"},{"id":"INC-11578","date":"2023-04","year":2023,"title":"Chosen Ciphertext Attack in Jose4j","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"maven/org.bitbucket.b_c:jose4j","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-jgvc-jfgh-rjvv"},{"id":"INC-11579","date":"2023-04","year":2023,"title":"SQL Injection in Admin Translations API","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30850"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30850"},{"id":"INC-11580","date":"2023-04","year":2023,"title":"SQL Injection in Translation Export API","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30849"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30849"},{"id":"INC-11581","date":"2023-04","year":2023,"title":"SQL Injection in Admin Search Find API","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30848"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30848"},{"id":"INC-11582","date":"2023-04","year":2023,"title":"Undefined Behavior in Rust runtime functions","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30624"],"affected":"rust/wasmtime, rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30624"},{"id":"INC-11583","date":"2023-04","year":2023,"title":"Cross Site Scripting (XSS) in Serenity","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31285"],"affected":"nuget/Serenity.Net.Services, nuget/Serenity.Net.Core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31285"},{"id":"INC-11584","date":"2023-04","year":2023,"title":"Missing permission check of canView in GridFieldPrintButton","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-22728"],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22728"},{"id":"INC-11585","date":"2023-04","year":2023,"title":"Ironic and ironic-inspector may expose as ConfigMaps","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-30841"],"affected":"go/github.com/metal3-io/baremetal-operator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30841"},{"id":"INC-11586","date":"2023-04","year":2023,"title":"Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30549"],"affected":"go/github.com/apptainer/apptainer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30549"},{"id":"INC-11587","date":"2023-04","year":2023,"title":"HTML injection in search results via plaintext message highlighting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30609"],"affected":"npm/matrix-react-sdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30609"},{"id":"INC-11588","date":"2023-04","year":2023,"title":"Possible XSS injection through Validate::isCleanHTML method","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30838"],"affected":"composer/prestashop/prestashop, composer/prestashop/prestashop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30838"},{"id":"INC-11589","date":"2023-04","year":2023,"title":"Duplicate Advisory: AVideo contains Command injection when embedding a video link","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-25313"],"affected":"composer/wwbn/avideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wj6r-53f5-q789"},{"id":"INC-11590","date":"2023-04","year":2023,"title":"Uncaught Exception in yaml","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-2251"],"affected":"npm/yaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-2251"},{"id":"INC-11591","date":"2023-04","year":2023,"title":"Cross-site Scripting in Backdrop CMS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-31045"],"affected":"composer/backdrop/backdrop","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-31045"},{"id":"INC-11592","date":"2023-04","year":2023,"title":"XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-29525"],"affected":"maven/org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui, maven/org.xwiki.platform:xwiki-platform-distributio…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29525"},{"id":"INC-11593","date":"2023-04","year":2023,"title":"XWiki Platform vulnerable to code injection in display method used in user profiles","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29523"],"affected":"maven/org.xwiki.platform:xwiki-platform-oldcore, maven/org.xwiki.platform:xwiki-platform-oldcore,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29523"},{"id":"INC-11594","date":"2023-04","year":2023,"title":"pretalx vulnerable to path traversal in HTML export","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28458","CVE-2023-28459"],"affected":"pip/pretalx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28459"},{"id":"INC-11595","date":"2023-04","year":2023,"title":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-30614"],"affected":"rubygems/pay","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30614"},{"id":"INC-11596","date":"2023-04","year":2023,"title":"Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29528"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29528"},{"id":"INC-11597","date":"2023-04","year":2023,"title":"Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-22621"],"affected":"npm/@strapi/plugin-email, npm/@strapi/plugin-users-permissions","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22621"},{"id":"INC-11598","date":"2023-04","year":2023,"title":"Code injection via unescaped translations in xwiki-platform","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29510"],"affected":"maven/org.xwiki.platform:xwiki-platform-administration-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29510"},{"id":"INC-11599","date":"2023-04","year":2023,"title":"Debug mode leaks confidential data in Cilium","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2023-29002"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29002"},{"id":"INC-11600","date":"2023-04","year":2023,"title":"Apache Spark vulnerable to Improper Privilege Management","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-22946"],"affected":"pip/pyspark, maven/org.apache.spark:spark-core_2.13, maven/org.apache.spark:spark-core_2.12","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22946"},{"id":"INC-11601","date":"2023-04","year":2023,"title":"Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-29207"],"affected":"maven/org.xwiki.platform:xwiki-web-standard, maven/org.xwiki.platform:xwiki-platform-web,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29207"},{"id":"INC-11602","date":"2023-04","year":2023,"title":"vm2 Sandbox Escape vulnerability","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29199"],"affected":"npm/vm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29199"},{"id":"INC-11603","date":"2023-04","year":2023,"title":"OpenFeature Operator vulnerable to Cluster-level Privilege Escalation","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-29018"],"affected":"go/github.com/open-feature/open-feature-operator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29018"},{"id":"INC-11604","date":"2023-04","year":2023,"title":"org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29205"],"affected":"maven/org.xwiki.platform:xwiki-platform-rendering-xwiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29205"},{"id":"INC-11605","date":"2023-04","year":2023,"title":"org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29202"],"affected":"maven/org.xwiki.platform:xwiki-platform-rendering-macro-rss, maven/org.xwiki.platform:xwiki-core-rendering-macro-rss","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29202"},{"id":"INC-11606","date":"2023-04","year":2023,"title":"org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-29201"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29201"},{"id":"INC-11607","date":"2023-04","year":2023,"title":"org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-30537"],"affected":"maven/org.xwiki.platform:xwiki-platform-flamingo-theme-ui, maven/org.xwiki.platform:xwiki-platform-flamingo-theme-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30537"},{"id":"INC-11608","date":"2023-04","year":2023,"title":"org.xwiki.platform:xwiki-platform-logging-ui Eval Injection vulnerability","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-29213"],"affected":"maven/org.xwiki.platform:xwiki-platform-logging-ui, maven/org.xwiki.platform:xwiki-platform-logging-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29213"},{"id":"INC-11609","date":"2023-04","year":2023,"title":"Jenkins Kubernetes Plugin does not properly mask credentials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-30513","CVE-2023-30514","CVE-2023-30515","CVE-2023-30527","CVE-2023-30528"],"affected":"maven/org.csanchez.jenkins.plugins:kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30513"},{"id":"INC-11610","date":"2023-04","year":2023,"title":"XXL-JOB vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26120"],"affected":"maven/com.xuxueli:xxl-job","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26120"},{"id":"INC-11611","date":"2023-04","year":2023,"title":"HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-1782"],"affected":"go/github.com/hashicorp/nomad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-1782"},{"id":"INC-11612","date":"2023-04","year":2023,"title":"thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-1756"],"affected":"composer/thorsten/phpmyfaq","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-1756"},{"id":"INC-11613","date":"2023-04","year":2023,"title":"SvelteKit vulnerable to Cross-Site Request Forgery","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-29003"],"affected":"npm/@sveltejs/kit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-29003"},{"id":"INC-11614","date":"2023-04","year":2023,"title":"Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-28836"],"affected":"pip/wagtail, pip/wagtail","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28836"},{"id":"INC-04950","date":"2023-03","year":2023,"title":"The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-4265"],"affected":"gopostmatic/replyable","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-4265"},{"id":"INC-04830","date":"2023-03","year":2023,"title":"redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in...","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-28858"],"affected":"redis/redis-py","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28858"},{"id":"INC-04758","date":"2023-03","year":2023,"title":"MindsDB — Path Traversal (CVE-2022-23522)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23522"],"affected":"mindsdb/mindsdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23522"},{"id":"INC-11617","date":"2023-03","year":2023,"title":"Karate has vulnerable dependency on json-smart package (CVE-2023-1370)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"maven/com.intuit.karate:karate-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5x5q-8cgm-2hjq"},{"id":"INC-11618","date":"2023-03","year":2023,"title":"Kiwi TCMS Stored Cross-site Scripting via SVG file","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27489"],"affected":"pip/kiwitcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27489"},{"id":"INC-11619","date":"2023-03","year":2023,"title":"Use of hard-coded, security-relevant constants in deepset-ai/haystack","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-1712"],"affected":"pip/farm-haystack","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-1712"},{"id":"INC-11620","date":"2023-03","year":2023,"title":"Apache UIMA DUCC allows remote code execution","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28935"],"affected":"maven/org.apache.uima:uima-ducc-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28935"},{"id":"INC-11621","date":"2023-03","year":2023,"title":"HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-0620"],"affected":"go/github.com/hashicorp/vault, go/github.com/hashicorp/vault, go/github.com/hashicorp/vault","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0620"},{"id":"INC-11622","date":"2023-03","year":2023,"title":"HashiCorp Vault's PKI mount vulnerable to denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-0665"],"affected":"go/github.com/hashicorp/vault, go/github.com/hashicorp/vault, go/github.com/hashicorp/vault","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0665"},{"id":"INC-11623","date":"2023-03","year":2023,"title":"Veracode Scan Jenkins Plugin vulnerable to information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2023-25721","CVE-2023-25722"],"affected":"maven/com.veracode.jenkins:veracode-scan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25721"},{"id":"INC-11624","date":"2023-03","year":2023,"title":"Comrak AST node data is not validated (GHSL-2023-049)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28631"],"affected":"rust/comrak","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28631"},{"id":"INC-11625","date":"2023-03","year":2023,"title":"Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28604"],"affected":"composer/sitegeist/fluid-components","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28604"},{"id":"INC-11626","date":"2023-03","year":2023,"title":"Interactive `run` permission prompt spoofing via improper ANSI neutralization","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28446"],"affected":"rust/deno, rust/deno_runtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28446"},{"id":"INC-11627","date":"2023-03","year":2023,"title":"angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28444"],"affected":"npm/angular-server-side-configuration","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28444"},{"id":"INC-09554","date":"2023-03","year":2023,"title":"Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-36551"],"affected":"pip/label-studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cpmr-mw4j-99r7"},{"id":"INC-11628","date":"2023-03","year":2023,"title":"`openssl` `X509NameBuilder::build` returned object is not thread safe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/openssl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3gxf-9r58-2ghg"},{"id":"INC-11629","date":"2023-03","year":2023,"title":"Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-1410"],"affected":"go/github.com/grafana/grafana, go/github.com/grafana/grafana, go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-1410"},{"id":"INC-11630","date":"2023-03","year":2023,"title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28119"],"affected":"go/github.com/crewjam/saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28119"},{"id":"INC-11631","date":"2023-03","year":2023,"title":"Apache Tomcat vulnerable to Unprotected Transport of Credentials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28708"],"affected":"maven/org.apache.tomcat:tomcat-catalina, maven/org.apache.tomcat:tomcat-catalina,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708"},{"id":"INC-11632","date":"2023-03","year":2023,"title":"`cilium-cli` disables etcd authorization for clustermesh clusters","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28114"],"affected":"go/github.com/cilium/cilium-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28114"},{"id":"INC-11633","date":"2023-03","year":2023,"title":"CairoSVG improperly processes SVG files loaded from external resources","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-27586"],"affected":"pip/CairoSVG","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27586"},{"id":"INC-11634","date":"2023-03","year":2023,"title":"kaml has potential denial of service while parsing input with anchors and aliases","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-28118"],"affected":"maven/com.charleskorn.kaml:kaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28118"},{"id":"INC-11636","date":"2023-03","year":2023,"title":"PHAR deserialization allowing remote code execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-28115"],"affected":"composer/knplabs/knp-snappy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28115"},{"id":"INC-11637","date":"2023-03","year":2023,"title":"Cilium eBPF filters may be temporarily removed during agent restart","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27595"],"affected":"go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27595"},{"id":"INC-11638","date":"2023-03","year":2023,"title":"cilium-agent container can access the host via `hostPath` mount","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27593"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27593"},{"id":"INC-11639","date":"2023-03","year":2023,"title":"russh may use insecure Diffie-Hellman keys","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-28113"],"affected":"rust/russh, rust/russh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-28113"},{"id":"INC-11640","date":"2023-03","year":2023,"title":"On a compromised node, the virt-handler service account can be used to modify all node specs","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-26484"],"affected":"go/kubevirt.io/kubevirt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26484"},{"id":"INC-05096","date":"2023-03","year":2023,"title":"SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-0335","CVE-2022-41183","CVE-2022-41184","CVE-2023-25617"],"affected":"pip/sap-ai-sdk-base","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25617"},{"id":"INC-14623","date":"2023-03","year":2023,"title":"ONOS vulnerable to reflected cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24279"],"affected":"maven/org.onosproject:onos-archetypes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24279"},{"id":"INC-11641","date":"2023-03","year":2023,"title":"Duplicate Advisory: Cross Site Scripting in eZ Platform Ibexa Kernel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/ezsystems/ezplatform-kernel, composer/ezsystems/ezplatform-kernel, composer/ezsystems/ezpublish-kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-c737-jhwr-fqxj"},{"id":"INC-11642","date":"2023-03","year":2023,"title":"Timing attack in eZ Platform Ibexa","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-48366"],"affected":"composer/ezsystems/ezpublish-kernel, composer/ezsystems/ezplatform-kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-48366"},{"id":"INC-11643","date":"2023-03","year":2023,"title":"Information disclosure through error stack traces related to agents","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27904"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904"},{"id":"INC-11644","date":"2023-03","year":2023,"title":"Consul Server Panic when Ingress and API Gateways Configured with Peering Connections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-0845","CVE-2023-26054"],"affected":"go/github.com/hashicorp/consul","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0845"},{"id":"INC-11645","date":"2023-03","year":2023,"title":"XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27480"],"affected":"maven/org.xwiki.platform:xwiki-platform-xar-model, maven/org.xwiki.platform:xwiki-platform-xar-model,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27480"},{"id":"INC-11646","date":"2023-03","year":2023,"title":"OWSLib vulnerable to XML External Entity (XXE) Injection","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-27476"],"affected":"pip/OWSLib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27476"},{"id":"INC-11647","date":"2023-03","year":2023,"title":"directus vulnerable to HTML Injection in Password Reset email to custom Reset URL","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-27474"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-27474"},{"id":"INC-11648","date":"2023-03","year":2023,"title":"XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26480"],"affected":"maven/org.xwiki.platform:xwiki-platform-livedata-macro, maven/org.xwiki.platform:xwiki-platform-livedata-macro,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26480"},{"id":"INC-11649","date":"2023-03","year":2023,"title":"XWiki Platform may allow privilege escalation to programming rights via user's first name","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26055"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml, maven/org.xwiki.commons:xwiki-commons-xml,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26055"},{"id":"INC-11650","date":"2023-03","year":2023,"title":"gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26483"],"affected":"go/github.com/russellhaering/gosaml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26483"},{"id":"INC-11651","date":"2023-03","year":2023,"title":"Vega has Cross-site Scripting vulnerability in `lassoAppend` function","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-26487"],"affected":"npm/vega-functions, npm/vega","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26487"},{"id":"INC-11652","date":"2023-03","year":2023,"title":"Kubernetes vulnerable to validation bypass","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-3294"],"affected":"go/github.com/kubernetes/kubernetes, go/github.com/kubernetes/kubernetes, go/github.com/kubernetes/kubernetes","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3294"},{"id":"INC-11653","date":"2023-03","year":2023,"title":"Grafana vulnerable to Stored Cross-site Scripting in Text plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-22462"],"affected":"go/github.com/grafana/grafana, go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22462"},{"id":"INC-11654","date":"2023-03","year":2023,"title":"teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-26046"],"affected":"go/github.com/kitabisa/teler-waf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26046"},{"id":"INC-11655","date":"2023-03","year":2023,"title":"Lemur subject to insecure random generation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-30797"],"affected":"pip/lemur","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-30797"},{"id":"INC-04944","date":"2023-02","year":2023,"title":"The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or priv...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-0405"],"affected":"gptaipower/gpt_ai_power","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0405"},{"id":"INC-04973","date":"2023-02","year":2023,"title":"Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user to potentially enable escalation of pr...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-26076"],"affected":"intel/oneapi_deep_neural_network","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26076"},{"id":"INC-04479","date":"2023-02","year":2023,"title":"Azure Machine Learning Compute Instance Information Disclosure Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-23382"],"affected":"microsoft/azure_machine_learning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23382"},{"id":"INC-11656","date":"2023-02","year":2023,"title":"XML External Entity (XXE) vulnerability in apoc.import.graphml","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-23926"],"affected":"maven/org.neo4j.procedure:apoc, maven/org.neo4j.procedure:apoc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9vx8-f5c4-862x"},{"id":"INC-11657","date":"2023-02","year":2023,"title":"rangy vulnerable to Prototype Pollution","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-26102"],"affected":"npm/rangy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-26102"},{"id":"INC-11658","date":"2023-02","year":2023,"title":"@braintree/sanitize-url Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-48345"],"affected":"npm/@braintree/sanitize-url","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-48345"},{"id":"INC-11659","date":"2023-02","year":2023,"title":"Microweber Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-32856"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32856"},{"id":"INC-11660","date":"2023-02","year":2023,"title":"Stored cross site scripting in changedetection.io","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24769"],"affected":"pip/changedetection.io","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24769"},{"id":"INC-11661","date":"2023-02","year":2023,"title":"Users with any cluster secret update access may update out-of-bounds cluster secrets","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-23947"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23947"},{"id":"INC-11662","date":"2023-02","year":2023,"title":"Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27098"],"affected":"npm/@graphql-mesh/http, npm/@graphql-mesh/cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27098"},{"id":"INC-11663","date":"2023-02","year":2023,"title":"Cross site scripting Vulnerability in backstage Software Catalog","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-25571"],"affected":"npm/@backstage/plugin-catalog-backend, npm/@backstage/catalog-model, npm/@backstage/core-components","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25571"},{"id":"INC-11664","date":"2023-02","year":2023,"title":"XML External Entity Reference in ureport","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24187"],"affected":"maven/com.bstek.ureport:ureport2-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24187"},{"id":"INC-11665","date":"2023-02","year":2023,"title":"Cross-Site-Scripting attack on `<RichTextField>`","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-25572"],"affected":"npm/ra-ui-materialui, npm/ra-ui-materialui, npm/react-admin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25572"},{"id":"INC-11666","date":"2023-02","year":2023,"title":"Cross-site Scripting vulnerability in drag-and-drop upload of phpMyAdmin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-25727"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-25727"},{"id":"INC-11667","date":"2023-02","year":2023,"title":"Formwork Cross-site Scripting (XSS) from Page title field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24230"],"affected":"composer/getformwork/formwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24230"},{"id":"INC-11668","date":"2023-02","year":2023,"title":"XML External Entity Reference in Apache NiFi","severity":"Critical","attack_vector":"other","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2017-12623","CVE-2018-1309","CVE-2021-44145","CVE-2022-29265","CVE-2022-33140","CVE-2023-22832"],"affected":"maven/org.apache.nifi:nifi-ccda-processors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22832"},{"id":"INC-11669","date":"2023-02","year":2023,"title":"TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24814"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24814"},{"id":"INC-11670","date":"2023-02","year":2023,"title":"Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/k8s.io/apimachinery","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-74fp-r6jw-h4mp"},{"id":"INC-11671","date":"2023-02","year":2023,"title":"wallabag subject to Improper Authorization via annotations","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-0610"],"affected":"composer/wallabag/wallabag","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0610"},{"id":"INC-11672","date":"2023-02","year":2023,"title":"Pimcore contains Unrestricted Upload of File with Dangerous Type","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-23937"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23937"},{"id":"INC-11676","date":"2023-01","year":2023,"title":"Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-21129"],"affected":"paypal/nemo-appium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21129"},{"id":"INC-11677","date":"2023-01","year":2023,"title":"Dromara Hutool Deserialization of Untrusted Data vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-24162"],"affected":"maven/cn.hutool:hutool-all","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24162"},{"id":"INC-11678","date":"2023-01","year":2023,"title":"Improper neutralization of `noscript` element content may allow XSS in Sanitize","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-23627"],"affected":"rubygems/sanitize","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23627"},{"id":"INC-11679","date":"2023-01","year":2023,"title":"Fix for arbitrary file deletion in customer media allows for remote code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-21395","CVE-2021-41143"],"affected":"composer/openmage/magento-lts, composer/openmage/magento-lts","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41143"},{"id":"INC-11680","date":"2023-01","year":2023,"title":"Withdrawn Advisory: HTML injections in BTCPayServer","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-0493"],"affected":"nuget/BTCPayServer.Client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0493"},{"id":"INC-11681","date":"2023-01","year":2023,"title":"XML external entity vulnerability on agents in Jenkins MSTest Plugin","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2023-24429","CVE-2023-24430","CVE-2023-24441","CVE-2023-24443","CVE-2023-24450"],"affected":"maven/org.jvnet.hudson.plugins:mstest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-24441"},{"id":"INC-11682","date":"2023-01","year":2023,"title":"Issue with whitespace in JWT roles in OpenSearch","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-23612"],"affected":"maven/org.opensearch.plugin:opensearch-security, maven/org.opensearch.plugin:opensearch-security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-23612"},{"id":"INC-11683","date":"2023-01","year":2023,"title":"ReDoS Vulnerability in ua-parser-js version","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25927"],"affected":"npm/ua-parser-js, npm/ua-parser-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25927"},{"id":"INC-11684","date":"2023-01","year":2023,"title":"CakePHP vulnerable to Denial of Service attack through XML payloads","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/cakephp/cakephp, composer/cakephp/cakephp, composer/cakephp/cakephp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q79m-c546-2g63"},{"id":"INC-11685","date":"2023-01","year":2023,"title":"Deno is vulnerable to race condition via interactive permission prompt spoofing","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-22499"],"affected":"rust/deno","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22499"},{"id":"INC-11686","date":"2023-01","year":2023,"title":"Velociraptor vulnerable to Missing Authorization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-0242"],"affected":"go/www.velocidex.com/golang/velociraptor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0242"},{"id":"INC-11687","date":"2023-01","year":2023,"title":"OpenStack Swift XML external entities (XXE) Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-47950"],"affected":"pip/swift, pip/swift, pip/swift","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-47950"},{"id":"INC-11688","date":"2023-01","year":2023,"title":"Sisimai Inefficient Regular Expression Complexity vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-4891"],"affected":"rubygems/sisimai","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-4891"},{"id":"INC-11689","date":"2023-01","year":2023,"title":"Apache Superset vulnerable to Injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-43720"],"affected":"pip/apache-superset, pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-43720"},{"id":"INC-11690","date":"2023-01","year":2023,"title":"XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/phpxmlrpc/phpxmlrpc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7vcx-v65q-9wpg"},{"id":"INC-11691","date":"2023-01","year":2023,"title":"gatsby-transformer-remark has possible unsanitized JavaScript code injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-22491"],"affected":"npm/gatsby-transformer-remark, npm/gatsby-transformer-remark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22491"},{"id":"INC-11692","date":"2023-01","year":2023,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-21538"],"affected":"nuget/Microsoft.NetCore.App.Runtime.win-x86, nuget/Microsoft.NetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-21538"},{"id":"INC-11693","date":"2023-01","year":2023,"title":"Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-22487","CVE-2023-22488","CVE-2023-22489"],"affected":"composer/flarum/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22489"},{"id":"INC-11694","date":"2023-01","year":2023,"title":"phoenix_html allows Cross-site Scripting in HEEx class attributes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-46871"],"affected":"erlang/phoenix_html, npm/phoenix_html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-46871"},{"id":"INC-11695","date":"2023-01","year":2023,"title":"Http4s improperly parses User-Agent and Server headers","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-22465"],"affected":"maven/org.http4s:http4s-core, maven/org.http4s:http4s-core_2.12, maven/org.http4s:http4s-core_2.12","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22465"},{"id":"INC-11696","date":"2023-01","year":2023,"title":"@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-22461"],"affected":"npm/@mattkrick/sanitize-svg","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-22461"},{"id":"INC-11697","date":"2023-01","year":2023,"title":"Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-0055"],"affected":"pip/pyload-ng","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-0055"},{"id":"INC-11698","date":"2023-01","year":2023,"title":"Gravitee API Management contains Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-25075","CVE-2022-38723"],"affected":"maven/io.gravitee.apim:gravitee-api-management","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-38723"},{"id":"INC-11699","date":"2023-01","year":2023,"title":"httparty has multipart/form-data request tampering vulnerability","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-22049"],"affected":"rubygems/httparty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-22049"},{"id":"INC-05064","date":"2022-12","year":2022,"title":"Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution ...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-3942"],"affected":"hp/color_laserjet_cm4540_mfp_cc419a_firmware, hp/color_laserjet_cm4540_mfp_cc419a,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-3942"},{"id":"INC-11702","date":"2022-12","year":2022,"title":"gotify/server vulnerable to Cross-site Scripting in the application image file upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-46181"],"affected":"go/github.com/gotify/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46181"},{"id":"INC-11703","date":"2022-12","year":2022,"title":"XStream can cause Denial of Service via stack overflow","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-41966"],"affected":"maven/com.thoughtworks.xstream:xstream","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41966"},{"id":"INC-11704","date":"2022-12","year":2022,"title":"go-saml's XML Digital Signatures use SHA-1","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-36563"],"affected":"go/github.com/RobotsAndPencils/go-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-36563"},{"id":"INC-11705","date":"2022-12","year":2022,"title":"YAML Go package vulnerable to denial of service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-4235","CVE-2022-3064"],"affected":"go/github.com/go-yaml/yaml, go/gopkg.in/yaml.v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-4235"},{"id":"INC-11706","date":"2022-12","year":2022,"title":"usememos/memos vulnerable to improper authorization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-4688"],"affected":"go/github.com/usememos/memos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-4688"},{"id":"INC-11707","date":"2022-12","year":2022,"title":"pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-40897"],"affected":"pip/setuptools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40897"},{"id":"INC-14624","date":"2022-12","year":2022,"title":"Apache Karaf vulnerable to potential code injection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-40145"],"affected":"maven/org.apache.karaf:apache-karaf, maven/org.apache.karaf:apache-karaf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40145"},{"id":"INC-11709","date":"2022-12","year":2022,"title":"safe-eval vulnerable to Prototype Pollution","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25904"],"affected":"npm/safe-eval","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25904"},{"id":"INC-11710","date":"2022-12","year":2022,"title":"Patchelf out-of-bounds read","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-44940"],"affected":"pip/patchelf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-44940"},{"id":"INC-11711","date":"2022-12","year":2022,"title":"Apache Helix UI vulnerable to Open Redirect","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-47500"],"affected":"maven/org.apache.helix:helix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-47500"},{"id":"INC-11712","date":"2022-12","year":2022,"title":"FeehiCMS Cross Site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-40373"],"affected":"composer/feehi/feehicms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40373"},{"id":"INC-11713","date":"2022-12","year":2022,"title":"FeehiCMS vulnerable to Cross Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-20589","CVE-2020-36607"],"affected":"composer/feehi/feehicms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-20589"},{"id":"INC-11714","date":"2022-12","year":2022,"title":".NET Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-41089"],"affected":"nuget/Microsoft.WindowsDesktop.App.Runtime.win-x64, nuget/Microsoft.WindowsDesktop.App.Runtime.win-x86,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41089"},{"id":"INC-11715","date":"2022-12","year":2022,"title":"TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension \"Master-Quiz\" (fp_masterquiz)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-47407"],"affected":"composer/fixpunkt/fp-masterquiz, composer/fixpunkt/fp-masterquiz","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-47407"},{"id":"INC-11716","date":"2022-12","year":2022,"title":"csaf-poc/csaf_distribution Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-43996"],"affected":"go/github.com/csaf-poc/csaf_distribution","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-43996"},{"id":"INC-11717","date":"2022-12","year":2022,"title":"TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23504"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23504"},{"id":"INC-11718","date":"2022-12","year":2022,"title":"TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23499"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23499"},{"id":"INC-11719","date":"2022-12","year":2022,"title":"json stack overflow vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-45688"],"affected":"maven/cn.hutool:hutool-json, maven/org.json:json","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-45688"},{"id":"INC-11720","date":"2022-12","year":2022,"title":"hutool-json stack overflow vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-45690"],"affected":"maven/cn.hutool:hutool-json","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-45690"},{"id":"INC-11721","date":"2022-12","year":2022,"title":"Amazon CloudWatch Agent for Windows has Privilege Escalation Vector","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23511"],"affected":"go/github.com/aws/amazon-cloudwatch-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23511"},{"id":"INC-11722","date":"2022-12","year":2022,"title":"Stored XSS vulnerability in Jenkins Checkmarx Plugin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-46682","CVE-2022-46684"],"affected":"maven/com.checkmarx.jenkins:checkmarx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46684"},{"id":"INC-11723","date":"2022-12","year":2022,"title":"Cross-site scripting vulnerability in TinyMCE alerts","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23494"],"affected":"nuget/TinyMCE, composer/tinymce/tinymce, npm/tinymce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23494"},{"id":"INC-11724","date":"2022-12","year":2022,"title":"Traefik may display authorization header in the debug logs","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-23469"],"affected":"go/github.com/traefik/traefik/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23469"},{"id":"INC-11725","date":"2022-12","year":2022,"title":"libp2p DoS vulnerability from lack of resource management","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23492"],"affected":"go/github.com/libp2p/go-libp2p","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23492"},{"id":"INC-11726","date":"2022-12","year":2022,"title":"Certifi removing TrustCor root certificate","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23491"],"affected":"pip/certifi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23491"},{"id":"INC-11727","date":"2022-12","year":2022,"title":"DSInternals Credential Roaming Elevation of Privilege Vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"nuget/DSInternals.Common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vx2x-9cff-fhjw"},{"id":"INC-11729","date":"2022-12","year":2022,"title":"Prometheus vulnerable to basic authentication bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/prometheus/prometheus/v2, go/github.com/prometheus/prometheus/v2, go/github.com/prometheus/prometheus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-4v48-4q5m-8vx4"},{"id":"INC-11730","date":"2022-12","year":2022,"title":"Craft CMS discloses password hashes","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-37783"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-37783"},{"id":"INC-11731","date":"2022-12","year":2022,"title":"Prometheus Exporter-Toolkit is vulnerable to authentication bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-46146"],"affected":"go/github.com/prometheus/exporter-toolkit, go/github.com/prometheus/exporter-toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-46146"},{"id":"INC-05136","date":"2022-11","year":2022,"title":"In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-45907"],"affected":"linuxfoundation/pytorch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-45907"},{"id":"INC-05094","date":"2022-11","year":2022,"title":"Deeplearning4J — Vulnerability (CVE-2022-36022)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36022"],"affected":"eclipse/deeplearning4j","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36022"},{"id":"INC-11732","date":"2022-11","year":2022,"title":"Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Toolkit may allow an authenticated user to potentially enable denial of service via network access.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-26251"],"affected":"intel/openvino","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-26251"},{"id":"INC-11733","date":"2022-11","year":2022,"title":"crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-41912"],"affected":"go/github.com/crewjam/saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41912"},{"id":"INC-11734","date":"2022-11","year":2022,"title":"Browsershot vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-43983","CVE-2022-43984"],"affected":"composer/spatie/browsershot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-43983"},{"id":"INC-11735","date":"2022-11","year":2022,"title":"PyroCMS vulnerable to stored Cross Site Scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-37721"],"affected":"composer/pyrocms/pyrocms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-37721"},{"id":"INC-11736","date":"2022-11","year":2022,"title":"Heap buffer overflow in GPU","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-4135"],"affected":"npm/electron","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-4135"},{"id":"INC-11737","date":"2022-11","year":2022,"title":"Silverstripe XSS in shortcodes","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-25817","CVE-2021-41559","CVE-2022-25238","CVE-2022-38724"],"affected":"composer/silverstripe/framework, composer/silverstripe/assets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-38724"},{"id":"INC-11738","date":"2022-11","year":2022,"title":"Cross site scripting vulnerability with discussion titles","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-41938"],"affected":"composer/flarum/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41938"},{"id":"INC-11739","date":"2022-11","year":2022,"title":"Missing Authorization in Filter Stream Converter Application of XWiki-platform","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-41937"],"affected":"maven/org.xwiki.platform:xwiki-platform-filter-ui, maven/org.xwiki.platform:xwiki-platform-filter-ui,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41937"},{"id":"INC-11740","date":"2022-11","year":2022,"title":"Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-41928"],"affected":"maven/org.xwiki.platform:xwiki-platform-attachment-ui, maven/org.xwiki.platform:xwiki-platform-attachment-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41928"},{"id":"INC-11741","date":"2022-11","year":2022,"title":"Cross-site Scripting in kiwitcms","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-4105"],"affected":"pip/kiwitcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-4105"},{"id":"INC-11742","date":"2022-11","year":2022,"title":"Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-45384","CVE-2022-45386","CVE-2022-45395","CVE-2022-45396","CVE-2022-45397","CVE-2022-45400"],"affected":"maven/org.jenkins-ci.main:reverse-proxy-auth-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-45384"},{"id":"INC-11743","date":"2022-11","year":2022,"title":"Concrete CMS vulnerable to XML External Entity","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-43689"],"affected":"composer/concrete5/concrete5, composer/concrete5/concrete5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-43689"},{"id":"INC-11745","date":"2022-11","year":2022,"title":"Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-42111"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-42111"},{"id":"INC-11746","date":"2022-11","year":2022,"title":"Wasmtime out of bounds read/write with zero-memory-pages configuration","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39392"],"affected":"rust/wasmtime, rust/wasmtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39392"},{"id":"INC-11747","date":"2022-11","year":2022,"title":"Read the Docs vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/readthedocs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-98pf-gfh3-x3mp"},{"id":"INC-11748","date":"2022-11","year":2022,"title":"Vela Insecure Defaults","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-39395"],"affected":"go/github.com/go-vela/worker, go/github.com/go-vela/server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39395"},{"id":"INC-11749","date":"2022-11","year":2022,"title":"Subrion CMS is vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-43120","CVE-2022-43121"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-43121"},{"id":"INC-11751","date":"2022-11","year":2022,"title":"Tauri Filesystem Scope can be Partially Bypassed","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-41874"],"affected":"rust/Tauri, rust/Tauri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41874"},{"id":"INC-11752","date":"2022-11","year":2022,"title":"Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-33684"],"affected":"pip/pulsar-client, pip/pulsar-client, pip/pulsar-client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33684"},{"id":"INC-11753","date":"2022-11","year":2022,"title":"Reflected Cross site scripting (XSS) in kairosdb","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-19040"],"affected":"maven/org.kairosdb:kairosdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19040"},{"id":"INC-11754","date":"2022-11","year":2022,"title":"Apache Spark vulnerable to Log Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31777"],"affected":"maven/org.apache.spark:spark-core_2.10, maven/org.apache.spark:spark-core_2.11, maven/org.apache.spark:spark-core_2.12","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31777"},{"id":"INC-11755","date":"2022-11","year":2022,"title":"xmldom allows multiple root nodes in a DOM","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39353"],"affected":"npm/@xmldom/xmldom, npm/@xmldom/xmldom, npm/@xmldom/xmldom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39353"},{"id":"INC-11756","date":"2022-11","year":2022,"title":"spring-security-oauth2-client vulnerable to Privilege Escalation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31690"],"affected":"maven/org.springframework.security:spring-security-oauth2-client, maven/org.springframework.security:spring-security-oa…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31690"},{"id":"INC-05336","date":"2022-10","year":2022,"title":"The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin pe...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-3149","CVE-2022-3151"],"affected":"wp_custom_cursors_project/wp_custom_cursors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3149"},{"id":"INC-05009","date":"2022-10","year":2022,"title":"@dependencytrack/frontend — Xss (CVE-2022-39350)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-39350"],"affected":"owasp/dependency-track_frontend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39350"},{"id":"INC-11760","date":"2022-10","year":2022,"title":"ProcessWire vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-40487"],"affected":"composer/processwire/processwire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40487"},{"id":"INC-11761","date":"2022-10","year":2022,"title":"OpenStack Sushy-Tools and VirtualBMC Improper Preservation of Permissions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-44020"],"affected":"pip/virtualbmc, pip/sushy-tools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-44020"},{"id":"INC-11762","date":"2022-10","year":2022,"title":"Keylime: unhandled exceptions could lead to invalid attestation states","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-3500"],"affected":"pip/Keylime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3500"},{"id":"INC-11763","date":"2022-10","year":2022,"title":"Twisted vulnerable to NameVirtualHost Host header injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39348"],"affected":"pip/twisted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348"},{"id":"INC-11764","date":"2022-10","year":2022,"title":"Docker Command Escaping in the GitHub Actions Runner","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39321"],"affected":"actions/actions/runner, actions/actions/runner, actions/actions/runner","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39321"},{"id":"INC-11765","date":"2022-10","year":2022,"title":"Untrusted code execution in Apache XML Graphics Batik","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-42890"],"affected":"maven/org.apache.xmlgraphics:batik-bridge, maven/org.apache.xmlgraphics:batik","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-42890"},{"id":"INC-11767","date":"2022-10","year":2022,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24464"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24464"},{"id":"INC-11768","date":"2022-10","year":2022,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21986"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.win-x86, nuget/Microsoft.AspNetCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21986"},{"id":"INC-11769","date":"2022-10","year":2022,"title":"Magento Improper input validation vulnerability","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-34253","CVE-2022-34254","CVE-2022-34255","CVE-2022-34256","CVE-2022-34257","CVE-2022-34258","CVE-2022-34259","CVE-2022-35692","CVE-2022-42344"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-42344"},{"id":"INC-11770","date":"2022-10","year":2022,"title":"Jadx-gui vulnerable to swing HTML Denial of Service (DoS) attack","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39259"],"affected":"maven/io.github.skylot:jadx-plugins-api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39259"},{"id":"INC-11772","date":"2022-10","year":2022,"title":".NET Remote Code Execution Vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-24512"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24512"},{"id":"INC-11773","date":"2022-10","year":2022,"title":"Update bundled libxml2 to v2.10.3 to resolve multiple CVEs","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2qc6-mcvw-92cw"},{"id":"INC-11774","date":"2022-10","year":2022,"title":"Magento Open Source allows Improper Access Control","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-35689","CVE-2022-35698"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-35689"},{"id":"INC-11775","date":"2022-10","year":2022,"title":"Powerline Gitstatus vulnerable to arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-42906"],"affected":"pip/powerline-gitstatus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-42906"},{"id":"INC-11776","date":"2022-10","year":2022,"title":"Signature bypass via multiple root elements","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39299","CVE-2022-39300"],"affected":"npm/node-saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39300"},{"id":"INC-11777","date":"2022-10","year":2022,"title":"Nomad Panics On Job Submission With Bad Artifact Stanza Source URL","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24686","CVE-2022-30324","CVE-2022-40716","CVE-2022-41606"],"affected":"go/github.com/hashicorp/nomad, go/github.com/hashicorp/nomad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41606"},{"id":"INC-11778","date":"2022-10","year":2022,"title":"NuGet Elevation of Privilege Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-41032"],"affected":"nuget/NuGet.Protocol, nuget/NuGet.Protocol, nuget/NuGet.Protocol","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41032"},{"id":"INC-11779","date":"2022-10","year":2022,"title":"AdGuardHome vulnerable to Cross-Site Request Forgery","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-32175"],"affected":"go/github.com/AdguardTeam/AdGuardHome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-32175"},{"id":"INC-11780","date":"2022-10","year":2022,"title":"tiny-csrf has openly visible CSRF tokens","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39287"],"affected":"npm/tiny-csrf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39287"},{"id":"INC-11781","date":"2022-10","year":2022,"title":"Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-41414"],"affected":"maven/com.liferay.portal:com.liferay.portal.impl, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41414"},{"id":"INC-11782","date":"2022-10","year":2022,"title":"xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-25614"],"affected":"go/github.com/antchfx/xmlquery","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-25614"},{"id":"INC-11783","date":"2022-10","year":2022,"title":"goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-7711"],"affected":"go/github.com/russellhaering/gosaml2, go/github.com/russellhaering/goxmldsig","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-7711"},{"id":"INC-11784","date":"2022-10","year":2022,"title":"OrchardCore vulnerable to HTML injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-32173"],"affected":"nuget/OrchardCore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-32173"},{"id":"INC-11785","date":"2022-10","year":2022,"title":"Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-39222"],"affected":"go/github.com/dexidp/dex","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39222"},{"id":"INC-05291","date":"2022-09","year":2022,"title":"TensorFlow — Vulnerability (CVE-2022-35938)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-35938"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-35938"},{"id":"INC-11787","date":"2022-09","year":2022,"title":"Centreon contains cross-site scripting vulnerability via esc_name parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-40044"],"affected":"composer/centreon/centreon, composer/centreon/centreon, composer/centreon/centreon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40044"},{"id":"INC-11788","date":"2022-09","year":2022,"title":"Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-40705"],"affected":"maven/soap:soap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40705"},{"id":"INC-11789","date":"2022-09","year":2022,"title":"Apache Batik vulnerable to Server-Side Request Forgery","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-38398","CVE-2022-38648","CVE-2022-40146"],"affected":"maven/org.apache.xmlgraphics:batik","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-40146"},{"id":"INC-11790","date":"2022-09","year":2022,"title":"Pimcore vulnerable to cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-3255"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3255"},{"id":"INC-11791","date":"2022-09","year":2022,"title":"Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-41226","CVE-2022-41235","CVE-2022-41237","CVE-2022-41241"],"affected":"maven/com.compuware.jenkins:compuware-common-configuration","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-41226"},{"id":"INC-11792","date":"2022-09","year":2022,"title":"autogluon.multimodal vulnerable to unsafe YAML deserialization","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/autogluon.multimodal, pip/autogluon.multimodal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-6h2x-4gjf-jc5w"},{"id":"INC-11793","date":"2022-09","year":2022,"title":"Microweber Cross-site Scripting can result in redirection to a malicious site","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-3242"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3242"},{"id":"INC-11794","date":"2022-09","year":2022,"title":"Microweber vulnerable to HTML Injection in create tag functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-3245"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3245"},{"id":"INC-11795","date":"2022-09","year":2022,"title":"Snipe-IT vulnerable to Improper Authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-3173"],"affected":"composer/snipe/snipe-it","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-3173"},{"id":"INC-11796","date":"2022-09","year":2022,"title":"XWiki Cross-Site Request Forgery (CSRF) for actions on tags","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36095"],"affected":"maven/org.xwiki.platform:xwiki-platform-web-templates, maven/org.xwiki.platform:xwiki-platform-web-templates","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36095"},{"id":"INC-11797","date":"2022-09","year":2022,"title":"Harbor fails to validate the user permissions when updating tag immutability policies","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31669"],"affected":"go/github.com/goharbor/harbor, go/github.com/goharbor/harbor, go/github.com/goharbor/harbor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31669"},{"id":"INC-11798","date":"2022-09","year":2022,"title":"Harbor fails to validate the user permissions when updating tag retention policies","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31670"],"affected":"go/github.com/goharbor/harbor, go/github.com/goharbor/harbor, go/github.com/goharbor/harbor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31670"},{"id":"INC-11799","date":"2022-09","year":2022,"title":"TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36020"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36020"},{"id":"INC-11800","date":"2022-09","year":2022,"title":"OPA Compiler: Bypass of WithUnsafeBuiltins using \"with\" keyword to mock functions","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2022-36085"],"affected":"go/github.com/open-policy-agent/opa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36085"},{"id":"INC-11801","date":"2022-09","year":2022,"title":"XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36096"],"affected":"maven/org.xwiki.platform:xwiki-platform-index-ui, maven/org.xwiki.platform:xwiki-platform-index-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36096"},{"id":"INC-11802","date":"2022-09","year":2022,"title":"XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36099"],"affected":"maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki, maven/org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36099"},{"id":"INC-11803","date":"2022-09","year":2022,"title":"Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-39135"],"affected":"maven/org.apache.calcite:calcite-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-39135"},{"id":"INC-11804","date":"2022-09","year":2022,"title":"Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-38639"],"affected":"npm/markdown-nice","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-38639"},{"id":"INC-11805","date":"2022-09","year":2022,"title":"MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-37189"],"affected":"pip/mei2volpiano","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-37189"},{"id":"INC-11806","date":"2022-09","year":2022,"title":"Apache ShenYu Admin has insecure permissions","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-37435"],"affected":"maven/org.apache.shenyu:shenyu-common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-37435"},{"id":"INC-11807","date":"2022-09","year":2022,"title":"jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36033"],"affected":"maven/org.jsoup:jsoup","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36033"},{"id":"INC-11810","date":"2022-08","year":2022,"title":"Improper Control of Generation of Code ('Code Injection') in mdx-mermaid","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36036"],"affected":"npm/mdx-mermaid, npm/mdx-mermaid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36036"},{"id":"INC-11811","date":"2022-08","year":2022,"title":"Sanitize-html Vulnerable To REDoS Attacks","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25887"],"affected":"npm/sanitize-html","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25887"},{"id":"INC-11812","date":"2022-08","year":2022,"title":"Uncontrolled Resource Consumption in snakeyaml","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25857"],"affected":"maven/org.yaml:snakeyaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857"},{"id":"INC-11813","date":"2022-08","year":2022,"title":"Cross-site scripting from content entered in the tags and multiselect fields","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/getkirby/cms, composer/getkirby/cms, composer/getkirby/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rv3r-vqjj-8c76"},{"id":"INC-11814","date":"2022-08","year":2022,"title":"Command Injection in moment-timezone","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/moment-timezone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-56x4-j7p9-fcf9"},{"id":"INC-11815","date":"2022-08","year":2022,"title":".NET Denial of Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29145"],"affected":"nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm, nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29145"},{"id":"INC-11816","date":"2022-08","year":2022,"title":"Pagekit CMS cross-site scripting in Markdown text box where articles are edited","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36573"],"affected":"composer/pagekit/pagekit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36573"},{"id":"INC-11817","date":"2022-08","year":2022,"title":"Cross-site scripting from dynamic options in the multiselect field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36037"],"affected":"composer/getkirby/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36037"},{"id":"INC-11818","date":"2022-08","year":2022,"title":"Jfinal Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36527"],"affected":"maven/com.jflyfox:jflyfox_jfinal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36527"},{"id":"INC-11819","date":"2022-08","year":2022,"title":"Improper token validation leading to code execution in Teleport","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-36633"],"affected":"go/github.com/gravitational/teleport, go/github.com/gravitational/teleport, go/github.com/gravitational/teleport","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36633"},{"id":"INC-11820","date":"2022-08","year":2022,"title":"HTML Injection in ActiveMQ Artemis Web Console","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-35278"],"affected":"maven/org.apache.activemq:artemis-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-35278"},{"id":"INC-14625","date":"2022-08","year":2022,"title":"Cross site scripting in getkirby/starterkit","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-35174"],"affected":"composer/getkirby/starterkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-35174"},{"id":"INC-11821","date":"2022-08","year":2022,"title":"@actions/core has Delimiter Injection Vulnerability in exportVariable","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-35954"],"affected":"npm/@actions/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-35954"},{"id":"INC-11822","date":"2022-08","year":2022,"title":"apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/apollo-server-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-2fvv-qxrq-7jq6"},{"id":"INC-11823","date":"2022-08","year":2022,"title":"mofh Vulnerable to Improper Restriction of XML External Entity Reference","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/mofh","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-7r9x-qrpr-3cxw"},{"id":"INC-11824","date":"2022-08","year":2022,"title":"nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-32862"],"affected":"pip/nbconvert","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32862"},{"id":"INC-11825","date":"2022-08","year":2022,"title":"CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31175"],"affected":"npm/@ckeditor/ckeditor5-html-embed, npm/@ckeditor/ckeditor5-html-support, npm/@ckeditor/ckeditor5-markdown-gfm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31175"},{"id":"INC-11826","date":"2022-08","year":2022,"title":"PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31197"],"affected":"maven/org.postgresql:postgresql, maven/org.postgresql:postgresql, maven/org.postgresql:postgresql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31197"},{"id":"INC-11827","date":"2022-08","year":2022,"title":"JSPUI vulnerable to path traversal in submission (resumable) upload","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31194"],"affected":"maven/org.dspace:dspace-jspui, maven/org.dspace:dspace-jspui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31194"},{"id":"INC-11828","date":"2022-08","year":2022,"title":"JSPUI spellcheck and autocomplete tools vulnerable to Cross Site Scripting","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31191"],"affected":"maven/org.dspace:dspace-jspui, maven/org.dspace:dspace-jspui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31191"},{"id":"INC-11829","date":"2022-08","year":2022,"title":"JSPUI's \"Internal System Error\" page prints exceptions and stack traces without sanitization","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31189"],"affected":"maven/org.dspace:dspace-jspui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31189"},{"id":"INC-11830","date":"2022-08","year":2022,"title":"untangle vulnerable to XML Entity Expansion","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31471","CVE-2022-33977"],"affected":"pip/untangle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33977"},{"id":"INC-11831","date":"2022-08","year":2022,"title":"Apache JSPWiki CSRF due to crafted invocation on the Image plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-34158"],"affected":"maven/org.apache.jspwiki:jspwiki-main","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34158"},{"id":"INC-14626","date":"2022-08","year":2022,"title":"Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-28731"],"affected":"maven/org.apache.jspwiki:jspwiki-main","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28731"},{"id":"INC-05137","date":"2022-07","year":2022,"title":"Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-1138"],"affected":"google/chrome","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1138"},{"id":"INC-11838","date":"2022-07","year":2022,"title":"check-spelling workflow vulnerable to token leakage via symlink attack","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2021-32724"],"affected":"actions/check-spelling/check-spelling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32724"},{"id":"INC-11839","date":"2022-07","year":2022,"title":"Feehi CMS Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-34140"],"affected":"composer/feehi/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34140"},{"id":"INC-11840","date":"2022-07","year":2022,"title":"WMAgent arbitrary code execution via a crafted dbs-client package","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-34558"],"affected":"pip/global-workqueue, pip/reqmon, pip/reqmgr2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34558"},{"id":"INC-11841","date":"2022-07","year":2022,"title":"Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36887","CVE-2022-36899","CVE-2022-36900"],"affected":"maven/org.jenkins-ci.plugins:jobConfigHistory","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36887"},{"id":"INC-11842","date":"2022-07","year":2022,"title":"Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31109"],"affected":"composer/laminas/laminas-diactoros","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31109"},{"id":"INC-11843","date":"2022-07","year":2022,"title":"Fava vulnerable to Reflected Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-2523"],"affected":"pip/fava","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2523"},{"id":"INC-11844","date":"2022-07","year":2022,"title":"Apache Spark UI can allow impersonation if ACLs enabled","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-33891"],"affected":"pip/pyspark, pip/pyspark, maven/org.apache.spark:spark-parent_2.12","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33891"},{"id":"INC-11845","date":"2022-07","year":2022,"title":"Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-36127"],"affected":"npm/skywalking-backend-js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-36127"},{"id":"INC-11846","date":"2022-07","year":2022,"title":"jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31160"],"affected":"rubygems/jquery-ui-rails, nuget/jQuery.UI.Combined, maven/org.webjars.npm:jquery-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31160"},{"id":"INC-11847","date":"2022-07","year":2022,"title":"WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-2099"],"affected":"composer/woocommerce/woocommerce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2099"},{"id":"INC-11848","date":"2022-07","year":2022,"title":"grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-7641"],"affected":"npm/grunt-util-property","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-7641"},{"id":"INC-11849","date":"2022-07","year":2022,"title":"Bypass of CMS Safe Mode Security Feature","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/wintercms/winter, composer/wintercms/winter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q37h-jhf3-85cj"},{"id":"INC-11850","date":"2022-07","year":2022,"title":"Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2015-8031"],"affected":"maven/org.jvnet.hudson.main:hudson-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8031"},{"id":"INC-11851","date":"2022-07","year":2022,"title":"Whoogle Search Cross-site Scripting via string parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-25303"],"affected":"pip/whoogle-search","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25303"},{"id":"INC-11852","date":"2022-07","year":2022,"title":"RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-32065"],"affected":"maven/com.ruoyi:ruoyi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-32065"},{"id":"INC-11853","date":"2022-07","year":2022,"title":"aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-2385"],"affected":"go/sigs.k8s.io/aws-iam-authenticator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2385"},{"id":"INC-11854","date":"2022-07","year":2022,"title":"Argo CD improper access control bug can allow malicious user to escalate privileges to admin level","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-1025","CVE-2022-24768"],"affected":"go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1025"},{"id":"INC-11855","date":"2022-07","year":2022,"title":"Active Record RCE bug with Serialized Columns","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-32224"],"affected":"rubygems/activerecord, rubygems/activerecord, rubygems/activerecord","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-32224"},{"id":"INC-11856","date":"2022-07","year":2022,"title":"KubeEdge Cloud Stream and Edge Stream DoS from large stream message","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31079"],"affected":"go/github.com/kubeedge/kubeedge, go/github.com/kubeedge/kubeedge, go/github.com/kubeedge/kubeedge","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31079"},{"id":"INC-11857","date":"2022-07","year":2022,"title":"Known v1.3.1 Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31290"],"affected":"composer/idno/known","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31290"},{"id":"INC-11858","date":"2022-07","year":2022,"title":"Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-44791"],"affected":"maven/org.apache.druid:druid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-44791"},{"id":"INC-11859","date":"2022-07","year":2022,"title":"XML External Entity Reference in Eclipse Lyo","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41042"],"affected":"maven/org.eclipse.lyo:lyo-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41042"},{"id":"INC-11860","date":"2022-07","year":2022,"title":"Jetty SslConnection does not release pooled ByteBuffers in case of errors","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-2191"],"affected":"maven/org.eclipse.jetty:jetty-server, maven/org.eclipse.jetty:jetty-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2191"},{"id":"INC-11861","date":"2022-07","year":2022,"title":"Improper handling of email input","severity":"High","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31127"],"affected":"npm/next-auth, npm/next-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31127"},{"id":"INC-11862","date":"2022-07","year":2022,"title":"Possible leak of key's raw field if declared length is incorrect","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31124"],"affected":"pip/openssh-key-parser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31124"},{"id":"INC-11863","date":"2022-07","year":2022,"title":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-2309"],"affected":"pip/lxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309"},{"id":"INC-11864","date":"2022-07","year":2022,"title":"Use of Hard-coded Credentials in Nacos","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2021-43116"],"affected":"maven/com.alibaba.nacos:nacos-client","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43116"},{"id":"INC-11865","date":"2022-07","year":2022,"title":"opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31115"],"affected":"rubygems/opensearch-ruby","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31115"},{"id":"INC-11866","date":"2022-07","year":2022,"title":"Possible inject arbitrary `CSS` into the generated graph affecting the container HTML","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2022-31108"],"affected":"npm/mermaid","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31108"},{"id":"INC-11867","date":"2022-07","year":2022,"title":"Missing Authorization in Jenkins XPath Configuration Viewer Plugin","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-34786","CVE-2022-34788","CVE-2022-34793","CVE-2022-34794","CVE-2022-34803","CVE-2022-34811"],"affected":"maven/org.jenkins-ci.plugins:xpath-config-viewer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34811"},{"id":"INC-11868","date":"2022-07","year":2022,"title":"Denial of service in Open Policy Agent","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-33082"],"affected":"go/github.com/open-policy-agent/opa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33082"},{"id":"INC-05146","date":"2022-06","year":2022,"title":"Jupyter Server provides the backend (i.e.","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-29241"],"affected":"jupyter/jupyter_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29241"},{"id":"INC-05183","date":"2022-06","year":2022,"title":"resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-29540"],"affected":"resi/gemini-net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29540"},{"id":"INC-05046","date":"2022-06","year":2022,"title":"An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensit...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2020-25459"],"affected":"webank/federated_ai_technology_enabler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-25459"},{"id":"INC-11873","date":"2022-06","year":2022,"title":"Stored XSS in link tags added via XHR in SilverStripe Framework","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-28803"],"affected":"composer/silverstripe/framework","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28803"},{"id":"INC-11874","date":"2022-06","year":2022,"title":"SystemDS CPU exhaustion vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-26477"],"affected":"pip/systemds, maven/org.apache.systemds:systemds","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26477"},{"id":"INC-11875","date":"2022-06","year":2022,"title":"Cross-site Scripting in Jenkins Agent Server Parameter Plugin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-34171","CVE-2022-34173","CVE-2022-34181","CVE-2022-34183"],"affected":"maven/io.jenkins.plugins:agent-server-parameter","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-34183"},{"id":"INC-11876","date":"2022-06","year":2022,"title":"Cross-site Scripting in Jfinal CMS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-33113"],"affected":"maven/com.jfinal:jfinal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33113"},{"id":"INC-11877","date":"2022-06","year":2022,"title":"Unsafe yaml deserialization in NVFlare","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31605"],"affected":"pip/nvflare","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31605"},{"id":"INC-11878","date":"2022-06","year":2022,"title":"Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-31036"],"affected":"go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31036"},{"id":"INC-11879","date":"2022-06","year":2022,"title":"Argo CD's external URLs for Deployments can include JavaScript","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31035"],"affected":"go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31035"},{"id":"INC-11880","date":"2022-06","year":2022,"title":"brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-33156"],"affected":"composer/brotkrueml/typo3-matomo-integration","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33156"},{"id":"INC-11881","date":"2022-06","year":2022,"title":"brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-33154"],"affected":"composer/brotkrueml/schema, composer/brotkrueml/schema","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-33154"},{"id":"INC-11882","date":"2022-06","year":2022,"title":"Cross-Site Scripting in TYPO3's Frontend Login Mailer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31049"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31049"},{"id":"INC-11883","date":"2022-06","year":2022,"title":"Unrestricted Attachment Upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-2111"],"affected":"pip/inventree","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2111"},{"id":"INC-11884","date":"2022-06","year":2022,"title":"Insufficient HTML Sanitization","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/inventree","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rm89-9g65-4ffr"},{"id":"INC-11885","date":"2022-06","year":2022,"title":"Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-31066"],"affected":"go/github.com/edgexfoundry/app-functions-sdk-go/v2, go/github.com/edgexfoundry/device-sdk-go/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31066"},{"id":"INC-11886","date":"2022-06","year":2022,"title":"ProxyAgent vulnerable to MITM","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-32210"],"affected":"npm/undici","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-32210"},{"id":"INC-11887","date":"2022-06","year":2022,"title":"Out-of-bounds write in nix::unistd::getgrouplist","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-45707"],"affected":"rust/nix, rust/nix, rust/nix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-wgrg-5h56-jg27"},{"id":"INC-11888","date":"2022-06","year":2022,"title":"XML External Entity Reference in drools","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41411"],"affected":"maven/org.drools:drools-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41411"},{"id":"INC-11889","date":"2022-06","year":2022,"title":"QueryInterface should call AddRef before returning pointer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/derive-com-impl","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-9rg7-3j4f-cf4x"},{"id":"INC-11890","date":"2022-06","year":2022,"title":"Space bug in `clean_text`","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"rust/ammonia","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-p2g9-94wh-65c2"},{"id":"INC-11891","date":"2022-06","year":2022,"title":"Octokit gem published with world-writable files","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31072"],"affected":"rubygems/octokit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31072"},{"id":"INC-11892","date":"2022-06","year":2022,"title":"Octopoller gem published with world-writable files","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-31071"],"affected":"rubygems/octopoller","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31071"},{"id":"INC-11893","date":"2022-06","year":2022,"title":"Incorrect Authorization in thinkcmf","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-40616"],"affected":"composer/thinkcmf/thinkcmf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-40616"},{"id":"INC-11894","date":"2022-06","year":2022,"title":"Cross site scripting in intelliants/subrion","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-41502"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41502"},{"id":"INC-11895","date":"2022-06","year":2022,"title":"Cross site scripting in francoisjacquet/rosariosis","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-2036"],"affected":"composer/francoisjacquet/rosariosis","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-2036"},{"id":"INC-11896","date":"2022-06","year":2022,"title":"Exposure of Sensitive Information to an Unauthorized Actor in semantic-release","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-31051"],"affected":"npm/semantic-release","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31051"},{"id":"INC-11897","date":"2022-06","year":2022,"title":"Cross site scripting in Jfinal","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-29648"],"affected":"maven/com.jflyfox:jflyfox_jfinal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29648"},{"id":"INC-11898","date":"2022-06","year":2022,"title":"Command injection in docker-tester","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-34079"],"affected":"npm/docker-tester","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-34079"},{"id":"INC-11899","date":"2022-06","year":2022,"title":"Neos CMS vulnerable to XSS in various backend modules","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-30429"],"affected":"composer/neos/neos, composer/neos/neos, composer/neos/neos","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-30429"},{"id":"INC-11940","date":"2022-06","year":2022,"title":"Malware in tensorflow-js-website","severity":"Critical","attack_vector":"malware","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/tensorflow-js-website","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5m7v-9x6m-j9q6"},{"id":"INC-05335","date":"2022-05","year":2022,"title":"The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks ...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1566"],"affected":"quotes_llama_project/quotes_llama","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1566"},{"id":"INC-11961","date":"2022-05","year":2022,"title":"Prototype Pollution in protobufjs","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25878"],"affected":"npm/protobufjs, npm/protobufjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25878"},{"id":"INC-11962","date":"2022-05","year":2022,"title":"Cross-site Scripting in ZKEACMS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-29362"],"affected":"nuget/ZKEACMS.Publisher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29362"},{"id":"INC-11963","date":"2022-05","year":2022,"title":"Path Traversal in FileGator","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1850"],"affected":"composer/filegator/filegator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1850"},{"id":"INC-11964","date":"2022-05","year":2022,"title":"Apache Superset Stored XSS on Dashboard markdown","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-27907"],"affected":"pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-27907"},{"id":"INC-11965","date":"2022-05","year":2022,"title":"Improper Certificate Validation in Apache Netbeans","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-17560","CVE-2019-17561"],"affected":"maven/org.codehaus.mevenide:netbeans","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-17560"},{"id":"INC-11966","date":"2022-05","year":2022,"title":"Cross site scripting in publify","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-25975"],"affected":"rubygems/publify_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-25975"},{"id":"INC-11967","date":"2022-05","year":2022,"title":"NuGet Package Manager Tampering Vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-0976"],"affected":"nuget/NuGet.Commands","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-0976"},{"id":"INC-11969","date":"2022-05","year":2022,"title":"PhantomJS Arbitrary File Read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-17221"],"affected":"npm/phantomjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-17221"},{"id":"INC-11970","date":"2022-05","year":2022,"title":"XML Injection in ReportLab","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-17626"],"affected":"pip/reportlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-17626"},{"id":"INC-11971","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Jenkins","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-7536","CVE-2017-1000392","CVE-2019-10401"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10401"},{"id":"INC-11972","date":"2022-05","year":2022,"title":"py-lmdb Invalid write operation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-16227"],"affected":"pip/lmdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16227"},{"id":"INC-11973","date":"2022-05","year":2022,"title":"Apache Solr vulnerable to XML Bomb","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-12401"],"affected":"maven/org.apache.solr:solr-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-12401"},{"id":"INC-11974","date":"2022-05","year":2022,"title":"Chakra Scripting Engine RCE via Out-of-bounds write","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-1024","CVE-2019-1051","CVE-2019-1052"],"affected":"nuget/Microsoft.ChakraCore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-1052"},{"id":"INC-11975","date":"2022-05","year":2022,"title":"ChakraCore RCE via Out-of-bounds write","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-1002"],"affected":"nuget/Microsoft.ChakraCore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-1002"},{"id":"INC-11976","date":"2022-05","year":2022,"title":"XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10327"],"affected":"maven/org.jenkins-ci.plugins:pipeline-maven","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10327"},{"id":"INC-11977","date":"2022-05","year":2022,"title":"Improper Privilege Management in Cilium","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-29178","CVE-2022-29179"],"affected":"go/github.com/cilium/cilium, go/github.com/cilium/cilium, go/github.com/cilium/cilium","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29179"},{"id":"INC-11978","date":"2022-05","year":2022,"title":"Cross-site Scripting in Auth0 Lock","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29172"],"affected":"npm/auth0-lock","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29172"},{"id":"INC-11979","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins pom2config Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-21701","CVE-2021-43576","CVE-2021-43577","CVE-2021-43578"],"affected":"maven/org.jenkins-ci.plugins:pom2config","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43576"},{"id":"INC-11981","date":"2022-05","year":2022,"title":"Uncontrolled Recursion in Akka HTTP","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-42697"],"affected":"maven/com.typesafe.akka:akka-http-core_2.11, maven/com.typesafe.akka:akka-http-core_2.12,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-42697"},{"id":"INC-11982","date":"2022-05","year":2022,"title":"Foxlor cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-28957"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-28957"},{"id":"INC-11983","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Stanford CoreNLP","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-3869","CVE-2021-3878"],"affected":"maven/edu.stanford.nlp:stanford-corenlp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-3869"},{"id":"INC-11984","date":"2022-05","year":2022,"title":"Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-32609"],"affected":"pip/apache-superset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32609"},{"id":"INC-11985","date":"2022-05","year":2022,"title":"Magento Open Source allows Cross-Site Request Forgery (CSRF)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-39864"],"affected":"composer/magento/project-community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-39864"},{"id":"INC-11986","date":"2022-05","year":2022,"title":"Path traversal vulnerability on Windows in Jenkins","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-21683"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21683"},{"id":"INC-11987","date":"2022-05","year":2022,"title":"Missing Authentication for Critical Function in Apache Airflow","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2021-38540"],"affected":"pip/apache-airflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-38540"},{"id":"INC-11989","date":"2022-05","year":2022,"title":"Jenkins SAML Plugin allows bypassing CSRF protection for any URL","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-21677","CVE-2021-21678","CVE-2021-21680"],"affected":"maven/org.jenkins-ci.plugins:saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21678"},{"id":"INC-11990","date":"2022-05","year":2022,"title":"Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33336"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33336"},{"id":"INC-11991","date":"2022-05","year":2022,"title":"Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33339"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33339"},{"id":"INC-11992","date":"2022-05","year":2022,"title":"Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33337"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33337"},{"id":"INC-11993","date":"2022-05","year":2022,"title":"Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-35463"],"affected":"maven/com.liferay:com.liferay.frontend.taglib.clay, maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-35463"},{"id":"INC-11994","date":"2022-05","year":2022,"title":"Nokogiri has vulnerable dependencies on libxml2 and libxslt","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-5815","CVE-2021-30560"],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-30560"},{"id":"INC-11995","date":"2022-05","year":2022,"title":"Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33326"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33326"},{"id":"INC-11996","date":"2022-05","year":2022,"title":"Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33328"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33328"},{"id":"INC-11997","date":"2022-05","year":2022,"title":"Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-33332"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33332"},{"id":"INC-11998","date":"2022-05","year":2022,"title":"LavaLite Stored Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-36397"],"affected":"composer/lavalite/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-36397"},{"id":"INC-11999","date":"2022-05","year":2022,"title":"Stored XSS in LavaLite 5.8.0","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-36395","CVE-2020-36396"],"affected":"composer/lavalite/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-36396"},{"id":"INC-12000","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins Generic Webhook Trigger Plugin","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-21669"],"affected":"maven/org.jenkins-ci.plugins:generic-webhook-trigger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21669"},{"id":"INC-12001","date":"2022-05","year":2022,"title":"Moodle Cross Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-32244"],"affected":"composer/moodle/moodle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32244"},{"id":"INC-12002","date":"2022-05","year":2022,"title":"Drupal Core Cross-site scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-13668","CVE-2020-13688"],"affected":"composer/drupal/core, composer/drupal/core, composer/drupal/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13688"},{"id":"INC-12003","date":"2022-05","year":2022,"title":"golang.org/x/net/html Infinite Loop vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-33194"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33194"},{"id":"INC-12004","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins URLTrigger Plugin","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-21657","CVE-2021-21658","CVE-2021-21659"],"affected":"maven/org.jenkins-ci.plugins:urltrigger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21659"},{"id":"INC-12005","date":"2022-05","year":2022,"title":"Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-24323"],"affected":"composer/woocommerce/woocommerce","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-24323"},{"id":"INC-12006","date":"2022-05","year":2022,"title":"XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-21642"],"affected":"maven/org.jenkins-ci.plugins:config-file-provider","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21642"},{"id":"INC-12007","date":"2022-05","year":2022,"title":"Lack of type validation in agent related REST API in Jenkins","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-21639"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21639"},{"id":"INC-12008","date":"2022-05","year":2022,"title":"CSRF vulnerability in Jenkins Libvirt Agents Plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-21627"],"affected":"maven/org.jenkins-ci.plugins:libvirt-slave","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21627"},{"id":"INC-12009","date":"2022-05","year":2022,"title":"ShopXO RCE Vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-27817"],"affected":"composer/shopxo/shopxo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-27817"},{"id":"INC-12010","date":"2022-05","year":2022,"title":"Changeset vulnerable to prototype pollution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-25915"],"affected":"npm/changeset","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-25915"},{"id":"INC-12011","date":"2022-05","year":2022,"title":"GramAddict bot uses dependency with reverse tcp backdoor","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-36245"],"affected":"pip/GramAddict","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-36245"},{"id":"INC-12012","date":"2022-05","year":2022,"title":"qlib Deserialization of Untrusted Data vulnerability","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-23338"],"affected":"pip/pyqlib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-23338"},{"id":"INC-12014","date":"2022-05","year":2022,"title":"Zen Cart vulnerable to authenticated remote code execution","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-3291"],"affected":"composer/zencart/zencart","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-3291"},{"id":"INC-12015","date":"2022-05","year":2022,"title":"Gravity Forms stored HTML injection vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-27851"],"affected":"composer/wp-premium/gravityforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-27851"},{"id":"INC-12016","date":"2022-05","year":2022,"title":"Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-27852"],"affected":"composer/wp-premium/gravityforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-27852"},{"id":"INC-12017","date":"2022-05","year":2022,"title":"Gravity Forms stored Cross-Site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-27850"],"affected":"composer/wp-premium/gravityforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-27850"},{"id":"INC-12018","date":"2022-05","year":2022,"title":"XSS vulnerability in Jenkins TICS Plugin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-21604","CVE-2021-21605","CVE-2021-21606","CVE-2021-21607","CVE-2021-21609","CVE-2021-21613"],"affected":"maven/io.jenkins.plugins:tics","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21613"},{"id":"INC-12019","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins CVS Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2324"],"affected":"maven/org.jenkins-ci.plugins:cvs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2324"},{"id":"INC-12020","date":"2022-05","year":2022,"title":"XML injection in Crafter CMS","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-15680","CVE-2017-15683","CVE-2017-15685"],"affected":"maven/org.craftercms:crafter-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15683"},{"id":"INC-12021","date":"2022-05","year":2022,"title":"Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2304","CVE-2020-2305","CVE-2020-2315","CVE-2020-2318"],"affected":"maven/org.jenkins-ci.plugins:mailcommander","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2318"},{"id":"INC-12022","date":"2022-05","year":2022,"title":"YOURLS Stored Cross Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-27388"],"affected":"composer/yourls/yourls","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-27388"},{"id":"INC-12023","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins Nerrvana Plugin","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2298"],"affected":"maven/org.jenkins-ci.plugins:nerrvana-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2298"},{"id":"INC-12024","date":"2022-05","year":2022,"title":"MediaWiki Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-25815"],"affected":"composer/mediawiki/core, composer/mediawiki/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-25815"},{"id":"INC-12025","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins Liquibase Runner Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2284"],"affected":"maven/org.jenkins-ci.plugins:liquibase-runner","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2284"},{"id":"INC-12026","date":"2022-05","year":2022,"title":"DotPlant2 Improper Restriction of XML External Entity Reference","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-25750"],"affected":"composer/devgroup/dotplant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-25750"},{"id":"INC-12027","date":"2022-05","year":2022,"title":"Arbitrary file write vulnerability in Jenkins Storable Configs Plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-2259","CVE-2020-2261","CVE-2020-2278"],"affected":"maven/org.jvnet.hudson.plugins:storable-configs-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2278"},{"id":"INC-12028","date":"2022-05","year":2022,"title":"xxl-job Multiple cross-site scripting (XSS) vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-23814"],"affected":"maven/com.xuxueli:xxl-job","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-23814"},{"id":"INC-12029","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins Klocwork Analysis Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2245","CVE-2020-2246","CVE-2020-2247"],"affected":"maven/org.jenkins-ci.plugins:klocwork","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2247"},{"id":"INC-12030","date":"2022-05","year":2022,"title":"Dolibarr stored Cross-Site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-19992","CVE-2018-19995","CVE-2020-13828"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13828"},{"id":"INC-12031","date":"2022-05","year":2022,"title":"Scalyr Agent 2 Missing SSL Certificate Validation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-24714","CVE-2020-24715"],"affected":"pip/scalyr-agent-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-24715"},{"id":"INC-12032","date":"2022-05","year":2022,"title":"OpenStack Nova Live migration fails to update persistent domain XML","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-17376"],"affected":"pip/nova, pip/nova, pip/nova","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-17376"},{"id":"INC-12033","date":"2022-05","year":2022,"title":"Dolibarr CRM allows Privilege Escalation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-14201"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-14201"},{"id":"INC-12034","date":"2022-05","year":2022,"title":"Magento security mitigation bypass vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-9689","CVE-2020-9690","CVE-2020-9691","CVE-2020-9692"],"affected":"composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-9692"},{"id":"INC-12035","date":"2022-05","year":2022,"title":"MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-15881","CVE-2020-15883","CVE-2020-15885"],"affected":"composer/munkireport/comment","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-15885"},{"id":"INC-12036","date":"2022-05","year":2022,"title":"Magento php object injection vulnerability","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-9664","CVE-2020-9665"],"affected":"composer/magento/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-9664"},{"id":"INC-12037","date":"2022-05","year":2022,"title":"Silverstripe CMS malicious file upload enables script execution","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-9309"],"affected":"composer/silverstripe/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-9309"},{"id":"INC-12038","date":"2022-05","year":2022,"title":"Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-2220","CVE-2020-2224","CVE-2020-2226"],"affected":"maven/org.jenkins-ci.plugins:matrix-auth","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2226"},{"id":"INC-12039","date":"2022-05","year":2022,"title":".NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-1147"],"affected":"nuget/Microsoft.NETCore.App.Runtime.win-x86, nuget/Microsoft.NETCore.App.Runtime.win-x64,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-1147"},{"id":"INC-12040","date":"2022-05","year":2022,"title":"RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2211","CVE-2020-2213"],"affected":"maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2211"},{"id":"INC-12042","date":"2022-05","year":2022,"title":"NukeViet Cross-Site Request Forgery (CSRF)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-13155"],"affected":"composer/nukeviet/nukeviet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13155"},{"id":"INC-12043","date":"2022-05","year":2022,"title":"Dolibarr reflected cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-19993","CVE-2020-14475"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-14475"},{"id":"INC-12044","date":"2022-05","year":2022,"title":"CSRF vulnerability in Jenkins Swarm Plugin","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2020-2191","CVE-2020-2192","CVE-2020-2197","CVE-2020-2198"],"affected":"maven/org.jenkins-ci.plugins:swarm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2192"},{"id":"INC-12045","date":"2022-05","year":2022,"title":"MediaWiki Open Redirect vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-10959"],"affected":"composer/mediawiki/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-10959"},{"id":"INC-12046","date":"2022-05","year":2022,"title":"Dolibarr Stored Cross-site Scripting via file upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-13239"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13239"},{"id":"INC-12047","date":"2022-05","year":2022,"title":"Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-2185","CVE-2020-2187","CVE-2020-2189"],"affected":"maven/org.jenkins-ci.plugins:ec2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2187"},{"id":"INC-12048","date":"2022-05","year":2022,"title":"RCE vulnerability in Jenkins AWS SAM Plugin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2178","CVE-2020-2179","CVE-2020-2180"],"affected":"maven/io.jenkins.plugins:aws-sam","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2180"},{"id":"INC-12049","date":"2022-05","year":2022,"title":"Stored XSS vulnerability in Jenkins FitNesse Plugin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2172","CVE-2020-2175"],"affected":"maven/org.jenkins-ci.plugins:fitnesse","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2175"},{"id":"INC-12050","date":"2022-05","year":2022,"title":"MediaWiki makeCollapsible allows applying event handler to any CSS selector","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-10960"],"affected":"composer/mediawiki/core, composer/mediawiki/core, composer/mediawiki/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-10960"},{"id":"INC-12051","date":"2022-05","year":2022,"title":"Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-10991"],"affected":"maven/org.mule.modules:mule-apikit-module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-10991"},{"id":"INC-12052","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins RapidDeploy Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2163","CVE-2020-2166","CVE-2020-2167","CVE-2020-2168","CVE-2020-2171"],"affected":"maven/org.jenkins-ci.plugins:rapiddeploy-jenkins","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2171"},{"id":"INC-12053","date":"2022-05","year":2022,"title":"Dolibarr ERP and CRM contain XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-14239","CVE-2017-14241","CVE-2019-19210"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19210"},{"id":"INC-12054","date":"2022-05","year":2022,"title":"Remote Code Execution vulnerability in Jenkins Literate Plugin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2137","CVE-2020-2138","CVE-2020-2144","CVE-2020-2146","CVE-2020-2158"],"affected":"maven/org.jenkins-ci.plugins:literate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2158"},{"id":"INC-12055","date":"2022-05","year":2022,"title":"Deserialization of Untrusted Data in JYaml","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-8441"],"affected":"maven/org.jyaml:jyaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-8441"},{"id":"INC-12056","date":"2022-05","year":2022,"title":"component-flatten vulnerable to Prototype Pollution","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10794"],"affected":"npm/component-flatten","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10794"},{"id":"INC-12058","date":"2022-05","year":2022,"title":"Magento stored cross-site scripting vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-3715","CVE-2020-3716","CVE-2020-3717","CVE-2020-3718","CVE-2020-3719","CVE-2020-3758"],"affected":"composer/magneto/core, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-3758"},{"id":"INC-12059","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins WebSphere Deployer Plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-2108"],"affected":"maven/org.jenkins-ci.plugins:websphere-deployer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2108"},{"id":"INC-12060","date":"2022-05","year":2022,"title":"Inbound TCP Agent Protocol/3 authentication bypass in Jenkins","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2020-2099","CVE-2020-2101"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2099"},{"id":"INC-12061","date":"2022-05","year":2022,"title":"Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-7934"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-7934"},{"id":"INC-12062","date":"2022-05","year":2022,"title":"Dolibarr cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-10095","CVE-2020-7994"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-7994"},{"id":"INC-12063","date":"2022-05","year":2022,"title":"Plone SQL Injection Vulnerability","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-7939"],"affected":"pip/Plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-7939"},{"id":"INC-12064","date":"2022-05","year":2022,"title":"phpBB Cross-Site Request Forgery (CSRF)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-5501"],"affected":"composer/phpbb/phpbb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-5501"},{"id":"INC-12065","date":"2022-05","year":2022,"title":"Redgate SQL Change Automation Plugin stored credentials in plain text","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2020-2092","CVE-2020-2095"],"affected":"maven/com.redgate.plugins.redgatesqlci:redgate-sql-ci","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2095"},{"id":"INC-12066","date":"2022-05","year":2022,"title":"PyAMF vulnerable to XML external entity (XXE)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-8549"],"affected":"pip/pyamf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8549"},{"id":"INC-12067","date":"2022-05","year":2022,"title":"Magento arbitrary PHP code execution via the productData parameter","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-6497"],"affected":"composer/magento/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-6497"},{"id":"INC-12068","date":"2022-05","year":2022,"title":"Jenkins Rundeck Plugin stored credentials in plain text","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-16549","CVE-2019-16550","CVE-2019-16556","CVE-2019-16557"],"affected":"maven/org.jenkins-ci.plugins:rundeck","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16556"},{"id":"INC-12069","date":"2022-05","year":2022,"title":"Modoboa is vulnerable to an XML External Entity Injection (XXE)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-19702"],"affected":"pip/modoboa-dmarc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19702"},{"id":"INC-12070","date":"2022-05","year":2022,"title":"Jenkins QMetry for JIRA Plugin stored credentials in plain text","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-16542","CVE-2019-16544","CVE-2019-16546","CVE-2019-16548"],"affected":"maven/org.jenkins-ci.plugins:qmetry-for-jira-test-management","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16544"},{"id":"INC-12071","date":"2022-05","year":2022,"title":"Magento Remote code execution through catalog attribute sets","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-8230","CVE-2019-8231"],"affected":"composer/magento/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-8231"},{"id":"INC-12072","date":"2022-05","year":2022,"title":"Magento 2 Community Edition RCE Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-8114","CVE-2019-8123","CVE-2019-8152","CVE-2019-8227","CVE-2019-8228","CVE-2019-8229","CVE-2019-8232"],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-8232"},{"id":"INC-12073","date":"2022-05","year":2022,"title":"Magento SQL injection vulnerability","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-8130"],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-8130"},{"id":"INC-12074","date":"2022-05","year":2022,"title":"Pimcore XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-18656"],"affected":"composer/pimcore/pimcore","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-18656"},{"id":"INC-12075","date":"2022-05","year":2022,"title":"Craft CMS possibility of brute force attempts","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-15929"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-15929"},{"id":"INC-12076","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache POI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-3529","CVE-2014-3574","CVE-2019-12415"],"affected":"maven/org.apache.poi:poi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-12415"},{"id":"INC-12077","date":"2022-05","year":2022,"title":"Jenkins Sonar Gerrit Plugin stores credentials unencrypted","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10459","CVE-2019-10460","CVE-2019-10466","CVE-2019-10467"],"affected":"maven/org.jenkins-ci.plugins:sonar-gerrit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10467"},{"id":"INC-12078","date":"2022-05","year":2022,"title":"Dolibarr ERP and CRM HTML Injection","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-17223"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-17223"},{"id":"INC-12079","date":"2022-05","year":2022,"title":"Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-10440","CVE-2019-10443","CVE-2019-10447","CVE-2019-10448","CVE-2019-10450"],"affected":"maven/com.elasticbox.jenkins-ci.plugins:elasticbox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10450"},{"id":"INC-12080","date":"2022-05","year":2022,"title":"Wildfly Authorization Misconfiguration","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-14838"],"affected":"maven/org.wildfly.core:wildfly-host-controller","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-14838"},{"id":"INC-12081","date":"2022-05","year":2022,"title":"OpenStack Octavia Amphora-Agent not requiring Client-Certificate","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-17134"],"affected":"pip/octavia, pip/octavia, pip/octavia","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-17134"},{"id":"INC-12082","date":"2022-05","year":2022,"title":"Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10432","CVE-2019-10433"],"affected":"maven/org.jenkins-ci.plugins:htmlpublisher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10432"},{"id":"INC-12083","date":"2022-05","year":2022,"title":"Dolibarr stored Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-16685"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16685"},{"id":"INC-12084","date":"2022-05","year":2022,"title":"Dolibarr Cross-site Scripting in a User Profile in a Signature section","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-16687"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16687"},{"id":"INC-12085","date":"2022-05","year":2022,"title":"Total.js CMS Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-15952"],"affected":"npm/total4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-15952"},{"id":"INC-12086","date":"2022-05","year":2022,"title":"Jenkins TestLink Plugin stores credentials in plain text","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10374","CVE-2019-10378","CVE-2019-10385"],"affected":"maven/org.jenkins-ci.plugins:testlink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10378"},{"id":"INC-12089","date":"2022-05","year":2022,"title":"Magento Filter extension bypass via crafted store configuration keys","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-7912"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7912"},{"id":"INC-12090","date":"2022-05","year":2022,"title":"Magento Stored cross-site scripting in admin panel","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-7863"],"affected":"composer/magento/community-edition, composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7863"},{"id":"INC-12091","date":"2022-05","year":2022,"title":"Skytap Cloud CI Plugin stored credentials in plain text","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10343","CVE-2019-10360","CVE-2019-10366"],"affected":"maven/org.jenkins-ci.plugins:skytap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10366"},{"id":"INC-12092","date":"2022-05","year":2022,"title":"SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-14315"],"affected":"composer/sunhater/kcfinder","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-14315"},{"id":"INC-12093","date":"2022-05","year":2022,"title":"Dolibarr Cross Site Request Forgery (CSRF)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-1010054"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010054"},{"id":"INC-12094","date":"2022-05","year":2022,"title":"Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-10346","CVE-2019-10349"],"affected":"maven/org.jenkins-ci.plugins:depgraph-view","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10349"},{"id":"INC-12095","date":"2022-05","year":2022,"title":"mxGraph vulnerable to cross-site scripting in color field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-13127"],"affected":"npm/mxgraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-13127"},{"id":"INC-12096","date":"2022-05","year":2022,"title":"Grafana Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-13068"],"affected":"go/github.com/grafana/grafana","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-13068"},{"id":"INC-12097","date":"2022-05","year":2022,"title":"Craft CMS XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-12823"],"affected":"composer/craftcms/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-12823"},{"id":"INC-12098","date":"2022-05","year":2022,"title":"Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2019-10335","CVE-2019-10336","CVE-2019-10337"],"affected":"maven/org.jenkins-ci.plugins:electricflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10335"},{"id":"INC-12099","date":"2022-05","year":2022,"title":"Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10226"],"affected":"rubygems/fat_free_crm","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10226"},{"id":"INC-12100","date":"2022-05","year":2022,"title":"PyDio Stored XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-10047"],"affected":"pip/Pydio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10047"},{"id":"INC-12101","date":"2022-05","year":2022,"title":"Jenkins Azure AD Plugin stored the client secret unencrypted","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-10309","CVE-2019-10318"],"affected":"maven/org.jenkins-ci.plugins:azure-ad","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10318"},{"id":"INC-12102","date":"2022-05","year":2022,"title":"Gitea Allows 1FA Even for 2FA-Enrolled Accounts","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-11576"],"affected":"go/code.gitea.io/gitea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-11576"},{"id":"INC-12103","date":"2022-05","year":2022,"title":"Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-10303"],"affected":"maven/org.jenkins-ci.plugins:azure-publishersettings-credentials","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10303"},{"id":"INC-12104","date":"2022-05","year":2022,"title":"Login screen allows message spoofing if SSO is enabled","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-24904","CVE-2022-24905"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24905"},{"id":"INC-12105","date":"2022-05","year":2022,"title":"Publify has Improper Access Controls","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-1810"],"affected":"rubygems/publify_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1810"},{"id":"INC-12106","date":"2022-05","year":2022,"title":"Publify vulnerable to cross site scripting","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1811"],"affected":"rubygems/publify_core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1811"},{"id":"INC-12107","date":"2022-05","year":2022,"title":"Nokogiri Improperly Handles Unexpected Data Type","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29181"],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29181"},{"id":"INC-12108","date":"2022-05","year":2022,"title":"Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29164"],"affected":"go/github.com/argoproj/argo-workflows/v3, go/github.com/argoproj/argo-workflows/v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29164"},{"id":"INC-12109","date":"2022-05","year":2022,"title":"Access control bypass in beego","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-31259"],"affected":"go/github.com/beego/beego, go/github.com/beego/beego/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-31259"},{"id":"INC-12110","date":"2022-05","year":2022,"title":"Improper Removal of Sensitive Information Before Storage or Transfer in Strapi","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-30617","CVE-2022-30618"],"affected":"npm/@strapi/strapi, npm/strapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-30617"},{"id":"INC-12111","date":"2022-05","year":2022,"title":"Out of bounds memory access in github.com/open-policy-agent/opa","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-28946"],"affected":"go/github.com/open-policy-agent/opa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28946"},{"id":"INC-12112","date":"2022-05","year":2022,"title":"gopkg.in/yaml.v3 Denial of Service","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-28948"],"affected":"go/gopkg.in/yaml.v3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28948"},{"id":"INC-12113","date":"2022-05","year":2022,"title":"Integer Overflow or Wraparound in libxml2 affects Nokogiri","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cgx6-hpwq-fhv5"},{"id":"INC-12114","date":"2022-05","year":2022,"title":"Cross-site Scripting in Jirafeau","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-30110"],"affected":"composer/mojo42/jirafeau","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-30110"},{"id":"INC-12115","date":"2022-05","year":2022,"title":"Cross Site Request Forgery in Jenkins Storable Configs Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-30947","CVE-2022-30948","CVE-2022-30949","CVE-2022-30950","CVE-2022-30951","CVE-2022-30971","CVE-2022-30972"],"affected":"maven/org.jvnet.hudson.plugins:storable-configs-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-30972"},{"id":"INC-14627","date":"2022-05","year":2022,"title":"phpBB vulnerable to sensitive information disclosure","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2008-6507"],"affected":"composer/phpbb/phpbb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-6507"},{"id":"INC-12116","date":"2022-05","year":2022,"title":"Apache Struts is vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-6682","CVE-2013-6348"],"affected":"maven/org.apache.struts:struts2-core, maven/org.apache.struts:struts2-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-6682"},{"id":"INC-12117","date":"2022-05","year":2022,"title":"Apache MyFaces Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2086"],"affected":"maven/org.apache.myfaces.core:myfaces-core-module, maven/org.apache.myfaces.core:myfaces-core-module","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2086"},{"id":"INC-12118","date":"2022-05","year":2022,"title":"Plone Cross-site Scripting vulnerability in PortalTransforms","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2422"],"affected":"pip/Plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2422"},{"id":"INC-12119","date":"2022-05","year":2022,"title":"HTML Purifier Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2479","CVE-2010-4183"],"affected":"composer/ezyang/htmlpurifier","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2479"},{"id":"INC-12120","date":"2022-05","year":2022,"title":"phpMyAdmin Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2958","CVE-2011-4782"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2958"},{"id":"INC-12121","date":"2022-05","year":2022,"title":"TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-3715"],"affected":"composer/typo3/cms-backend, composer/typo3/cms-backend, composer/typo3/cms-backend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-3715"},{"id":"INC-12122","date":"2022-05","year":2022,"title":"CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-4335"],"affected":"composer/cakephp/cakephp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-4335"},{"id":"INC-12123","date":"2022-05","year":2022,"title":"Apache Struts Multiple XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-2087"],"affected":"maven/org.apache.struts:struts2-parent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-2087"},{"id":"INC-12124","date":"2022-05","year":2022,"title":"Plone XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-1340"],"affected":"pip/plone","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1340"},{"id":"INC-12125","date":"2022-05","year":2022,"title":"OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2011-4457"],"affected":"maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4457"},{"id":"INC-12126","date":"2022-05","year":2022,"title":"Joomla! vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1649","CVE-2011-2509","CVE-2011-4332"],"affected":"composer/joomla/joomla-cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4332"},{"id":"INC-12127","date":"2022-05","year":2022,"title":"HTML Purifier allows remote attackers to obtain sensitive information","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2011-3744"],"affected":"composer/ezyang/htmlpurifier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-3744"},{"id":"INC-12128","date":"2022-05","year":2022,"title":"phpMyAdmin Multiple XSS Vulnerabilities","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-4345","CVE-2012-4579"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-4579"},{"id":"INC-12129","date":"2022-05","year":2022,"title":"Typo3 Backend XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1606","CVE-2012-1608"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1606"},{"id":"INC-12130","date":"2022-05","year":2022,"title":"Silverstripe XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-4968"],"affected":"composer/silverstripe/framework, composer/silverstripe/framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-4968"},{"id":"INC-14628","date":"2022-05","year":2022,"title":"phpMyAdmin Vulnerable to Cross-Site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-1940","CVE-2011-4634"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1940"},{"id":"INC-12131","date":"2022-05","year":2022,"title":"MoinMoin Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-3381","CVE-2009-0260","CVE-2009-0312","CVE-2009-1482","CVE-2011-1058","CVE-2012-6082","CVE-2016-9119"],"affected":"pip/moin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-6082"},{"id":"INC-12132","date":"2022-05","year":2022,"title":"phpMyAdmin Unsafe Fetching of Javascript Code","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5339","CVE-2012-5368"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5368"},{"id":"INC-12133","date":"2022-05","year":2022,"title":"XML Entity Expansion (XEE) in Django","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-1664","CVE-2013-1665"],"affected":"pip/Django, pip/Django","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-1664"},{"id":"INC-12134","date":"2022-05","year":2022,"title":"phpMyAdmin Global variables scope injection vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4729"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4729"},{"id":"INC-12135","date":"2022-05","year":2022,"title":"CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2012-4399"],"affected":"composer/cakephp/cakephp, composer/cakephp/cakephp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-4399"},{"id":"INC-07624","date":"2022-05","year":2022,"title":"phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4996","CVE-2013-4997"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4997"},{"id":"INC-12136","date":"2022-05","year":2022,"title":"Alkacon OpenCMS XSS via title and requestedResource parameters","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4600"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4600"},{"id":"INC-12137","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in JavaMelody","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4378"],"affected":"maven/net.bull.javamelody:javamelody-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4378"},{"id":"INC-12138","date":"2022-05","year":2022,"title":"Improper Authentication in OpenSAML","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-1411"],"affected":"maven/org.opensaml:opensaml, maven/org.opensaml:opensaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1411"},{"id":"INC-12139","date":"2022-05","year":2022,"title":"Apache Shindig PHP Sensitive Information Disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2013-4295"],"affected":"maven/org.apache.shindig:shindig-php","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4295"},{"id":"INC-12140","date":"2022-05","year":2022,"title":"OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4179","CVE-2013-4202"],"affected":"pip/nova","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4179"},{"id":"INC-12141","date":"2022-05","year":2022,"title":"Apache Solr for TYPO3 (solr) extension is vulnerable to Cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-6289"],"affected":"composer/apache-solr-for-typo3/solr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-6289"},{"id":"INC-12142","date":"2022-05","year":2022,"title":"Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4714"],"affected":"composer/tikiwiki/tiki-manager, composer/tikiwiki/tiki-manager, composer/tikiwiki/tiki-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4714"},{"id":"INC-12143","date":"2022-05","year":2022,"title":"Salt has insufficient argument validation in several modules","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4435"],"affected":"pip/salt","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4435"},{"id":"INC-12144","date":"2022-05","year":2022,"title":"Fat Free CRM vulnerable to Exposure of Sensitive Information","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2013-7249"],"affected":"rubygems/fat_free_crm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7249"},{"id":"INC-12145","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache Solr","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-6612","CVE-2013-6397","CVE-2013-6407","CVE-2013-6408"],"affected":"maven/org.apache.solr:solr-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-6612"},{"id":"INC-12146","date":"2022-05","year":2022,"title":"OpenStack Nova Router metadata queries are not restricted by tenant","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-6419","CVE-2014-0157","CVE-2014-3473","CVE-2014-3474","CVE-2014-3497","CVE-2014-3594","CVE-2019-10876"],"affected":"pip/nova","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-6419"},{"id":"INC-12147","date":"2022-05","year":2022,"title":"Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-2829"],"affected":"erlang/MongooseIM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2829"},{"id":"INC-12148","date":"2022-05","year":2022,"title":"Ajenti Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-2260"],"affected":"pip/ajenti","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2260"},{"id":"INC-12149","date":"2022-05","year":2022,"title":"Ignite Realtime Openfire vulnerable to XMPPbomb attack","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-2741"],"affected":"maven/org.igniterealtime.openfire:parent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2741"},{"id":"INC-12150","date":"2022-05","year":2022,"title":"Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2014-0135"],"affected":"rubygems/kafo, rubygems/kafo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-0135"},{"id":"INC-12151","date":"2022-05","year":2022,"title":"SOAPpy vulnerable to XML External Entity attacks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-3242"],"affected":"pip/SOAPpy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3242"},{"id":"INC-12152","date":"2022-05","year":2022,"title":"PHPExcel vulnerable to XXE attacks through libxml","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-2054"],"affected":"composer/phpoffice/phpexcel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2054"},{"id":"INC-12153","date":"2022-05","year":2022,"title":"OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-0162"],"affected":"pip/glance","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-0162"},{"id":"INC-12154","date":"2022-05","year":2022,"title":"XXE in SabreDAV","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-2055"],"affected":"composer/sabre/dav, composer/sabre/dav","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2055"},{"id":"INC-12155","date":"2022-05","year":2022,"title":"OpenStack Neutron Improper Authentication vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-0056"],"affected":"pip/neutron","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-0056"},{"id":"INC-12156","date":"2022-05","year":2022,"title":"GeSHi vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-3522"],"affected":"composer/geshi/geshi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-3522"},{"id":"INC-12157","date":"2022-05","year":2022,"title":"Djblets Cross-site scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3994","CVE-2014-3995"],"affected":"pip/Djblets, pip/djblets","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3995"},{"id":"INC-12158","date":"2022-05","year":2022,"title":"Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3840"],"affected":"pip/mayan-edms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3840"},{"id":"INC-12159","date":"2022-05","year":2022,"title":"Fat Free CRM subject to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-5441"],"affected":"rubygems/fat_free_crm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-5441"},{"id":"INC-12160","date":"2022-05","year":2022,"title":"Plone Cross-site scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5490","CVE-2012-5494","CVE-2012-5502","CVE-2012-5504"],"affected":"pip/Plone, pip/plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5502"},{"id":"INC-12161","date":"2022-05","year":2022,"title":"WEC Map (wec_map) extension for TYPO3 allows Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-6292","CVE-2014-6296"],"affected":"composer/jbartels/wec-map, composer/web-tp3/wec_map","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-6296"},{"id":"INC-07657","date":"2022-05","year":2022,"title":"Cobbler vulnerable to code injection via unsafe YAML loading","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-4953"],"affected":"pip/cobbler","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4953"},{"id":"INC-12162","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Direct Web Remoting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-5326"],"affected":"maven/org.directwebremoting:dwr, maven/org.directwebremoting:dwr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-5326"},{"id":"INC-12163","date":"2022-05","year":2022,"title":"ZF-Commons ZfcUser Vulnerable to XSS in Login Redirect","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-1039"],"affected":"composer/zf-commons/zfc-user","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-1039"},{"id":"INC-12164","date":"2022-05","year":2022,"title":"October CMS XSS In Caption Tag of Profile","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-5612"],"affected":"composer/october/october","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-5612"},{"id":"INC-12165","date":"2022-05","year":2022,"title":"The Preview plugin in CKEditor allows Cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-5191"],"affected":"composer/ckeditor/ckeditor","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-5191"},{"id":"INC-12166","date":"2022-05","year":2022,"title":"Cross-site Scripting in SmartyException","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-4437"],"affected":"composer/smarty/smarty","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-4437"},{"id":"INC-12167","date":"2022-05","year":2022,"title":"TYPO3 CMS indexed search Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8756"],"affected":"composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8756"},{"id":"INC-12168","date":"2022-05","year":2022,"title":"TYPO3 Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8759"],"affected":"composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8759"},{"id":"INC-12169","date":"2022-05","year":2022,"title":"Dolibarr ERP and CRM contain XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-1912"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-1912"},{"id":"INC-12170","date":"2022-05","year":2022,"title":"phpMyAdmin cross-site scripting Vulnerability via ENUM value","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-7217"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-7217"},{"id":"INC-12171","date":"2022-05","year":2022,"title":"Apache Ranger Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-0265"],"affected":"maven/org.apache.ranger:ranger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-0265"},{"id":"INC-12172","date":"2022-05","year":2022,"title":"Apache Jetspeed vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-0711","CVE-2016-0712"],"affected":"maven/org.apache.portals.jetspeed-2:jetspeed-commons","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-0711"},{"id":"INC-12173","date":"2022-05","year":2022,"title":"Jenkins allows Cross-Site Scripting (XSS)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-4344","CVE-2012-0324","CVE-2012-0325"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4344"},{"id":"INC-12174","date":"2022-05","year":2022,"title":"Jenkin allows attackers to obtain passwords by reading the HTML source code","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-2061","CVE-2014-2065","CVE-2014-2067"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2061"},{"id":"INC-12175","date":"2022-05","year":2022,"title":"Liferay Portal Vulnerable to XSS in Profile Search Functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-3670"],"affected":"maven/com.liferay:com.liferay.portal.search.web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-3670"},{"id":"INC-12176","date":"2022-05","year":2022,"title":"Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-6374"],"affected":"maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-6374"},{"id":"INC-12177","date":"2022-05","year":2022,"title":"Eugene Pankov Ajenti Cross-site scripting Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-4301"],"affected":"pip/ajenti","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-4301"},{"id":"INC-12178","date":"2022-05","year":2022,"title":"OpenStack Murano Code Execution","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4972"],"affected":"pip/python-muranoclient, pip/murano-dashboard, pip/python-muranoclient","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4972"},{"id":"INC-12179","date":"2022-05","year":2022,"title":"Drupal Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-7571"],"affected":"composer/drupal/drupal, composer/drupal/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-7571"},{"id":"INC-12180","date":"2022-05","year":2022,"title":"Cross-site Scripting in Apache ActiveMQ","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-0684","CVE-2012-6092"],"affected":"maven/org.apache.activemq:activemq-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-6092"},{"id":"INC-12181","date":"2022-05","year":2022,"title":"PHP OpenID Library Denial of Service vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4701"],"affected":"composer/typo3/cms, composer/openid/php-openid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4701"},{"id":"INC-12182","date":"2022-05","year":2022,"title":"Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-5325"],"affected":"maven/org.directwebremoting:dwr, maven/org.directwebremoting:dwr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-5325"},{"id":"INC-12183","date":"2022-05","year":2022,"title":"Moodle XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-9188"],"affected":"composer/moodle/moodle","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-9188"},{"id":"INC-12184","date":"2022-05","year":2022,"title":"Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2015-1796"],"affected":"maven/edu.internet2.middleware:shibboleth-identityprovider, maven/org.opensaml:opensaml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-1796"},{"id":"INC-12185","date":"2022-05","year":2022,"title":"MediaElement Vulnerable to Reflected XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4567"],"affected":"composer/contao/core, composer/contao-components/mediaelement, npm/mediaelement","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4567"},{"id":"INC-12186","date":"2022-05","year":2022,"title":"Django Cross-site Scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-2241","CVE-2016-6186"],"affected":"pip/django, pip/django","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-2241"},{"id":"INC-12187","date":"2022-05","year":2022,"title":"phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-2559"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-2559"},{"id":"INC-12188","date":"2022-05","year":2022,"title":"Yii Framework Cross-site Scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-3397"],"affected":"composer/yiisoft/yii2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3397"},{"id":"INC-12189","date":"2022-05","year":2022,"title":"Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-3935"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3935"},{"id":"INC-12190","date":"2022-05","year":2022,"title":"concrete5 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-3989"],"affected":"composer/concrete5/concrete5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3989"},{"id":"INC-12191","date":"2022-05","year":2022,"title":"phpMyAdmin cross-site scripting Vulnerability in Table or Column Names","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-4986","CVE-2014-5274"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-4986"},{"id":"INC-12192","date":"2022-05","year":2022,"title":"OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-3219","CVE-2016-4428"],"affected":"pip/horizon","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3219"},{"id":"INC-12193","date":"2022-05","year":2022,"title":"ZendXml and Zend Framework contain XXE and XEE Vulnerabilities","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-5161"],"affected":"composer/zendframework/zendframework, composer/zendframework/zendxml, composer/zendframework/zendframework1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-5161"},{"id":"INC-12194","date":"2022-05","year":2022,"title":"phpMyAdmin Cross-site scripting (XSS) vulnerability via pageNumber value","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-5002"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5002"},{"id":"INC-12195","date":"2022-05","year":2022,"title":"Joomla! Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-5583"],"affected":"composer/joomla/joomla-cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5583"},{"id":"INC-12196","date":"2022-05","year":2022,"title":"getID3 is vulnerable to XML External Entity (XXE)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-2053"],"affected":"composer/james-heinrich/getid3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-2053"},{"id":"INC-12197","date":"2022-05","year":2022,"title":"TYPO3 Backend component Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4056"],"affected":"composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4056"},{"id":"INC-12198","date":"2022-05","year":2022,"title":"Plone XSS in Zope ZMI","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-7147"],"affected":"pip/plone, pip/plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-7147"},{"id":"INC-12199","date":"2022-05","year":2022,"title":"EpicEditor XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-6589"],"affected":"npm/epiceditor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-6589"},{"id":"INC-12200","date":"2022-05","year":2022,"title":"imdbphp Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7204"],"affected":"composer/imdbphp/imdbphp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7204"},{"id":"INC-12201","date":"2022-05","year":2022,"title":"Cherry Music Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8310"],"affected":"pip/CherryMusic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8310"},{"id":"INC-12202","date":"2022-05","year":2022,"title":"Apache Ambari Improper Access Control","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-6807"],"affected":"maven/org.apache.ambari:ambari","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-6807"},{"id":"INC-12203","date":"2022-05","year":2022,"title":"SocialNetwork Cross-Site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7390"],"affected":"composer/movingbytes/social-network","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7390"},{"id":"INC-12204","date":"2022-05","year":2022,"title":"Magmi XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7391"],"affected":"composer/dweeves/magmi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7391"},{"id":"INC-12205","date":"2022-05","year":2022,"title":"TeamPass vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-7562"],"affected":"composer/nilsteampassnet/teampass","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-7562"},{"id":"INC-12206","date":"2022-05","year":2022,"title":"Yii Framework Reflected XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7271"],"affected":"composer/yiisoft/yii2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7271"},{"id":"INC-12207","date":"2022-05","year":2022,"title":"baserCMS Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4880"],"affected":"composer/baserproject/basercms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4880"},{"id":"INC-12208","date":"2022-05","year":2022,"title":"ViMbAdmin Cross-site Scripting Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-5870"],"affected":"composer/opensolutions/vimbadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-5870"},{"id":"INC-12209","date":"2022-05","year":2022,"title":"ADOdb Cross-site scripting vulnerability in old test script","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4855"],"affected":"composer/adodb/adodb-php","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4855"},{"id":"INC-07509","date":"2022-05","year":2022,"title":"phpMyAdmin XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-2040","CVE-2016-5704","CVE-2016-5705","CVE-2016-5731","CVE-2016-5732"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-5704"},{"id":"INC-12210","date":"2022-05","year":2022,"title":"New Relic .NET Agent contains SQL Injection","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-9246"],"affected":"nuget/NewRelic.Agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-9246"},{"id":"INC-12211","date":"2022-05","year":2022,"title":"Apache OpenMeetings vulnerable to SQL injection","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7681"],"affected":"maven/org.apache.openmeetings:openmeetings-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7681"},{"id":"INC-12212","date":"2022-05","year":2022,"title":"Apache OpenMeetings does not correctly validate uploaded XML documents","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-7664"],"affected":"maven/org.apache.openmeetings:openmeetings-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7664"},{"id":"INC-12213","date":"2022-05","year":2022,"title":"XML External Entity Reference in Apache Sling","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-6798"],"affected":"maven/org.apache.sling:org.apache.sling.xss.compat, maven/org.apache.sling:org.apache.sling.xss","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-6798"},{"id":"INC-12214","date":"2022-05","year":2022,"title":"Apache Solr Cross-site scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8796"],"affected":"maven/org.apache.solr:solr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8796"},{"id":"INC-12215","date":"2022-05","year":2022,"title":"TYPO3 Cross-site Scripting vulnerability in the file backend module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-5644"],"affected":"composer/typo3/cms-backend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-5644"},{"id":"INC-12216","date":"2022-05","year":2022,"title":"typo3/cms-felogin Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-5656"],"affected":"composer/typo3/cms-felogin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-5656"},{"id":"INC-12217","date":"2022-05","year":2022,"title":"Trac has vulnerability in HTML sanitizer filter","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-1405","CVE-2008-3328","CVE-2008-5647"],"affected":"pip/Trac","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-5647"},{"id":"INC-12218","date":"2022-05","year":2022,"title":"Mayaa Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-5720"],"affected":"maven/com.github.seasarorg.mayaa:mayaa","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-5720"},{"id":"INC-12219","date":"2022-05","year":2022,"title":"Improper Input Validation in OpenSymphony XWork","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2008-6504"],"affected":"maven/com.opensymphony:xwork, maven/com.opensymphony:xwork","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-6504"},{"id":"INC-12220","date":"2022-05","year":2022,"title":"EC-CUBE XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-0451"],"affected":"composer/ec-cube/ec-cube","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-0451"},{"id":"INC-12221","date":"2022-05","year":2022,"title":"Loggerhead XSS via filename","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-0728"],"affected":"pip/loggerhead","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-0728"},{"id":"INC-12222","date":"2022-05","year":2022,"title":"QooxDoo XSS in Callback Parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-1714"],"affected":"npm/qooxdoo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1714"},{"id":"INC-12223","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Google Web Toolkit","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4204"],"affected":"maven/com.google.gwt:gwt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4204"},{"id":"INC-12224","date":"2022-05","year":2022,"title":"Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-12882"],"affected":"maven/org.springframework.batch:spring-batch-admin-manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-12882"},{"id":"INC-12225","date":"2022-05","year":2022,"title":"TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-5097","CVE-2010-5098","CVE-2010-5100"],"affected":"composer/typo3/cms-frontend, composer/typo3/cms-frontend","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-5097"},{"id":"INC-12226","date":"2022-05","year":2022,"title":"Symphony CMS vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-4340"],"affected":"composer/symphonycms/symphony-2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4340"},{"id":"INC-12227","date":"2022-05","year":2022,"title":"Apache Struts Multiple Cross-site Scripting Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1006"],"affected":"maven/org.apache.struts:struts2-parent, maven/org.apache.struts:struts2-parent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1006"},{"id":"INC-12228","date":"2022-05","year":2022,"title":"Fork CMS Multiple XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1188"],"affected":"composer/forkcms/forkcms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1188"},{"id":"INC-12229","date":"2022-05","year":2022,"title":"Elefant CMS Multiple XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1296"],"affected":"composer/elefant/cms, composer/elefant/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1296"},{"id":"INC-12230","date":"2022-05","year":2022,"title":"OpenStack Horizon Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-2094"],"affected":"pip/horizon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-2094"},{"id":"INC-12231","date":"2022-05","year":2022,"title":"Typo3 Exception Handler XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-2112"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-2112"},{"id":"INC-12232","date":"2022-05","year":2022,"title":"Typo3 Backend XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-3528","CVE-2012-3531"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-3528"},{"id":"INC-12233","date":"2022-05","year":2022,"title":"Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5888"],"affected":"composer/b13/seo_basics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5888"},{"id":"INC-12234","date":"2022-05","year":2022,"title":"Cross-site scripting in yui 2.4.0","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5881"],"affected":"npm/yui2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5881"},{"id":"INC-12235","date":"2022-05","year":2022,"title":"powermail extension for TYPO3 has Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5889"],"affected":"composer/in2code/powermail","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5889"},{"id":"INC-12236","date":"2022-05","year":2022,"title":"Typo3 Function Menu API XSS Vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-6145","CVE-2012-6147","CVE-2012-6148"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-6148"},{"id":"INC-12237","date":"2022-05","year":2022,"title":"Symphony Vulnerable to PHP Code Injection via YAML Parsing","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-1348"],"affected":"composer/symfony/yaml, composer/symfony/symfony","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-1348"},{"id":"INC-12238","date":"2022-05","year":2022,"title":"Django cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4249"],"affected":"pip/django","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4249"},{"id":"INC-12239","date":"2022-05","year":2022,"title":"DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4649"],"affected":"nuget/DotNetNuke.Core, nuget/DotNetNuke.Core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4649"},{"id":"INC-12240","date":"2022-05","year":2022,"title":"Static Methods since 2007 (div2007) extension for TYPO3 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-5100"],"affected":"composer/jambagecom/div2007","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5100"},{"id":"INC-12241","date":"2022-05","year":2022,"title":"Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-5323"],"affected":"composer/sjbr/static-info-tables","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5323"},{"id":"INC-12242","date":"2022-05","year":2022,"title":"Jenkins allows Cross-Site Scripting (XSS) in User Configuration","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-5573"],"affected":"maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5573"},{"id":"INC-12243","date":"2022-05","year":2022,"title":"TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-7074","CVE-2013-7077","CVE-2013-7078"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7074"},{"id":"INC-12244","date":"2022-05","year":2022,"title":"TYPO3 Flow Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-7082"],"affected":"composer/typo3/flow, composer/typo3/flow, composer/neos/flow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7082"},{"id":"INC-12245","date":"2022-05","year":2022,"title":"Fastly Magento2 sensitive information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2017-13761"],"affected":"composer/fastly/magento2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-13761"},{"id":"INC-12246","date":"2022-05","year":2022,"title":"NodeBB Cross-site Scripting Vulnerability in Markdown Processing","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-3296"],"affected":"npm/nodebb-plugin-markdown, npm/nodebb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3296"},{"id":"INC-12247","date":"2022-05","year":2022,"title":"Deserialization of Untrusted Data in Apache Brooklyn","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-8744"],"affected":"maven/org.apache.brooklyn:brooklyn","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-8744"},{"id":"INC-12248","date":"2022-05","year":2022,"title":"eGroupware Community Edition Stored XSS vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-14920"],"affected":"composer/egroupware/egroupware","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-14920"},{"id":"INC-12249","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Jelly","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-12621"],"affected":"maven/commons-jelly:commons-jelly","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-12621"},{"id":"INC-12250","date":"2022-05","year":2022,"title":"Persistent XSS vulnerability in Jenkins OWASP Dependency-Check Plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-1000102","CVE-2017-1000103","CVE-2017-1000109"],"affected":"maven/org.jenkins-ci.plugins:dependency-check-jenkins-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000109"},{"id":"INC-12251","date":"2022-05","year":2022,"title":"Umbraco CMS vulnerable to stored XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-15279"],"affected":"nuget/UmbracoCMS.Web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15279"},{"id":"INC-12252","date":"2022-05","year":2022,"title":"Umbraco CMS XXE Vulnerability","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-15280"],"affected":"nuget/UmbracoCms.Web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15280"},{"id":"INC-12253","date":"2022-05","year":2022,"title":"TeamPass Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-15278"],"affected":"composer/nilsteampassnet/teampass","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15278"},{"id":"INC-12254","date":"2022-05","year":2022,"title":"Persisted XSS Vulnerability in Jenkins Sidebar Link Plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-1000088"],"affected":"maven/org.jenkins-ci.plugins:sidebar-link","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000088"},{"id":"INC-12255","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache OpenNLP","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-12620"],"affected":"maven/org.apache.opennlp:opennlp-tools","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-12620"},{"id":"INC-12256","date":"2022-05","year":2022,"title":"Improper Input Validation in Apache Batik","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-0250"],"affected":"maven/org.apache.xmlgraphics:batik","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-0250"},{"id":"INC-12257","date":"2022-05","year":2022,"title":"TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-3659"],"affected":"composer/typo3/cms-backend, composer/typo3/cms-backend, composer/typo3/cms-backend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-3659"},{"id":"INC-12258","date":"2022-05","year":2022,"title":"Concrete5 Vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-5181"],"affected":"composer/concrete5/concrete5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-5181"},{"id":"INC-12259","date":"2022-05","year":2022,"title":"TeamPass stored cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2017-15051","CVE-2017-15052","CVE-2017-15053"],"affected":"composer/nilsteampassnet/teampass","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15051"},{"id":"INC-12260","date":"2022-05","year":2022,"title":"Improper kubeconfig validation allows arbitrary code execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-24817"],"affected":"go/github.com/fluxcd/helm-controller, go/github.com/fluxcd/kustomize-controller, go/github.com/fluxcd/flux2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24817"},{"id":"INC-12261","date":"2022-05","year":2022,"title":"lxml Cross-site Scripting Via Control Characters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3146"],"affected":"pip/lxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3146"},{"id":"INC-12262","date":"2022-05","year":2022,"title":"Typo3 XSS Vulnerabilities","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3943"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3943"},{"id":"INC-12263","date":"2022-05","year":2022,"title":"XML External Entity Reference in org.picketlink:picketlink-common","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3530"],"affected":"maven/org.picketlink:picketlink-common","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3530"},{"id":"INC-12264","date":"2022-05","year":2022,"title":"Jenkins allows Deserialization of Untrusted Data via an XML File","severity":"High","attack_vector":"rce","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2016-0792","CVE-2016-3727"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-0792"},{"id":"INC-12265","date":"2022-05","year":2022,"title":"Apache Drill vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-12630"],"affected":"maven/org.apache.drill:drill-common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-12630"},{"id":"INC-12266","date":"2022-05","year":2022,"title":"Fork CMS XSS via Highlight Parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1209"],"affected":"composer/forkcms/forkcms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1209"},{"id":"INC-12267","date":"2022-05","year":2022,"title":"Magento Cross-Site Request Forgery (CSRF)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-5301"],"affected":"composer/magento/community-edition, composer/magento/community-edition","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-5301"},{"id":"INC-12268","date":"2022-05","year":2022,"title":"Pallets Werkzeug cross-site scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-10516"],"affected":"pip/Werkzeug","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-10516"},{"id":"INC-12269","date":"2022-05","year":2022,"title":"XXE vulnerability in Jenkins PMD Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2018-1000008","CVE-2018-1000009","CVE-2018-1000010","CVE-2018-1000011","CVE-2018-1000012","CVE-2018-1000015"],"affected":"maven/org.jvnet.hudson.plugins:pmd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000008"},{"id":"INC-12270","date":"2022-05","year":2022,"title":"Cross-Site Request Forgery (CSRF) vulnerability in Jenkins global-build-stats plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-1000386","CVE-2017-1000388","CVE-2017-1000389"],"affected":"maven/org.jenkins-ci.plugins:global-build-stats","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000389"},{"id":"INC-12271","date":"2022-05","year":2022,"title":"Arbitrary shell command execution in Jenkins EC2 Plugin","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-1000502"],"affected":"maven/org.jenkins-ci.plugins:ec2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000502"},{"id":"INC-12272","date":"2022-05","year":2022,"title":"SimpleSAMLphp SAML2 spoof SAML responses","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-9814"],"affected":"composer/simplesamlphp/saml2, composer/simplesamlphp/saml2, composer/simplesamlphp/saml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-9814"},{"id":"INC-12273","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2018-1000054","CVE-2018-1000055","CVE-2018-1000056"],"affected":"maven/org.jenkins-ci.plugins:junit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000056"},{"id":"INC-12274","date":"2022-05","year":2022,"title":"phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-7260"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7260"},{"id":"INC-12275","date":"2022-05","year":2022,"title":"mxGraph vulnerable to XXE attacks","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-18197"],"affected":"npm/mxgraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-18197"},{"id":"INC-12276","date":"2022-05","year":2022,"title":"Path Traversal in Apache Oozie","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-15712"],"affected":"maven/org.apache.oozie:oozie-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15712"},{"id":"INC-12277","date":"2022-05","year":2022,"title":"Drupal cross-site scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-6927"],"affected":"composer/drupal/drupal, composer/drupal/drupal, composer/drupal/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-6927"},{"id":"INC-12278","date":"2022-05","year":2022,"title":"Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-1000425"],"affected":"maven/com.liferay.portal:release.portal.bom","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000425"},{"id":"INC-12279","date":"2022-05","year":2022,"title":"Stored cross-site scripting vulnerability in Jenkins TestLink Plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2018-1000106","CVE-2018-1000113"],"affected":"maven/org.jenkins-ci.plugins:testlink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000113"},{"id":"INC-12280","date":"2022-05","year":2022,"title":"Grav CMS Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-5233"],"affected":"composer/getgrav/grav","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-5233"},{"id":"INC-12281","date":"2022-05","year":2022,"title":"Gleez CMS Stored XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-13339","CVE-2018-7035"],"affected":"composer/gleez/cms, composer/gleez/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7035"},{"id":"INC-12282","date":"2022-05","year":2022,"title":"Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2018-1000142"],"affected":"maven/org.jenkins-ci.plugins:ghprb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000142"},{"id":"INC-12283","date":"2022-05","year":2022,"title":"OISF suricata-update unsafely deserializes YAML data","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000167"],"affected":"pip/suricata-update","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000167"},{"id":"INC-12284","date":"2022-05","year":2022,"title":"GeniXCMS Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-14740"],"affected":"composer/genix/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-14740"},{"id":"INC-12285","date":"2022-05","year":2022,"title":"Jenkins HTML Publisher Plugin path traversal vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000175"],"affected":"maven/org.jenkins-ci.plugins:htmlpublisher","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000175"},{"id":"INC-12286","date":"2022-05","year":2022,"title":"Airbnb Knowledge Repo XSS In Comments","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-12104"],"affected":"pip/knowledge-repo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-12104"},{"id":"INC-12287","date":"2022-05","year":2022,"title":"Jenkins SAML Plugin Session Fixation vulnerability","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2018-1000602","CVE-2018-1000604","CVE-2018-1000609"],"affected":"maven/org.jenkins-ci.plugins:saml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000602"},{"id":"INC-12288","date":"2022-05","year":2022,"title":"XSS in baserCMS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-0570","CVE-2018-0574"],"affected":"composer/baserproject/basercms, composer/baserproject/basercms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-0574"},{"id":"INC-12289","date":"2022-05","year":2022,"title":"Improper Input Validation in Deap","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-3749"],"affected":"npm/deap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-3749"},{"id":"INC-12290","date":"2022-05","year":2022,"title":"xapian-core Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-0499"],"affected":"rubygems/xapian-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-0499"},{"id":"INC-12291","date":"2022-05","year":2022,"title":"PHPOffice Common Improper Restriction of XML External Entity Reference","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-14065"],"affected":"composer/phpoffice/common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-14065"},{"id":"INC-12292","date":"2022-05","year":2022,"title":"Gleez Cms Cross-site Scripting in Profile Page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1999021"],"affected":"composer/gleez/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999021"},{"id":"INC-12293","date":"2022-05","year":2022,"title":"Drupal PECL YAML parser unsafe object handling","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-6920","CVE-2017-6921"],"affected":"composer/drupal/drupal, composer/drupal/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-6920"},{"id":"INC-12294","date":"2022-05","year":2022,"title":"Apache Continuum and Archiva vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-0533"],"affected":"maven/org.apache.continuum:continuum, maven/org.apache.continuum:continuum, maven/org.apache.archiva:archiva","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-0533"},{"id":"INC-12295","date":"2022-05","year":2022,"title":"Access controll bypass in Apache Tomcat","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-1183"],"affected":"maven/org.apache.tomcat:tomcat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1183"},{"id":"INC-14629","date":"2022-05","year":2022,"title":"phpMyAdmin vulnerable to static code injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-2505","CVE-2011-2506"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-2506"},{"id":"INC-12296","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in JAMon","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-6235"],"affected":"maven/com.jamonapi:jamon","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-6235"},{"id":"INC-12297","date":"2022-05","year":2022,"title":"Improper Input Validation in Apache Jackrabbit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-1833"],"affected":"maven/org.apache.jackrabbit:jackrabbit-core, maven/org.apache.jackrabbit:jackrabbit-core,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-1833"},{"id":"INC-12298","date":"2022-05","year":2022,"title":"Fat Free CRM Cross-Site Request Forgery vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-1585"],"affected":"rubygems/fat_free_crm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-1585"},{"id":"INC-12299","date":"2022-05","year":2022,"title":"Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-2351"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-2351"},{"id":"INC-12300","date":"2022-05","year":2022,"title":"Apache OpenMeetings Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-2163","CVE-2016-3089"],"affected":"maven/org.apache.openmeetings:openmeetings-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-2163"},{"id":"INC-12301","date":"2022-05","year":2022,"title":"WSO2 Carbon vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4316"],"affected":"maven/org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui, maven/org.wso2.carbon.identity.framework:org.wso2.carbon…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4316"},{"id":"INC-12302","date":"2022-05","year":2022,"title":"Plone Cross-site Scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-7138","CVE-2016-7139","CVE-2016-7140"],"affected":"pip/Plone, pip/Plone, pip/Plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-7139"},{"id":"INC-12303","date":"2022-05","year":2022,"title":"SilverStripe vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1593"],"affected":"composer/silverstripe/framework, composer/silverstripe/cms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-1593"},{"id":"INC-12304","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Apache Axis2","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2103"],"affected":"maven/org.apache.axis2.wso2:axis2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2103"},{"id":"INC-12305","date":"2022-05","year":2022,"title":"MantisBT Cross-site Scripting vulnerability","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-2574"],"affected":"composer/mantisbt/mantisbt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2574"},{"id":"INC-12306","date":"2022-05","year":2022,"title":"ImpressCMS Cross-site Scripting vulnerability via quicksearch_ContentContent parameter","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-4616"],"affected":"composer/impresscms/impresscms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-4616"},{"id":"INC-12307","date":"2022-05","year":2022,"title":"PHPMailer susceptible to arbitrary code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-5619"],"affected":"composer/phpmailer/phpmailer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-5619"},{"id":"INC-12308","date":"2022-05","year":2022,"title":"Withdrawn Advisory: Apache Struts XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1007"],"affected":"maven/struts:struts, maven/org.apache.struts:struts-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1007"},{"id":"INC-12309","date":"2022-05","year":2022,"title":"OpenStack Neutron Improper Input Validation vulnerability","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-3221"],"affected":"pip/neutron, pip/neutron","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3221"},{"id":"INC-12310","date":"2022-05","year":2022,"title":"Nokogiri gem, via libxml, is affected by DoS vulnerabilities","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-15412"],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15412"},{"id":"INC-12311","date":"2022-05","year":2022,"title":"OpenStack Swift Unchecked user input in XML responses","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-2161"],"affected":"pip/swift","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-2161"},{"id":"INC-12312","date":"2022-05","year":2022,"title":"phpMyAdmin vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-5733"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-5733"},{"id":"INC-12313","date":"2022-05","year":2022,"title":"phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-8326"],"affected":"composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin, composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-8326"},{"id":"INC-12314","date":"2022-05","year":2022,"title":"XML External Entity Reference in Apache Cayenne","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-11758"],"affected":"maven/org.apache.cayenne:cayenne-parent, maven/org.apache.cayenne:cayenne-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-11758"},{"id":"INC-12315","date":"2022-05","year":2022,"title":"Gogs XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-17031"],"affected":"go/gogs.io/gogs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17031"},{"id":"INC-12316","date":"2022-05","year":2022,"title":"Subrion Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-10795"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-10795"},{"id":"INC-12317","date":"2022-05","year":2022,"title":"Subrion CMS Cross-site scripting in search","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-9120"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-9120"},{"id":"INC-12318","date":"2022-05","year":2022,"title":"Subrion CMS Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-14840"],"affected":"composer/intelliants/subrion","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-14840"},{"id":"INC-12319","date":"2022-05","year":2022,"title":"OpenStack Nova live snapshots use an insecure local directory","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-7048"],"affected":"pip/nova","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7048"},{"id":"INC-12320","date":"2022-05","year":2022,"title":"Cross-site Scripting in Apache Struts","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-1548","CVE-2016-4003"],"affected":"maven/org.apache.struts:struts2-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4003"},{"id":"INC-12321","date":"2022-05","year":2022,"title":"LibreNMS XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-18478"],"affected":"composer/librenms/librenms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-18478"},{"id":"INC-12322","date":"2022-05","year":2022,"title":"Apache XML-RPC XXE Vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-5002"],"affected":"maven/org.apache.xmlrpc:xmlrpc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-5002"},{"id":"INC-12323","date":"2022-05","year":2022,"title":"Jenkins vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-2033"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-2033"},{"id":"INC-12324","date":"2022-05","year":2022,"title":"Apache Struts Code injection due to conversion error","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-0838"],"affected":"maven/org.apache.struts.xwork:xwork-core, maven/org.apache.struts:struts2-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-0838"},{"id":"INC-12325","date":"2022-05","year":2022,"title":"PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-20583"],"affected":"composer/league/commonmark","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-20583"},{"id":"INC-12326","date":"2022-05","year":2022,"title":"Stored XSS vulnerability in Config File Provider Plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000407","CVE-2018-1000413","CVE-2018-1000415","CVE-2018-1000416","CVE-2018-1000426"],"affected":"maven/org.jenkins-ci.plugins:config-file-provider","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000413"},{"id":"INC-12327","date":"2022-05","year":2022,"title":"XML External Entity Reference in weixin-java-tools","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-5312"],"affected":"maven/com.github.binarywang:weixin-java-common","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-5312"},{"id":"INC-12328","date":"2022-05","year":2022,"title":"Croogo vulnerable to XSS in title field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-7168","CVE-2019-7169","CVE-2019-7170","CVE-2019-7171","CVE-2019-7173"],"affected":"composer/croogo/croogo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7171"},{"id":"INC-12329","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in PMD","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2019-7722"],"affected":"maven/net.sourceforge.pmd:pmd-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7722"},{"id":"INC-12330","date":"2022-05","year":2022,"title":"Cross-site Scripting in Jolokia agent","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000129","CVE-2018-1000130"],"affected":"maven/org.jolokia:jolokia-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000129"},{"id":"INC-12331","date":"2022-05","year":2022,"title":"Apache Solr Kerberos delegation token functionality flaws","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-9803"],"affected":"maven/org.apache.solr:solr-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-9803"},{"id":"INC-12332","date":"2022-05","year":2022,"title":"PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-6099"],"affected":"composer/paypal/merchant-sdk-php","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-6099"},{"id":"INC-12333","date":"2022-05","year":2022,"title":"Incorrect Privilege Assignment in RESTEasy","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-3490"],"affected":"maven/org.jboss.resteasy:resteasy-client, maven/org.jboss.resteasy:resteasy-client","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3490"},{"id":"INC-12334","date":"2022-05","year":2022,"title":"Donfig Command Injection in collect_yaml method","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-7537"],"affected":"pip/donfig","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7537"},{"id":"INC-12335","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Select2","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-10744"],"affected":"npm/select2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-10744"},{"id":"INC-12336","date":"2022-05","year":2022,"title":"Apache ActiveMQ Apollo XXE Vulnerability","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-3579","CVE-2014-3600","CVE-2014-8110"],"affected":"maven/org.apache.activemq:apollo-project","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3579"},{"id":"INC-12337","date":"2022-05","year":2022,"title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-5647","CVE-2017-5648"],"affected":"maven/org.apache.tomcat:tomcat, maven/org.apache.tomcat:tomcat, maven/org.apache.tomcat:tomcat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-5647"},{"id":"INC-12338","date":"2022-05","year":2022,"title":"jQuery vulnerable to Cross-Site Scripting (XSS)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-4408","CVE-2011-4969","CVE-2016-5005","CVE-2017-5657"],"affected":"maven/org.webjars.npm:jquery, rubygems/jquery-rails, nuget/jQuery","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4969"},{"id":"INC-12339","date":"2022-05","year":2022,"title":"Exposure of Sensitive Information to an Unauthorized Actor in Jenkins","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2017-1000393","CVE-2017-1000398","CVE-2018-1000169","CVE-2018-1000862","CVE-2018-1999046"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999046"},{"id":"INC-12340","date":"2022-05","year":2022,"title":"Mercurial missing symlink check","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-1000115"],"affected":"pip/mercurial","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000115"},{"id":"INC-12341","date":"2022-05","year":2022,"title":"RubyGems Deserialization of Untrusted Data vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000074"],"affected":"maven/org.jruby:jruby-stdlib, rubygems/rubygems-update","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000074"},{"id":"INC-12342","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache uimaj","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-15691"],"affected":"maven/org.apache.uima:uimaj-as-core, maven/org.apache.uima:uimaj-core, maven/org.apache.uima:uimaj-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-15691"},{"id":"INC-12343","date":"2022-05","year":2022,"title":"Puppet does not properly restrict access to node resources","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-0528"],"affected":"rubygems/puppet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-0528"},{"id":"INC-12344","date":"2022-05","year":2022,"title":"Puppet allows local users to modify the permissions of arbitrary files","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-3870"],"affected":"rubygems/puppet, rubygems/puppet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-3870"},{"id":"INC-12345","date":"2022-05","year":2022,"title":"Puppet Denial of Service and Arbitrary File Write","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-1987","CVE-2012-1988"],"affected":"rubygems/puppet, rubygems/puppet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-1987"},{"id":"INC-12346","date":"2022-05","year":2022,"title":"MAGMI plugin for Magento Unsafe File Upload","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-8770"],"affected":"composer/dweeves/magmi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-8770"},{"id":"INC-12347","date":"2022-05","year":2022,"title":"SimpleXML has XML External Entity (XXE) vulnerability","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-6429","CVE-2014-0054","CVE-2014-0107","CVE-2014-1904","CVE-2015-1832","CVE-2017-1000190"],"affected":"maven/org.simpleframework:simple-xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000190"},{"id":"INC-12348","date":"2022-05","year":2022,"title":"ClassLoader manipulation in Apache Struts","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-0116"],"affected":"maven/org.apache.struts:struts2-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-0116"},{"id":"INC-12349","date":"2022-05","year":2022,"title":"Prototype Pollution in sds","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25862"],"affected":"npm/sds","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25862"},{"id":"INC-12350","date":"2022-05","year":2022,"title":"SimpleSAMLphp Improper Verification of Cryptographic Signature","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-7644"],"affected":"composer/simplesamlphp/saml2, composer/simplesamlphp/saml2, composer/simplesamlphp/saml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7644"},{"id":"INC-12351","date":"2022-05","year":2022,"title":"Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2018-1999036"],"affected":"maven/org.jenkins-ci.plugins:ssh-agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1999036"},{"id":"INC-12352","date":"2022-05","year":2022,"title":"Phusion Passenger incorrect permission assignment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-12615"],"affected":"rubygems/passenger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-12615"},{"id":"INC-12353","date":"2022-05","year":2022,"title":"Improper Privilege Management in Jenkins","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000865","CVE-2018-1000866","CVE-2019-1003013","CVE-2019-1003015"],"affected":"maven/org.jenkins-ci.plugins:script-security","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000865"},{"id":"INC-12354","date":"2022-05","year":2022,"title":"LightSAML Incorrect Access Control vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2018-1000165"],"affected":"composer/lightsaml/lightsaml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000165"},{"id":"INC-12355","date":"2022-05","year":2022,"title":"Unsafe pyyaml load usage in PyAnyAPI","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-16616"],"affected":"pip/pyanyapi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-16616"},{"id":"INC-12356","date":"2022-05","year":2022,"title":"Openstack tripleo-heat-templates unauthenticated file access","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-12155"],"affected":"pip/tripleo-heat-templates","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-12155"},{"id":"INC-12357","date":"2022-05","year":2022,"title":"RubyGems vulnerable to Deserialization of Untrusted Data","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-0903"],"affected":"rubygems/rubygems-update","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-0903"},{"id":"INC-12358","date":"2022-05","year":2022,"title":"Keycloak Authentication Error","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-10894"],"affected":"maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-saml-adapter-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-10894"},{"id":"INC-12359","date":"2022-05","year":2022,"title":"Cloud Foundry UAA Privilege Escalation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-15761"],"affected":"maven/org.cloudfoundry.identity:cloudfoundry-identity-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-15761"},{"id":"INC-12360","date":"2022-05","year":2022,"title":"statics-server Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-3771"],"affected":"npm/statics-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-3771"},{"id":"INC-12361","date":"2022-05","year":2022,"title":"Nuclide Improper Input Validation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-6333"],"affected":"npm/nuclide","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-6333"},{"id":"INC-12362","date":"2022-05","year":2022,"title":"Phusion Passenger information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-16355"],"affected":"rubygems/passenger","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-16355"},{"id":"INC-12363","date":"2022-05","year":2022,"title":"Cross-site Scripting in Jenkins Build Failure Analyzer plugin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-4988"],"affected":"maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-4988"},{"id":"INC-12364","date":"2022-05","year":2022,"title":"Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2016-3101"],"affected":"maven/org.jenkins-ci.plugins:extra-columns","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-3101"},{"id":"INC-12365","date":"2022-05","year":2022,"title":"Piwik (now Matomo) Vulnerable to Cross-Site Scripting (XSS)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-1844"],"affected":"composer/piwik/piwik, composer/matomo/matomo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-1844"},{"id":"INC-12366","date":"2022-05","year":2022,"title":"PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-4744"],"affected":"composer/oliverklee/phpunit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4744"},{"id":"INC-12367","date":"2022-05","year":2022,"title":"Kallithea cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-1864"],"affected":"pip/Kallithea","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-1864"},{"id":"INC-12368","date":"2022-05","year":2022,"title":"golang.org/x/net/html Improper Validation of Array Index vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-17847","CVE-2018-17848"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17848"},{"id":"INC-12369","date":"2022-05","year":2022,"title":"MAGMI cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-2067","CVE-2015-2068"],"affected":"composer/dweeves/magmi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-2068"},{"id":"INC-12370","date":"2022-05","year":2022,"title":"Jenkins Crowd Integration Plugin stores credentials in plain text","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2019-1003053","CVE-2019-1003088","CVE-2019-1003089","CVE-2019-1003096","CVE-2019-1003097","CVE-2019-10277","CVE-2019-10280","CVE-2019-10294"],"affected":"maven/com.ds.tools.hudson:crowd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003097"},{"id":"INC-12371","date":"2022-05","year":2022,"title":"October CMS - RainLab Blog Plugin XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-7198"],"affected":"composer/rainlab/blog-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7198"},{"id":"INC-12372","date":"2022-05","year":2022,"title":"HashiCorp Consul vulnerable to Origin Validation Error","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-9764"],"affected":"go/github.com/hashicorp/consul","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-9764"},{"id":"INC-12373","date":"2022-05","year":2022,"title":"golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-17143"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17143"},{"id":"INC-12374","date":"2022-05","year":2022,"title":"golang.org/x/net/html NULL Pointer Dereference vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-17075","CVE-2018-17142"],"affected":"go/golang.org/x/net","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17142"},{"id":"INC-12375","date":"2022-05","year":2022,"title":"Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2019-1003035","CVE-2019-1003036","CVE-2019-1003037","CVE-2019-1003039"],"affected":"maven/org.jenkins-ci.plugins:appdynamics-dashboard","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003039"},{"id":"INC-12376","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache Batik","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-5662"],"affected":"maven/org.apache.xmlgraphics:batik","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-5662"},{"id":"INC-12377","date":"2022-05","year":2022,"title":"Silverstripe CMS XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8606"],"affected":"composer/silverstripe/cms, composer/silverstripe/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8606"},{"id":"INC-12378","date":"2022-05","year":2022,"title":"Symphony CMS XSS Vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-8766"],"affected":"composer/symphonycms/symphony-2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8766"},{"id":"INC-12379","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in LXML","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-19787"],"affected":"pip/lxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-19787"},{"id":"INC-12380","date":"2022-05","year":2022,"title":"phpCAS client library and Moodle Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1614","CVE-2010-1618","CVE-2010-1619"],"affected":"composer/moodle/moodle, composer/moodle/moodle, composer/apereo/phpcas","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-1618"},{"id":"INC-12381","date":"2022-05","year":2022,"title":"INTER-Mediator Cross-Site Scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-6484"],"affected":"composer/inter-mediator/inter-mediator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-6484"},{"id":"INC-12382","date":"2022-05","year":2022,"title":"Securimage HTML Injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-14077"],"affected":"composer/dapphp/securimage","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-14077"},{"id":"INC-12383","date":"2022-05","year":2022,"title":"Improper Neutralization of Input During Web Page Generation in Apache Sling","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2015-2944"],"affected":"maven/org.apache.sling:org.apache.sling.servlets.post, maven/org.apache.sling:org.apache.sling.api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-2944"},{"id":"INC-12384","date":"2022-05","year":2022,"title":"baserCMS Access Control Bypass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-5640"],"affected":"composer/baserproject/basercms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-5640"},{"id":"INC-12385","date":"2022-05","year":2022,"title":"Cloud Foundry UAA reset password vulnerable to brute force attack","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-3084"],"affected":"maven/org.cloudfoundry.identity:cloudfoundry-identity-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-3084"},{"id":"INC-12386","date":"2022-05","year":2022,"title":"Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-3189"],"affected":"maven/org.cloudfoundry.identity:cloudfoundry-identity-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-3189"},{"id":"INC-12387","date":"2022-05","year":2022,"title":"Pi Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2017-7251"],"affected":"composer/pi/pi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-7251"},{"id":"INC-12388","date":"2022-05","year":2022,"title":"Puppet Improper Access Control","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-2785"],"affected":"rubygems/puppet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-2785"},{"id":"INC-12389","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in python-docx","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-5851"],"affected":"pip/python-docx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-5851"},{"id":"INC-12390","date":"2022-05","year":2022,"title":"Inefficient Algorithmic Complexity in Apache Santuario XML Security","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-2172","CVE-2013-4517","CVE-2014-8152"],"affected":"maven/org.apache.santuario:xmlsec, maven/org.apache.santuario:xmlsec","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-2172"},{"id":"INC-12391","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Castor","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-3004"],"affected":"maven/castor:castor, maven/org.codehaus.castor:castor","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-3004"},{"id":"INC-12392","date":"2022-05","year":2022,"title":"Wizkunde SAMLBase SAML Bypass","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-5387"],"affected":"composer/gogentooss/samlbase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-5387"},{"id":"INC-12393","date":"2022-05","year":2022,"title":"Improper Restriction of XML External Entity Reference in Spring Framework","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-0225"],"affected":"maven/org.springframework:spring-webmvc, maven/org.springframework:spring-webmvc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-0225"},{"id":"INC-12394","date":"2022-05","year":2022,"title":"Cross-Site Request Forgery in Spring Framework","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4152"],"affected":"maven/org.springframework:spring-oxm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4152"},{"id":"INC-12395","date":"2022-05","year":2022,"title":"Missing XML Validation in Spring Framework","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-7315"],"affected":"maven/org.springframework:spring-oxm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7315"},{"id":"INC-12396","date":"2022-05","year":2022,"title":"XMLTooling Library Incorrectly Handles Some Exceptions","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-9628"],"affected":"maven/org.opensaml:xmltooling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-9628"},{"id":"INC-12397","date":"2022-05","year":2022,"title":"Incorrect Authorization in microweber","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-1631"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1631"},{"id":"INC-12398","date":"2022-05","year":2022,"title":"External Entity Reference in TwelveMonkeys ImageIO","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-23792"],"affected":"maven/com.twelvemonkeys.imageio:imageio-metadata","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-23792"},{"id":"INC-12399","date":"2022-05","year":2022,"title":"XML External Entity Reference in apache jena","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-28890"],"affected":"maven/org.apache.jena:jena","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28890"},{"id":"INC-12400","date":"2022-05","year":2022,"title":"Plone Zope cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-7062"],"affected":"pip/plone, pip/plone, pip/plone","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-7062"},{"id":"INC-12401","date":"2022-05","year":2022,"title":"Features file injection vulnerability","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-4318"],"affected":"rubygems/features","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-4318"},{"id":"INC-12402","date":"2022-05","year":2022,"title":"Microweber vulnerable to cross-site scripting (XSS)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1555"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1555"},{"id":"INC-12403","date":"2022-05","year":2022,"title":"Trytond allows modification of privileges of arbitrary users","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2012-0215"],"affected":"pip/trytond","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-0215"},{"id":"INC-12404","date":"2022-05","year":2022,"title":"Incorrect MAC key used in the RC4-MD5 ciphersuite","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-1434"],"affected":"rust/openssl-src","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1434"},{"id":"INC-12405","date":"2022-05","year":2022,"title":"Zope DocumentTemplate package allows unauthenticated write","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-0483"],"affected":"pip/zope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-0483"},{"id":"INC-12406","date":"2022-05","year":2022,"title":"Prototype Pollution in Dexie","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21189"],"affected":"npm/dexie, npm/dexie","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21189"},{"id":"INC-12407","date":"2022-05","year":2022,"title":"Denial of service vulnerability exists in libxmljs","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21144"],"affected":"npm/libxmljs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21144"},{"id":"INC-12408","date":"2022-05","year":2022,"title":"Path Traversal in com.alibaba.oneagent:one-java-agent-plugin","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-25842"],"affected":"maven/com.alibaba.oneagent:one-java-agent-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25842"},{"id":"INC-12409","date":"2022-05","year":2022,"title":"Commerce extension for TYPO3 vulnerable to Cross-site Scripting","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-4963"],"affected":"composer/commerceteam/commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-4963"},{"id":"INC-12410","date":"2022-05","year":2022,"title":"Improper input validation in Mort Bay Jetty","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-5613","CVE-2007-5614","CVE-2009-4611"],"affected":"maven/org.mortbay.jetty:jetty, maven/org.mortbay.jetty:jetty","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-4611"},{"id":"INC-12411","date":"2022-05","year":2022,"title":"TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-4159"],"affected":"composer/directmailteam/direct-mail","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-4159"},{"id":"INC-12412","date":"2022-05","year":2022,"title":"Apache Solr Search for TYPO3 vulnerable to Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-3821"],"affected":"composer/apache-solr-for-typo3/solr","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-3821"},{"id":"INC-12413","date":"2022-05","year":2022,"title":"Buildbot vulnerable to cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-2959","CVE-2009-2967"],"affected":"pip/buildbot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-2967"},{"id":"INC-12414","date":"2022-05","year":2022,"title":"Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-0038"],"affected":"maven/org.apache.geronimo.plugins:console","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-0038"},{"id":"INC-12415","date":"2022-05","year":2022,"title":"Apache Jackrabbit contains Cross-site Scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-0026"],"affected":"maven/org.apache.jackrabbit:jackrabbit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-0026"},{"id":"INC-12416","date":"2022-05","year":2022,"title":"Plone Cross-site Scripting vulnerability in the LiveSearch module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-4571"],"affected":"pip/Plone","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-4571"},{"id":"INC-12417","date":"2022-05","year":2022,"title":"phpMyAdmin extension for TYPO3 has Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-3032"],"affected":"composer/mehrwert/phpmyadmin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-3032"},{"id":"INC-12418","date":"2022-05","year":2022,"title":"Mercurial Directory traversal vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-2942"],"affected":"pip/mercurial","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-2942"},{"id":"INC-12419","date":"2022-05","year":2022,"title":"Django Cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-2302"],"affected":"pip/django, pip/django, pip/django","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-2302"},{"id":"INC-14630","date":"2022-05","year":2022,"title":"Apache Struts Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-2025"],"affected":"maven/struts:struts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-2025"},{"id":"INC-12420","date":"2022-05","year":2022,"title":"Alkacon OpenCMS XSS via searchfilter parameter in system/workplace/admin/workplace/sessions.jsp","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-1753"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1753"},{"id":"INC-12421","date":"2022-05","year":2022,"title":"Alkacon OpenCMS XSS via searchfilter or listSearchFilter parameter","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-1045","CVE-2008-1510"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1510"},{"id":"INC-12422","date":"2022-05","year":2022,"title":"Moodle vulnerable to Cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-1502"],"affected":"composer/moodle/moodle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1502"},{"id":"INC-12423","date":"2022-05","year":2022,"title":"Alkacon Open CMS XSS via Logfile Viewer Settings function","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-1300"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1300"},{"id":"INC-12424","date":"2022-05","year":2022,"title":"Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-1285"],"affected":"maven/com.sun.faces:jsf-api","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1285"},{"id":"INC-12425","date":"2022-05","year":2022,"title":"MoinMoin Multiple cross-site scripting (XSS) vulnerabilities","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-0857","CVE-2008-1098"],"affected":"pip/moin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-1098"},{"id":"INC-12426","date":"2022-05","year":2022,"title":"Apache Struts Dojo Plugin XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-6726"],"affected":"maven/org.apache.struts:struts2-dojo-plugin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-6726"},{"id":"INC-12427","date":"2022-05","year":2022,"title":"HTML Purifier Cross-site Scripting vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-3498"],"affected":"composer/ezyang/htmlpurifier","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-3498"},{"id":"INC-12428","date":"2022-05","year":2022,"title":"Apache Tomcat's CookieExample Vulnerable to XSS","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-3384"],"affected":"maven/org.apache.tomcat:tomcat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-3384"},{"id":"INC-12429","date":"2022-05","year":2022,"title":"MoinMoin Cross-Site Scripting (XSS) vulnerability via hitcounts and general parameters","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-0901"],"affected":"pip/Moin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-0901"},{"id":"INC-12430","date":"2022-05","year":2022,"title":"XWiki Remote Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-7223"],"affected":"maven/org.xwiki.platform:xwiki-platform-oldcore","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-7223"},{"id":"INC-12431","date":"2022-05","year":2022,"title":"Apache Tomcat XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-7195"],"affected":"maven/org.apache.tomcat:tomcat, maven/org.apache.tomcat:tomcat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-7195"},{"id":"INC-12432","date":"2022-05","year":2022,"title":"Cross-site scripting (XSS) vulnerability in CakePHP","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-4067"],"affected":"composer/cakephp/cakephp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-4067"},{"id":"INC-12433","date":"2022-05","year":2022,"title":"Alkacon OpenCms XSS via unsanitized message body","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-3933"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-3933"},{"id":"INC-12434","date":"2022-05","year":2022,"title":"Alkacon OpenCms XSS via query parameter in a search action","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-2571"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-2571"},{"id":"INC-12435","date":"2022-05","year":2022,"title":"Plone allows remote users to modify arbitrary portraits","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2006-1711"],"affected":"pip/plone, pip/plone, pip/plone","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-1711"},{"id":"INC-14631","date":"2022-05","year":2022,"title":"Apache Geronimo console 1.0 vulnerable to cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-0254"],"affected":"maven/geronimo:geronimo-console-standard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-0254"},{"id":"INC-12436","date":"2022-05","year":2022,"title":"Trac HTML WikiProcessor cross-site scripting (XSS) vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2005-4644"],"affected":"pip/trac","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2005-4644"},{"id":"INC-12437","date":"2022-05","year":2022,"title":"Alkacon OpenCms XSS via username during login","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2005-4294"],"affected":"maven/org.opencms:opencms-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2005-4294"},{"id":"INC-12438","date":"2022-05","year":2022,"title":"Apache Struts Cross-site scripting Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2005-3745"],"affected":"maven/org.apache.struts:struts-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2005-3745"},{"id":"INC-12440","date":"2022-04","year":2022,"title":"Jetty Javascript Inclusion Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2002-1533"],"affected":"maven/org.mortbay.jetty:jetty","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2002-1533"},{"id":"INC-12441","date":"2022-04","year":2022,"title":"Zope does not properly perform security registration for legacy names","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-1211"],"affected":"pip/zope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-1211"},{"id":"INC-12442","date":"2022-04","year":2022,"title":"Zope allows attackers to modify raw image and file data","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-1212"],"affected":"pip/zope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-1212"},{"id":"INC-12443","date":"2022-04","year":2022,"title":"Zope does not properly restrict access to the getRoles method","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-0725"],"affected":"pip/zope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-0725"},{"id":"INC-12444","date":"2022-04","year":2022,"title":"Zope DTML implementation Improper Authentication","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-0062"],"affected":"pip/zope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-0062"},{"id":"INC-12445","date":"2022-04","year":2022,"title":"Tomcat uses trusted privileges when processing web.xml file","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2003-0043"],"affected":"maven/org.apache.tomcat:tomcat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2003-0043"},{"id":"INC-12446","date":"2022-04","year":2022,"title":"Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24898"],"affected":"maven/org.xwiki.commons:xwiki-commons-xml, maven/org.xwiki.commons:xwiki-commons-xml,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24898"},{"id":"INC-12447","date":"2022-04","year":2022,"title":"OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29546"],"affected":"maven/net.sourceforge.htmlunit:neko-htmlunit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29546"},{"id":"INC-12448","date":"2022-04","year":2022,"title":"Liferay Portal and Liferay DXP allows arbitrary injection via the site name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-26597"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.layout.seo.web","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26597"},{"id":"INC-12449","date":"2022-04","year":2022,"title":"Cross-site Scripting in OWASP AntiSamy","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-28366","CVE-2022-28367"],"affected":"maven/org.owasp.antisamy:antisamy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28367"},{"id":"INC-12450","date":"2022-04","year":2022,"title":"Cross Site Request Forgery in Mingsoft MCMS","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-27340"],"affected":"maven/net.mingsoft:ms-mcms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-27340"},{"id":"INC-12451","date":"2022-04","year":2022,"title":"Improper Authentication in django-mfa3","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24857"],"affected":"pip/django-mfa3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24857"},{"id":"INC-12452","date":"2022-04","year":2022,"title":"SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/xml2rfc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-cf4q-4cqr-7g7w"},{"id":"INC-12453","date":"2022-04","year":2022,"title":"Typo3 XSS in RemoveXSS function","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-4630","CVE-2011-4632","CVE-2011-4903"],"affected":"composer/typo3/cms, composer/typo3/cms, composer/typo3/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4903"},{"id":"INC-12454","date":"2022-04","year":2022,"title":"simpleSAMLphp incorrectly handles XML encryption","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-4625"],"affected":"composer/simplesamlphp/simplesamlphp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-4625"},{"id":"INC-12455","date":"2022-04","year":2022,"title":"XML External Entity Reference in detekt","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0272"],"affected":"maven/io.gitlab.arturbosch.detekt:detekt-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0272"},{"id":"INC-12456","date":"2022-04","year":2022,"title":"Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-26593"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.asset.taglib","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26593"},{"id":"INC-12457","date":"2022-04","year":2022,"title":"Cross site scripting in safe-svg","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1091"],"affected":"composer/darylldoyle/safe-svg","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1091"},{"id":"INC-12458","date":"2022-04","year":2022,"title":"Liferay Portal and Liferay DXP allows arbitrary injection via form field","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-26594"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay:com.liferay.dynamic.data.mapping.form.field.type","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26594"},{"id":"INC-12459","date":"2022-04","year":2022,"title":"HTML Injection in Froxlor","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-29653"],"affected":"composer/froxlor/froxlor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-29653"},{"id":"INC-12460","date":"2022-04","year":2022,"title":"Prototype Pollution in nconf","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21803"],"affected":"npm/nconf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21803"},{"id":"INC-12461","date":"2022-04","year":2022,"title":"Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-29047","CVE-2022-29052"],"affected":"maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, maven/org.jenkins-ci.plugins.workflow:workflow-cps-globa…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-29047"},{"id":"INC-12462","date":"2022-04","year":2022,"title":"Inline DTD allows XML bomb attack","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-15160"],"affected":"erlang/sweet_xml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-15160"},{"id":"INC-12463","date":"2022-04","year":2022,"title":"Persistent Cross-site Scripting vulnerability in PrivateBin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-24833"],"affected":"composer/privatebin/privatebin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24833"},{"id":"INC-12464","date":"2022-04","year":2022,"title":"Improper Neutralization of Formula Elements in a CSV File in Kimai 2","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-43515"],"affected":"composer/kevinpapst/kimai2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43515"},{"id":"INC-12465","date":"2022-04","year":2022,"title":"Incorrect protocol extraction via \\r, \\n and \\t characters","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-1243"],"affected":"npm/urijs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-1243"},{"id":"INC-12466","date":"2022-04","year":2022,"title":"SQL injection in ImpressCMS","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-26986"],"affected":"composer/impresscms/impresscms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26986"},{"id":"INC-12467","date":"2022-04","year":2022,"title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24814"],"affected":"npm/directus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24814"},{"id":"INC-12468","date":"2022-04","year":2022,"title":"Opened exploitable ports in default docker-compose.yaml in go-ipfs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/ipfs/go-ipfs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fx5p-f64h-93xc"},{"id":"INC-12469","date":"2022-04","year":2022,"title":"Remote code injection in dompdf/dompdf","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-28368"],"affected":"composer/dompdf/dompdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28368"},{"id":"INC-12470","date":"2022-04","year":2022,"title":"Automatic named constructor discovery in Valinor","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"composer/cuyz/valinor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-xhr8-mpwq-2rr2"},{"id":"INC-12471","date":"2022-04","year":2022,"title":"Improper Restriction of XML External Entity Reference in wutka jox","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-43142"],"affected":"maven/com.wutka:jox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43142"},{"id":"INC-05074","date":"2022-03","year":2022,"title":"Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0845"],"affected":"lightningai/pytorch_lightning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0845"},{"id":"INC-14632","date":"2022-03","year":2022,"title":"The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-45117"],"affected":"opcfoundation/ua-nodeset, siemens/simatic_net_pc, siemens/sitop_manager, siemens/telecontrol_server_basic","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-45117"},{"id":"INC-05163","date":"2022-03","year":2022,"title":"Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a u...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0427"],"affected":"gitlab/gitlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0427"},{"id":"INC-12472","date":"2022-03","year":2022,"title":"Cross-site Scripting in Parsedown","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-1000162"],"affected":"composer/erusev/parsedown","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000162"},{"id":"INC-12473","date":"2022-03","year":2022,"title":"XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-28140","CVE-2022-28141","CVE-2022-28154","CVE-2022-28155","CVE-2022-28156"],"affected":"maven/com.surenpi.jenkins:phoenix-autotest","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-28155"},{"id":"INC-12474","date":"2022-03","year":2022,"title":"Parsedown Class-Name Injection","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10905"],"affected":"composer/erusev/parsedown","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10905"},{"id":"INC-12475","date":"2022-03","year":2022,"title":"Improper Restriction of XML External Entity Reference in soa-model","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-43090"],"affected":"maven/com.predic8:soa-model-core, maven/com.predic8:soa-model-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43090"},{"id":"INC-12476","date":"2022-03","year":2022,"title":"Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-24730"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24730"},{"id":"INC-12477","date":"2022-03","year":2022,"title":"Code injection in Apache Dubbo","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-30180"],"affected":"maven/org.apache.dubbo:dubbo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-30180"},{"id":"INC-12478","date":"2022-03","year":2022,"title":"XML external entity (XXE) attacks in Jenkins Xcode integration Plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-21656"],"affected":"maven/org.jenkins-ci.plugins:xcode-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21656"},{"id":"INC-12479","date":"2022-03","year":2022,"title":"XML external entity (XXE) injection in Apache Nutch","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-23901"],"affected":"maven/org.apache.nutch:nutch","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-23901"},{"id":"INC-12480","date":"2022-03","year":2022,"title":"Prototype Pollution in bodymen","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25296"],"affected":"npm/bodymen","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25296"},{"id":"INC-12481","date":"2022-03","year":2022,"title":"Sandbox escape in notevil and argencoders-notevil","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-23771"],"affected":"npm/argencoders-notevil, npm/notevil","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-23771"},{"id":"INC-12482","date":"2022-03","year":2022,"title":"Cross-site Scripting in CKEditor4","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24728"],"affected":"npm/ckeditor4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24728"},{"id":"INC-12483","date":"2022-03","year":2022,"title":"XML External Entities Vulnerability in CVRF-CSAF-Converter","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-27193"],"affected":"pip/cvrf2csaf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-27193"},{"id":"INC-12484","date":"2022-03","year":2022,"title":"Denial of service in microweber","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0961"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0961"},{"id":"INC-12485","date":"2022-03","year":2022,"title":"Unrestricted XML files leading to cross-site scripting in Microweber","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-0963"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0963"},{"id":"INC-12486","date":"2022-03","year":2022,"title":"Integer Overflow in microweber","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0968"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0968"},{"id":"INC-12487","date":"2022-03","year":2022,"title":"Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-27201","CVE-2022-27217","CVE-2022-27218"],"affected":"maven/org.jenkins-ci.plugins:semantic-versioning-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-27201"},{"id":"INC-12488","date":"2022-03","year":2022,"title":"Improper Authorization in org.cometd.oort","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24721"],"affected":"maven/org.cometd.java:cometd-java-oort, maven/org.cometd.java:cometd-java-oort, maven/org.cometd.java:cometd-java-oort","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24721"},{"id":"INC-12489","date":"2022-03","year":2022,"title":"Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-24749"],"affected":"composer/Sylius/Sylius, composer/Sylius/Sylius, composer/Sylius/Sylius","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24749"},{"id":"INC-12490","date":"2022-03","year":2022,"title":"Cross-site Scripting in microweber","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-0928"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0928"},{"id":"INC-12491","date":"2022-03","year":2022,"title":"Static Code Injection in Microweber","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0895"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0895"},{"id":"INC-12492","date":"2022-03","year":2022,"title":"XML Entity Expansion in trytond and proteus","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-26661","CVE-2022-26662"],"affected":"pip/proteus, pip/proteus, pip/proteus","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-26662"},{"id":"INC-12493","date":"2022-03","year":2022,"title":"Incorrect Authentication in shopware","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24748"],"affected":"composer/shopware/core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24748"},{"id":"INC-12494","date":"2022-03","year":2022,"title":"HTML injection possibility in voucher code form in Shopware","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-24746"],"affected":"composer/shopware/storefront, composer/shopware/core, composer/shopware/platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24746"},{"id":"INC-12495","date":"2022-03","year":2022,"title":"Server-Side Request Forgery and Open Redirect in AllTube Download","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-24739"],"affected":"composer/rudloff/alltube","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24739"},{"id":"INC-12496","date":"2022-03","year":2022,"title":"Improper Restriction of XML External Entity Reference in Any23","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-25312"],"affected":"maven/org.apache.any23:apache-any23","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25312"},{"id":"INC-12497","date":"2022-03","year":2022,"title":"Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-38267"],"affected":"maven/com.liferay:com.liferay.frontend.js.web, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-38267"},{"id":"INC-12498","date":"2022-03","year":2022,"title":"Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-38269"],"affected":"maven/com.liferay.portal:release.dxp.bom, maven/com.liferay.portal:release.dxp.bom,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-38269"},{"id":"INC-12499","date":"2022-03","year":2022,"title":"XML External Entity Reference in Hazelcast","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0265"],"affected":"maven/com.hazelcast:hazelcast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0265"},{"id":"INC-12500","date":"2022-03","year":2022,"title":"Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23640"],"affected":"maven/com.monitorjbl:xlsx-streamer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23640"},{"id":"INC-12501","date":"2022-03","year":2022,"title":"Cross site scripting in reveal.js","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0776"],"affected":"npm/reveal.js","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0776"},{"id":"INC-05012","date":"2022-02","year":2022,"title":"A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-21960"],"affected":"sealevel/seaconnect_370w_firmware, sealevel/seaconnect_370w","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-21960"},{"id":"INC-05261","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21726)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21726"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21726"},{"id":"INC-05262","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21727)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21727","CVE-2022-21728"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21727"},{"id":"INC-05264","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21730)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21730"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21730"},{"id":"INC-05206","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-21731)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21731"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21731"},{"id":"INC-05207","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-21732)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21732"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21732"},{"id":"INC-05208","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-21733)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21733"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21733"},{"id":"INC-05267","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21736)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21736"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21736"},{"id":"INC-05212","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23568)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23568"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23568"},{"id":"INC-05260","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21725)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21725"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21725"},{"id":"INC-05263","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21729)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21729"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21729"},{"id":"INC-05265","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21734)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21734"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21734"},{"id":"INC-05266","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21735)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21735"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21735"},{"id":"INC-05209","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-21737)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21737"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21737"},{"id":"INC-05268","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21738)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21738","CVE-2022-21740"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21738"},{"id":"INC-05269","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21739)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21739"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21739"},{"id":"INC-05270","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-21741)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21741"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21741"},{"id":"INC-05271","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23557)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23557"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23557"},{"id":"INC-05272","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23558)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23558"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23558"},{"id":"INC-05273","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23559)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23559"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23559"},{"id":"INC-05274","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23560)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23560"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23560"},{"id":"INC-05275","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23561)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23561"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23561"},{"id":"INC-05276","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23562)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41195","CVE-2022-23562"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23562"},{"id":"INC-05210","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23564)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23564"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23564"},{"id":"INC-05211","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23565)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23565"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23565"},{"id":"INC-05278","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23566)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23566"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23566"},{"id":"INC-05279","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23570)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23570","CVE-2022-23574"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23570"},{"id":"INC-05213","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23571)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23571"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23571"},{"id":"INC-05280","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23572)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23572","CVE-2022-23580"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23572"},{"id":"INC-05281","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23573)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23573"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23573"},{"id":"INC-05282","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23575)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23575","CVE-2022-23576","CVE-2022-23587"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23575"},{"id":"INC-05283","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23577)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23577"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23577"},{"id":"INC-05284","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23578)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23578"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23578"},{"id":"INC-05214","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23579)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23579"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23579"},{"id":"INC-05215","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23581)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23581","CVE-2022-23588","CVE-2022-23589"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23581"},{"id":"INC-05216","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23582)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23582"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23582"},{"id":"INC-05217","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23583)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23583"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23583"},{"id":"INC-05285","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23584)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23584","CVE-2022-23585"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23584"},{"id":"INC-05218","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23586)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23586"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23586"},{"id":"INC-05286","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23590)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23590","CVE-2022-23592"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23590"},{"id":"INC-05287","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23591)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23591"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23591"},{"id":"INC-05219","date":"2022-02","year":2022,"title":"Tensorflow — Dos (CVE-2022-23593)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23593"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23593"},{"id":"INC-05289","date":"2022-02","year":2022,"title":"Tensorflow — Vulnerability (CVE-2022-23595)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23595"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23595"},{"id":"INC-12502","date":"2022-02","year":2022,"title":"jQuery-Upload-File XSS in fileNameStr","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-37504"],"affected":"npm/jquery-file-upload","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37504"},{"id":"INC-12503","date":"2022-02","year":2022,"title":"Vulnerable dependencies in Nokogiri","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"rubygems/nokogiri","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-fq42-c5rg-92c2"},{"id":"INC-12504","date":"2022-02","year":2022,"title":"Authenticated remote code execution in October CMS","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-21705"],"affected":"composer/october/system, composer/october/system, composer/october/system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21705"},{"id":"INC-12505","date":"2022-02","year":2022,"title":"Cross-site Scripting in Prism","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23647"],"affected":"npm/prismjs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23647"},{"id":"INC-12506","date":"2022-02","year":2022,"title":"Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-0671"],"affected":"maven/org.eclipse.lemminx:lemminx-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0671"},{"id":"INC-12507","date":"2022-02","year":2022,"title":"Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-25186","CVE-2022-25191","CVE-2022-25197","CVE-2022-25204","CVE-2022-25207","CVE-2022-25208","CVE-2022-25209"],"affected":"maven/com.datapipe.jenkins.plugins:hashicorp-vault-plugin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-25186"},{"id":"INC-12508","date":"2022-02","year":2022,"title":"Arbitrary file deletion in NeMo ASR webapp","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-22821"],"affected":"pip/nemo_toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-rpx7-33j2-xx9x"},{"id":"INC-12509","date":"2022-02","year":2022,"title":"Access Restriction Bypass in Docker","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-6408"],"affected":"go/github.com/docker/docker","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-6408"},{"id":"INC-12510","date":"2022-02","year":2022,"title":"Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-2023"],"affected":"go/github.com/kata-containers/runtime, go/github.com/kata-containers/runtime, go/github.com/kata-containers/runtime","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-2023"},{"id":"INC-12511","date":"2022-02","year":2022,"title":"Denial of Service (DoS) in HashiCorp Consul","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-12758"],"affected":"go/github.com/hashicorp/consul, go/github.com/hashicorp/consul","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-12758"},{"id":"INC-12512","date":"2022-02","year":2022,"title":"Directory traversal in Kubernetes Secrets Store CSI Driver","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2020-8568"],"affected":"go/sigs.k8s.io/secrets-store-csi-driver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-8568"},{"id":"INC-12513","date":"2022-02","year":2022,"title":"Denial of service in github.com/nats-io/nats-server/server","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-28466"],"affected":"go/github.com/nats-io/nats-server/v2, go/github.com/nats-io/nats-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-28466"},{"id":"INC-12514","date":"2022-02","year":2022,"title":"Improper input validation in umoci","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29136"],"affected":"go/github.com/opencontainers/umoci","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29136"},{"id":"INC-12515","date":"2022-02","year":2022,"title":"Cross-site Scripting in enshrined/svg-sanitize","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23638"],"affected":"composer/enshrined/svg-sanitize","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23638"},{"id":"INC-12516","date":"2022-02","year":2022,"title":"OS Command Injection in Microweber","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-0557"],"affected":"composer/microweber/microweber","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0557"},{"id":"INC-12517","date":"2022-02","year":2022,"title":"Deserialization of Untrusted Data in Magnolia CMS","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-46364","CVE-2021-46365"],"affected":"maven/info.magnolia:magnolia-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-46364"},{"id":"INC-12518","date":"2022-02","year":2022,"title":"SAML authentication vulnerability due to stdlib XML parsing","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26276"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26276"},{"id":"INC-12519","date":"2022-02","year":2022,"title":"Authentication Bypass in github.com/russellhaering/gosaml2","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2020-29509"],"affected":"go/github.com/russellhaering/gosaml2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-29509"},{"id":"INC-12520","date":"2022-02","year":2022,"title":"DOM-based cross-site scripting in Froala Editor","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-19935"],"affected":"npm/froala-editor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-19935"},{"id":"INC-12521","date":"2022-02","year":2022,"title":"Injection in Apache Archiva","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-9495"],"affected":"maven/org.apache.archiva:archiva","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-9495"},{"id":"INC-12522","date":"2022-02","year":2022,"title":"Improper Authentication in Apache Spark","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2020-9480"],"affected":"pip/pyspark, maven/org.apache.spark:spark-parent_2.11","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-9480"},{"id":"INC-12523","date":"2022-02","year":2022,"title":"Cross-site scripting in json-sanitizer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-13973"],"affected":"maven/com.mikesamuel:json-sanitizer","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13973"},{"id":"INC-12524","date":"2022-02","year":2022,"title":"Deserialization of Untrusted Data in Apache ShardingSphere","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-1947"],"affected":"maven/org.apache.shardingsphere:shardingsphere","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-1947"},{"id":"INC-12525","date":"2022-02","year":2022,"title":"Cross-site scripting in @atlaskit/editor-core","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-20903"],"affected":"npm/@atlaskit/editor-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-20903"},{"id":"INC-12526","date":"2022-02","year":2022,"title":"Improper Restriction of XML External Entity Reference","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-13692"],"affected":"maven/org.postgresql:postgresql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13692"},{"id":"INC-12527","date":"2022-02","year":2022,"title":"DoS vulnerability in bundled XStream library in Jenkins Core","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-43859","CVE-2022-0538"],"affected":"maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0538"},{"id":"INC-12528","date":"2022-02","year":2022,"title":"Prototype Pollution in undefsafe","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10795"],"affected":"npm/undefsafe","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10795"},{"id":"INC-12529","date":"2022-02","year":2022,"title":"Prototype Pollution in dot-object","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10793"],"affected":"npm/dot-object","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10793"},{"id":"INC-12530","date":"2022-02","year":2022,"title":"Incorrect Calculation in github.com/open-policy-agent/opa","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23628"],"affected":"go/github.com/open-policy-agent/opa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23628"},{"id":"INC-12531","date":"2022-02","year":2022,"title":"Path traversal in xwiki-platform-skin-skinx","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23620"],"affected":"maven/org.xwiki.platform:xwiki-platform-skin-skinx","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23620"},{"id":"INC-12532","date":"2022-02","year":2022,"title":"Remote code execution in xwiki-platform","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23616"],"affected":"maven/org.xwiki.platform:xwiki-platform-administration-ui","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23616"},{"id":"INC-12533","date":"2022-02","year":2022,"title":"OCI Manifest Type Confusion Issue","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/docker/distribution","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-qq97-vm5h-rrhg"},{"id":"INC-12534","date":"2022-02","year":2022,"title":"Incorrect Authorization in NATS nats-server","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2022-24450"],"affected":"go/github.com/nats-io/nats-server/v2, go/github.com/nats-io/nats-streaming-server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24450"},{"id":"INC-12535","date":"2022-02","year":2022,"title":"Validation bypass in frourio-express","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23624"],"affected":"npm/frourio-express","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23624"},{"id":"INC-12536","date":"2022-02","year":2022,"title":"Validation bypass in frourio","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23623"],"affected":"npm/frourio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23623"},{"id":"INC-12537","date":"2022-02","year":2022,"title":"Cookie and header exposure in twisted","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-21712"],"affected":"pip/Twisted","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21712"},{"id":"INC-12538","date":"2022-02","year":2022,"title":"Limited ability to spoof SAML authentication with missing audience verification in Fleet","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-23600"],"affected":"go/github.com/fleetdm/fleet/v4","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23600"},{"id":"INC-12539","date":"2022-02","year":2022,"title":"Path traversal and dereference of symlinks in Argo CD","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-24348"],"affected":"go/github.com/argoproj/argo-cd, go/github.com/argoproj/argo-cd/v2, go/github.com/argoproj/argo-cd/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-24348"},{"id":"INC-12540","date":"2022-02","year":2022,"title":"Cross-Site Request Forgery in Filebrowser","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-46398"],"affected":"go/github.com/filebrowser/filebrowser/v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-46398"},{"id":"INC-14633","date":"2022-02","year":2022,"title":"RosarioSIS XSS Vulnerability","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-45416"],"affected":"composer/francoisjacquet/rosariosis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-45416"},{"id":"INC-12541","date":"2022-02","year":2022,"title":"Neo4j Graph Database vulnerable to Path Traversal","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-42767"],"affected":"maven/org.neo4j.procedure:apoc, maven/org.neo4j.procedure:apoc, maven/org.neo4j.procedure:apoc","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-42767"},{"id":"INC-05135","date":"2022-01","year":2022,"title":"Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electro...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-30348"],"affected":"qualcomm/pq8009_firmware, qualcomm/pq8009, qualcomm/apq8017_firmware, qualcomm/apq8017","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-30348"},{"id":"INC-12542","date":"2022-01","year":2022,"title":"Cross-site Scripting when rendering error messages in laminas-form","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23598"],"affected":"composer/laminas/laminas-form, composer/laminas/laminas-form, composer/laminas/laminas-form","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23598"},{"id":"INC-12543","date":"2022-01","year":2022,"title":"Cross-site Scripting in phpmyadmin","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-23808"],"affected":"composer/phpmyadmin/phpmyadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-23808"},{"id":"INC-12544","date":"2022-01","year":2022,"title":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0239"],"affected":"maven/edu.stanford.nlp:stanford-corenlp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0239"},{"id":"INC-12545","date":"2022-01","year":2022,"title":"Cross-site Scripting in Ericsson CodeChecker","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-44217"],"affected":"pip/codechecker","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-44217"},{"id":"INC-12546","date":"2022-01","year":2022,"title":"Cross-site Scripting in HTML2PDF","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-45394"],"affected":"composer/spipu/html2pdf","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-45394"},{"id":"INC-12547","date":"2022-01","year":2022,"title":"Security Advisory for \"Log4Shell\"","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"maven/com.hazelcast:hazelcast, maven/com.hazelcast:hazelcast, maven/com.hazelcast:hazelcast","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-v57x-gxfj-484q"},{"id":"INC-12548","date":"2022-01","year":2022,"title":"OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-21690","CVE-2022-21692"],"affected":"pip/onionshare-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21690"},{"id":"INC-12549","date":"2022-01","year":2022,"title":"Improper Restriction of XML External Entity Reference in skylot/jadx","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0219"],"affected":"maven/io.github.skylot:jadx-core","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0219"},{"id":"INC-12550","date":"2022-01","year":2022,"title":"October/System authenticated file write leads to remote code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-32649"],"affected":"composer/october/system, composer/october/system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32649"},{"id":"INC-12551","date":"2022-01","year":2022,"title":"XML External Entity Reference in edu.stanford.nlp:stanford-corenlp","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-0198"],"affected":"maven/edu.stanford.nlp:stanford-corenlp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-0198"},{"id":"INC-12552","date":"2022-01","year":2022,"title":"Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"go/github.com/spiffe/spire, go/github.com/spiffe/spire","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-m7vp-hqwv-7m5x"},{"id":"INC-12553","date":"2022-01","year":2022,"title":"Pipenv's requirements.txt parsing allows malicious index url in comments","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2022-21668"],"affected":"pip/pipenv","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-21668"},{"id":"INC-12554","date":"2022-01","year":2022,"title":"Cross-site Scripting in Scratch-Svg-Renderer","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-27428"],"affected":"npm/scratch-svg-renderer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-27428"},{"id":"INC-12555","date":"2022-01","year":2022,"title":"jquery.terminal self XSS on user input","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-43862"],"affected":"npm/jquery.terminal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43862"},{"id":"INC-12556","date":"2022-01","year":2022,"title":"Improper Restriction of XML External Entity Reference in Apache NiFi","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-13940"],"affected":"maven/org.apache.nifi:nifi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13940"},{"id":"INC-12557","date":"2022-01","year":2022,"title":"Sandbox Bypass in Apache Velocity Engine","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-13936"],"affected":"maven/org.apache.velocity:velocity, maven/org.apache.velocity:velocity-engine-parent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-13936"},{"id":"INC-12558","date":"2022-01","year":2022,"title":"Deserialization of Untrusted Data in Apache Heron","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-1964"],"affected":"maven/org.apache.heron:heron-simulator","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-1964"},{"id":"INC-12559","date":"2022-01","year":2022,"title":"CSRF forgery protection bypass in solidus_frontend","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2021-43846"],"affected":"rubygems/solidus_frontend, rubygems/solidus_frontend, rubygems/solidus_frontend","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43846"},{"id":"INC-12560","date":"2022-01","year":2022,"title":"Improper Input Validation and Injection in Apache Log4j2","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-44832"],"affected":"maven/org.ops4j.pax.logging:pax-logging-log4j2, maven/org.ops4j.pax.logging:pax-logging-log4j2,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-44832"},{"id":"INC-12561","date":"2022-01","year":2022,"title":"Cross site scripting in dolibarr","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-22293"],"affected":"composer/dolibarr/dolibarr","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2022-22293"},{"id":"INC-05855","date":"2021-12","year":2021,"title":"Sockeye — Deserialization (CVE-2021-43811)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-43811"],"affected":"amazon/sockeye","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43811"},{"id":"INC-05810","date":"2021-12","year":2021,"title":"pytorch-lightning is vulnerable to Deserialization of Untrusted Data","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-4118"],"affected":"lightningai/pytorch_lightning","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-4118"},{"id":"INC-12562","date":"2021-12","year":2021,"title":"Open redirect vulnerability in Sourcegraph","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-12283"],"affected":"go/github.com/sourcegraph/sourcegraph, go/github.com/sourcegraph/sourcegraph","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-12283"},{"id":"INC-12563","date":"2021-12","year":2021,"title":"Open Redirect in OAuth2 Proxy","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-11053"],"affected":"go/github.com/oauth2-proxy/oauth2-proxy","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-11053"},{"id":"INC-14207","date":"2021-12","year":2021,"title":"Excessive Platform Resource Consumption within a Loop in Kubernetes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-11254"],"affected":"go/github.com/go-yaml/yaml, go/gopkg.in/yaml.v2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254"},{"id":"INC-14208","date":"2021-12","year":2021,"title":"vault-cli contains possible RCE when reading user-defined data","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2021-43837"],"affected":"pip/vault-cli","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43837"},{"id":"INC-14209","date":"2021-12","year":2021,"title":"Vulnerable dependency in XTDB connector","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"maven/org.odpi.egeria:egeria-connector-xtdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-hwvm-vfw8-93mw"},{"id":"INC-14210","date":"2021-12","year":2021,"title":"Improper Restriction of XML External Entity Reference in com.h2database:h2.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-23463"],"affected":"maven/com.h2database:h2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-23463"},{"id":"INC-14211","date":"2021-12","year":2021,"title":"Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging Mail","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-44549"],"affected":"maven/org.apache.sling:org.apache.sling.commons.messaging.mail","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-44549"},{"id":"INC-14212","date":"2021-12","year":2021,"title":"Buffer overrun in CGI.escape_html","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41816"],"affected":"rubygems/cgi, rubygems/cgi, rubygems/cgi","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41816"},{"id":"INC-14213","date":"2021-12","year":2021,"title":"Open Redirect in Flask-Security-Too","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"pip/Flask-Security-Too","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-gxjj-f44v-qm94"},{"id":"INC-14214","date":"2021-12","year":2021,"title":"lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-43818"],"affected":"pip/lxml","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43818"},{"id":"INC-14215","date":"2021-12","year":2021,"title":"Cross-Site Request Forgery in kimai2","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-4033"],"affected":"composer/kevinpapst/kimai2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-4033"},{"id":"INC-06043","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41196)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41196"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41196"},{"id":"INC-06045","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41198)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41198"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41198"},{"id":"INC-06046","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41199)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41199"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41199"},{"id":"INC-06047","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41200)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41200"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41200"},{"id":"INC-06048","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41201)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41201"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41201"},{"id":"INC-06055","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41210)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41210"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41210"},{"id":"INC-06050","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41203)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41203"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41203"},{"id":"INC-06051","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41204)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41204"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41204"},{"id":"INC-06052","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41205)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41205"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41205"},{"id":"INC-06056","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41211)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41211"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41211"},{"id":"INC-06057","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41212)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41212","CVE-2021-41214"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41212"},{"id":"INC-05880","date":"2021-11","year":2021,"title":"TensorFlow — Deserialization (CVE-2021-41215)","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-41215"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41215"},{"id":"INC-06059","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41217)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41217"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41217"},{"id":"INC-06061","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41219)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41219"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41219"},{"id":"INC-06065","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41223)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41223"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41223"},{"id":"INC-06066","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41224)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41224"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41224"},{"id":"INC-06068","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41226)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41226"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41226"},{"id":"INC-06049","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41202)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41202"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41202"},{"id":"INC-06054","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41207)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41207","CVE-2021-41209"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41207"},{"id":"INC-06060","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41218)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41218"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41218"},{"id":"INC-05918","date":"2021-11","year":2021,"title":"TensorFlow — Dos (CVE-2021-41213)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41213"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41213"},{"id":"INC-06058","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41216)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41216"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41216"},{"id":"INC-06062","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41220)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41220"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41220"},{"id":"INC-06063","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41221)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41221"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41221"},{"id":"INC-06064","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41222)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41222"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41222"},{"id":"INC-06067","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41225)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41225"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41225"},{"id":"INC-06069","date":"2021-11","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-41227)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41227"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41227"},{"id":"INC-05778","date":"2021-11","year":2021,"title":"nbdime provides tools for diffing and merging of Jupyter Notebooks.","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-41134"],"affected":"jupyter/nbdime, jupyter/nbdime-jupyterlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41134"},{"id":"INC-05446","date":"2021-11","year":2021,"title":"Aim — Path Traversal (CVE-2021-43775)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-43775"],"affected":"aimstack/aim","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-43775"},{"id":"INC-12565","date":"2021-11","year":2021,"title":"Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated user to potentially enable denial of ser...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-33073"],"affected":"intel/distribution_of_openvino_toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-33073"},{"id":"INC-05815","date":"2021-10","year":2021,"title":"Rasa — Vulnerability (CVE-2021-41127)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-41127"],"affected":"rasa/rasa","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-41127"},{"id":"INC-12566","date":"2021-10","year":2021,"title":"Rasa X before 0.42.4 allows Directory Traversal during archive extraction.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-42556"],"affected":"rasa/rasa_x","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-42556"},{"id":"INC-05996","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37636)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37636"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37636"},{"id":"INC-06000","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37640)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37640"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37640"},{"id":"INC-06002","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37642)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37642"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37642"},{"id":"INC-06013","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37653)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37653"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37653"},{"id":"INC-06020","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37660)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37660"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37660"},{"id":"INC-05997","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37637)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37637"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37637"},{"id":"INC-05998","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37638)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37638"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37638"},{"id":"INC-05999","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37639)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37639"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37639"},{"id":"INC-06003","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37643)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37643"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37643"},{"id":"INC-06007","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37647)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37647"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37647"},{"id":"INC-06009","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37649)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37649"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37649"},{"id":"INC-05995","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37635)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37635"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37635"},{"id":"INC-06001","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37641)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37641"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37641"},{"id":"INC-06004","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37644)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37644"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37644"},{"id":"INC-06005","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37645)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37645"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37645"},{"id":"INC-06006","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37646)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37646"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37646"},{"id":"INC-06010","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37650)","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37650"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37650"},{"id":"INC-06011","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37651)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37651"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37651"},{"id":"INC-06014","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37654)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37654"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37654"},{"id":"INC-06015","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37655)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37655"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37655"},{"id":"INC-06016","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37656)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37656"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37656"},{"id":"INC-06017","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37657)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37657"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37657"},{"id":"INC-06018","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37658)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37658"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37658"},{"id":"INC-06019","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37659)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37659"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37659"},{"id":"INC-05908","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37661)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37661"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37661"},{"id":"INC-06021","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37662)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37662"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37662"},{"id":"INC-06023","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37664)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37664"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37664"},{"id":"INC-06008","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37648)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37648"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37648"},{"id":"INC-06012","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37652)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37652"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37652"},{"id":"INC-06025","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37666)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37666"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37666"},{"id":"INC-06026","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37667)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37667"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37667"},{"id":"INC-06028","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37671)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37671"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37671"},{"id":"INC-05913","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37675)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37675"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37675"},{"id":"INC-06030","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37676)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37676"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37676"},{"id":"INC-06032","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37680)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37680"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37680"},{"id":"INC-06033","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37681)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37681"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37681"},{"id":"INC-06038","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37686)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37686"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37686"},{"id":"INC-05915","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37688)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37688"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37688"},{"id":"INC-05916","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37689)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37689"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37689"},{"id":"INC-06022","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37663)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37663"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37663"},{"id":"INC-06024","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37665)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37665"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37665"},{"id":"INC-05909","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37668)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37668"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37668"},{"id":"INC-05910","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37669)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37669"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37669"},{"id":"INC-06027","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37670)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37670"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37670"},{"id":"INC-06029","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37672)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37672"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37672"},{"id":"INC-05911","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37673)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37673"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37673"},{"id":"INC-05912","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37674)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37674"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37674"},{"id":"INC-05914","date":"2021-08","year":2021,"title":"TensorFlow — Dos (CVE-2021-37677)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37677"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37677"},{"id":"INC-05920","date":"2021-08","year":2021,"title":"TensorFlow — Rce (CVE-2021-37678)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-37678"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37678"},{"id":"INC-06031","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37679)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37679"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37679"},{"id":"INC-06034","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37682)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37682"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37682"},{"id":"INC-06035","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37683)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37683"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37683"},{"id":"INC-06036","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37684)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37684"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37684"},{"id":"INC-06037","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37685)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37685"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37685"},{"id":"INC-06039","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37687)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37687"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37687"},{"id":"INC-06041","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37691)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37691"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37691"},{"id":"INC-06042","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37692)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37692"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37692"},{"id":"INC-06040","date":"2021-08","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-37690)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-37690"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-37690"},{"id":"INC-05732","date":"2021-08","year":2021,"title":"JupyterLab — Rce (CVE-2021-32797)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-32797"],"affected":"jupyter/jupyterlab","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-32797"},{"id":"INC-06179","date":"2021-07","year":2021,"title":"Vulnerability in the Oracle XML DB component of Oracle Database Server.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-2329","CVE-2021-2333","CVE-2021-2337"],"affected":"oracle/xml_database","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-2329"},{"id":"INC-05879","date":"2021-06","year":2021,"title":"TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-35958"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-35958"},{"id":"INC-05921","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29512)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29512","CVE-2021-29514"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29512"},{"id":"INC-05894","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29554)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29554"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29554"},{"id":"INC-05922","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29513)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29513"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29513"},{"id":"INC-05923","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29515)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29515"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29515"},{"id":"INC-05924","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29516)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29516"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29516"},{"id":"INC-05925","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29517)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29517"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29517"},{"id":"INC-05926","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29518)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29518"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29518"},{"id":"INC-05881","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29519)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29519"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29519"},{"id":"INC-05927","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29520)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29520"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29520"},{"id":"INC-05928","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29521)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29521"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29521"},{"id":"INC-05882","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29522)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29522"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29522"},{"id":"INC-05883","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29523)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29523","CVE-2021-29534"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29523"},{"id":"INC-05929","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29524)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29524"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29524"},{"id":"INC-05930","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29525)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29525"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29525"},{"id":"INC-05931","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29526)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29526"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29526"},{"id":"INC-05932","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29527)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29527"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29527"},{"id":"INC-05933","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29528)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29528"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29528"},{"id":"INC-05934","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29529)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29529"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29529"},{"id":"INC-05935","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29530)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29530"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29530"},{"id":"INC-05884","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29531)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29531"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29531"},{"id":"INC-05936","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29532)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29532"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29532"},{"id":"INC-05885","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29533)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29533"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29533"},{"id":"INC-05937","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29535)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29535"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29535"},{"id":"INC-05938","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29536)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29536"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29536"},{"id":"INC-05939","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29537)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29537"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29537"},{"id":"INC-05886","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29538)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29538","CVE-2021-29540"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29538"},{"id":"INC-05940","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29539)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29539"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29539"},{"id":"INC-05941","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29541)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29541","CVE-2021-29542"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29541"},{"id":"INC-05887","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29543)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29543"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29543"},{"id":"INC-05888","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29544)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29544"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29544"},{"id":"INC-05889","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29545)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29545"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29545"},{"id":"INC-05942","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29546)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29546"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29546"},{"id":"INC-05890","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29547)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29547","CVE-2021-29548"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29547"},{"id":"INC-05891","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29549)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29549"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29549"},{"id":"INC-05892","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29550)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29550"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29550"},{"id":"INC-05943","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29551)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29551"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29551"},{"id":"INC-05893","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29552)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29552"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29552"},{"id":"INC-05944","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29553)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29553"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29553"},{"id":"INC-05895","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29555)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29555"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29555"},{"id":"INC-05896","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29556)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29556"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29556"},{"id":"INC-05897","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29557)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29557"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29557"},{"id":"INC-05945","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29558)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29558"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29558"},{"id":"INC-05946","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29559)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29559"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29559"},{"id":"INC-05947","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29560)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29560"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29560"},{"id":"INC-05898","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29561)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29561"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29561"},{"id":"INC-05899","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29562)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29562"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29562"},{"id":"INC-05900","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29563)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29563"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29563"},{"id":"INC-05948","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29564)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29564"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29564"},{"id":"INC-05949","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29565)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29565"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29565"},{"id":"INC-05950","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29566)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29566"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29566"},{"id":"INC-05901","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29567)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29567"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29567"},{"id":"INC-05951","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29568)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29568"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29568"},{"id":"INC-05952","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29569)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29569"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29569"},{"id":"INC-05953","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29570)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29570"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29570"},{"id":"INC-05919","date":"2021-05","year":2021,"title":"TensorFlow — Rce (CVE-2021-29571)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-29571"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29571"},{"id":"INC-05954","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29572)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29572"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29572"},{"id":"INC-05955","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29573)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29573"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29573"},{"id":"INC-05956","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29574)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29574"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29574"},{"id":"INC-05902","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29575)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29575"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29575"},{"id":"INC-05957","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29576)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29576"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29576"},{"id":"INC-05958","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29577)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29577"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29577"},{"id":"INC-05959","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29578)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29578"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29578"},{"id":"INC-05960","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29579)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29579"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29579"},{"id":"INC-05903","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29580)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29580"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29580"},{"id":"INC-05904","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29581)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29581"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29581"},{"id":"INC-05961","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29582)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29582"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29582"},{"id":"INC-05962","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29583)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29583"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29583"},{"id":"INC-05905","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29584)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29584"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29584"},{"id":"INC-05963","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29585)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29585"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29585"},{"id":"INC-05964","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29586)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29586"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29586"},{"id":"INC-05965","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29587)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29587"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29587"},{"id":"INC-05966","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29588)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29588"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29588"},{"id":"INC-05967","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29589)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29589"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29589"},{"id":"INC-05968","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29590)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29590"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29590"},{"id":"INC-05969","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29591)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29591"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29591"},{"id":"INC-05970","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29592)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29592"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29592"},{"id":"INC-05971","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29593)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29593"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29593"},{"id":"INC-05972","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29594)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29594"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29594"},{"id":"INC-05973","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29595)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29595"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29595"},{"id":"INC-05974","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29596)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29596"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29596"},{"id":"INC-05975","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29597)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29597"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29597"},{"id":"INC-05976","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29598)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29598"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29598"},{"id":"INC-05977","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29599)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29599"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29599"},{"id":"INC-05978","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29600)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29600"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29600"},{"id":"INC-05979","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29601)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29601"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29601"},{"id":"INC-05980","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29602)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29602"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29602"},{"id":"INC-05981","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29603)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29603"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29603"},{"id":"INC-05982","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29604)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29604"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29604"},{"id":"INC-05983","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29605)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29605"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29605"},{"id":"INC-05984","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29606)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29606"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29606"},{"id":"INC-05985","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29607)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29607","CVE-2021-29612"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29607"},{"id":"INC-05986","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29608)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29608"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29608"},{"id":"INC-05987","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29609)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29609"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29609"},{"id":"INC-05988","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29610)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29610"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29610"},{"id":"INC-05906","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29611)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29611"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29611"},{"id":"INC-05989","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29613)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29613"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29613"},{"id":"INC-05990","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29614)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29614"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29614"},{"id":"INC-05991","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29615)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29615"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29615"},{"id":"INC-05992","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29616)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29616"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29616"},{"id":"INC-05907","date":"2021-05","year":2021,"title":"TensorFlow — Dos (CVE-2021-29617)","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29617"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29617"},{"id":"INC-05993","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29618)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29618"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29618"},{"id":"INC-05994","date":"2021-05","year":2021,"title":"TensorFlow — Vulnerability (CVE-2021-29619)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2021-29619"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-29619"},{"id":"INC-05699","date":"2021-03","year":2021,"title":"Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2021-28796"],"affected":"increments/qiita\\","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2021-28796"},{"id":"INC-05499","date":"2021-01","year":2021,"title":"Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4).","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-17500"],"affected":"barco/transform_n, barco/transform_ndn-210_lite, barco/transform_ndn-210_pro, barco/transform_ndn-211_lite","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-17500"},{"id":"INC-06361","date":"2020-12","year":2020,"title":"An issue was discovered in FNET through 4.6.4.","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2020-17467"],"affected":"butok/fnet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-17467"},{"id":"INC-06205","date":"2020-12","year":2020,"title":"A RCE vulnerability exists in Raysync below 3.3.3.8.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-35370"],"affected":"raysync/raysync","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-35370"},{"id":"INC-06697","date":"2020-12","year":2020,"title":"In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26271"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26271"},{"id":"INC-06696","date":"2020-12","year":2020,"title":"In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-26266"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26266"},{"id":"INC-06694","date":"2020-12","year":2020,"title":"In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26267"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26267"},{"id":"INC-06695","date":"2020-12","year":2020,"title":"In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26268"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26268"},{"id":"INC-06702","date":"2020-12","year":2020,"title":"In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the a...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26269"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26269"},{"id":"INC-06693","date":"2020-12","year":2020,"title":"In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-26270"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-26270"},{"id":"INC-06699","date":"2020-10","year":2020,"title":"In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-15265"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-15265"},{"id":"INC-06700","date":"2020-10","year":2020,"title":"In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floa...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-15266"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-15266"},{"id":"INC-06204","date":"2020-10","year":2020,"title":"<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-16977"],"affected":"microsoft/visual_studio_code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-16977"},{"id":"INC-06701","date":"2020-09","year":2020,"title":"In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors.","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":["CVE-2020-15190","CVE-2020-15191","CVE-2020-15192","CVE-2020-15193","CVE-2020-15194","CVE-2020-15195","CVE-2020-15196","CVE-2020-15197","CVE-2020-15198","CVE-2020-15199","CVE-2020-15200","CVE-2020-15201","CVE-2020-15202","CVE-2020-15203","CVE-2020-15204","CVE-2020-15205","CVE-2020-15206","CVE-2020-15207","CVE-2020-15208","CVE-2020-15209","CVE-2020-15210","CVE-2020-15211","CVE-2020-15212","CVE-2020-15213","CVE-2020-15214"],"affected":"google/tensorflow, opensuse/leap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-15190"},{"id":"INC-12567","date":"2020-08","year":2020,"title":"Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalation of privilege vi...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-12287"],"affected":"intel/distribution_of_openvino_toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-12287"},{"id":"INC-06952","date":"2020-05","year":2020,"title":"TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-21233"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-21233"},{"id":"INC-06864","date":"2020-04","year":2020,"title":"Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (account.php), uname and pass parameters ...","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-11545"],"affected":"projectworlds/official_car_rental_system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-11545"},{"id":"INC-06841","date":"2020-03","year":2020,"title":"PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php.","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2020-10106"],"affected":"phpgurukul/daily_expense_tracker_system","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-10106"},{"id":"INC-06698","date":"2020-01","year":2020,"title":"In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use ca...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2020-5215"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2020-5215"},{"id":"INC-07197","date":"2019-12","year":2019,"title":"In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-16778"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-16778"},{"id":"INC-07248","date":"2019-12","year":2019,"title":"This issue was addressed by improving Face ID machine learning models.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-8760"],"affected":"apple/iphone_os","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-8760"},{"id":"INC-07247","date":"2019-11","year":2019,"title":"The Panasonic Eluga Ray 530 Android device with a build fingerprint of Panasonic/ELUGA_Ray_530/ELUGA_Ray_530:8.1.0/O11019/1531828974:user/release-keys contains a pre-installed a...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-15376","CVE-2019-15378"],"affected":"panasonic/eluga_ray_530_firmware, panasonic/eluga_ray_530","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-15376"},{"id":"INC-07161","date":"2019-04","year":2019,"title":"An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA).","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-6689"],"affected":"dillonkane/tidal_workload_automation","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-6689"},{"id":"INC-07186","date":"2019-04","year":2019,"title":"Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-7576"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7576"},{"id":"INC-07187","date":"2019-04","year":2019,"title":"Google TensorFlow 1.7 and below is affected by: Buffer Overflow.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-8825"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-8825"},{"id":"INC-07199","date":"2019-04","year":2019,"title":"Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memo...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-10055"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-10055"},{"id":"INC-07211","date":"2019-04","year":2019,"title":"Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-7577"],"affected":"google/snappy, google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7577"},{"id":"INC-07215","date":"2019-04","year":2019,"title":"NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-9635"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-9635"},{"id":"INC-07188","date":"2019-04","year":2019,"title":"Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-7575"],"affected":"google/tensorflow","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-7575"},{"id":"INC-07214","date":"2019-04","year":2019,"title":"nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-10844"],"affected":"sony/neural_network_libraries","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-10844"},{"id":"INC-12568","date":"2019-02","year":2019,"title":"Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure via local access.","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2019-0127"],"affected":"intel/openvino, linux/linux_kernel","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-0127"},{"id":"INC-07162","date":"2019-01","year":2019,"title":"An issue was discovered in OpenSSH 7.9.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2019-6111"],"affected":"openbsd/openssh, winscp/winscp, canonical/ubuntu_linux, debian/debian_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111"},{"id":"INC-07163","date":"2019-01","year":2019,"title":"An issue was discovered in rcp in NetKit through 0.17.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2019-7283"],"affected":"netkit/netkit, debian/debian_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2019-7283"},{"id":"INC-07342","date":"2018-09","year":2018,"title":"The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-6975"],"affected":"vmware/intelligent_hub","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-6975"},{"id":"INC-07332","date":"2018-09","year":2018,"title":"SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands...","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-17232"],"affected":"slack_archivebot_project/slack_archivebot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-17232"},{"id":"INC-12569","date":"2018-09","year":2018,"title":"Directory permissions in the Intel OpenVINO Toolkit for Windows before version 2018.1.265 may allow an authenticated user to potentially execute code using default directory per...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-12162"],"affected":"intel/openvino_toolkit","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-12162"},{"id":"INC-07343","date":"2018-06","year":2018,"title":"The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote code execution vulnerability in real time File Manager c...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-6968"],"affected":"vmware/airwatch_agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-6968"},{"id":"INC-07286","date":"2018-03","year":2018,"title":"Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Lo...","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-5314"],"affected":"citrix/netscaler_application_delivery_controller, citrix/netscaler_gateway, citrix/netscaler_sd-wan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-5314"},{"id":"INC-07313","date":"2018-03","year":2018,"title":"In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2018-8768"],"affected":"jupyter/notebook","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-8768"},{"id":"INC-12570","date":"2018-03","year":2018,"title":"Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2018-6765"],"affected":"swisscom/myswisscomassistant","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2018-6765"},{"id":"INC-07360","date":"2017-11","year":2017,"title":"A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-5719"],"affected":"intel/deep_learning_training_tool","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-5719"},{"id":"INC-07455","date":"2017-10","year":2017,"title":"Vulnerability in the XML Database component of Oracle Database Server.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-10261"],"affected":"oracle/database","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-10261"},{"id":"INC-07422","date":"2017-09","year":2017,"title":"iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2015-9231"],"affected":"iterm2/iterm2","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-9231"},{"id":"INC-07460","date":"2017-06","year":2017,"title":"Windows Cursor in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows improper elevation of privilege, aka ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-8466"],"affected":"microsoft/windows_10, microsoft/windows_8.1, microsoft/windows_rt_8.1, microsoft/windows_server_2012","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-8466"},{"id":"INC-07369","date":"2017-05","year":2017,"title":"Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2017-4895"],"affected":"vmware/airwatch_agent, vmware/airwatch_inbox","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2017-4895"},{"id":"INC-07446","date":"2017-01","year":2017,"title":"The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Performance for Infrastructure Managers 1...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-9795"],"affected":"broadcom/ca_workload_automation_ae, broadcom/client_automation, broadcom/systemedge,…","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-9795"},{"id":"INC-07532","date":"2016-12","year":2016,"title":"The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and Q...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-7170"],"affected":"qemu/qemu, debian/debian_linux, opensuse/leap","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-7170"},{"id":"INC-07517","date":"2016-12","year":2016,"title":"QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2016-9846"],"affected":"qemu/qemu","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2016-9846"},{"id":"INC-07547","date":"2016-02","year":2016,"title":"Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-8286"],"affected":"zhuhai/raysharp_firmware","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-8286"},{"id":"INC-07542","date":"2016-01","year":2016,"title":"Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect avail...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2014-6577","CVE-2015-4923","CVE-2016-0461","CVE-2016-0472"],"affected":"oracle/database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-4923"},{"id":"INC-07584","date":"2015-10","year":2015,"title":"Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidential...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-0455","CVE-2015-0479","CVE-2015-4900"],"affected":"oracle/database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-4900"},{"id":"INC-07569","date":"2015-03","year":2015,"title":"Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow rem...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2015-2759"],"affected":"mcafee/data_loss_prevention_endpoint","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-2759"},{"id":"INC-07555","date":"2015-02","year":2015,"title":"Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2015-0058"],"affected":"microsoft/windows_8.1, microsoft/windows_rt_8.1, microsoft/windows_server_2012","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2015-0058"},{"id":"INC-07604","date":"2014-06","year":2014,"title":"Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it e...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2014-1539"],"affected":"mozilla/firefox, mozilla/thunderbird, apple/mac_os_x","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2014-1539"},{"id":"INC-07629","date":"2013-10","year":2013,"title":"Unspecified vulnerability in the XML Parser component in Oracle Database Server 11.1.0.7, 11.2.0.2, 11.2.0.3, and 12.1.0.1 allows remote attackers to affect confidentiality and ...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2013-3751","CVE-2013-5771"],"affected":"oracle/database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-5771"},{"id":"INC-07616","date":"2013-04","year":2013,"title":"Buffer overflow in the NVIDIA GPU driver before 304.88, 310.x before 310.44, and 313.x before 313.30 for the X Window System on UNIX, when NoScanout mode is enabled, allows remo...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2013-0131"],"affected":"nvidia/gpu_driver","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2013-0131"},{"id":"INC-07635","date":"2012-09","year":2012,"title":"Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HT...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2012-4015"],"affected":"mylittletools/mylittleadmin, microsoft/sql_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2012-4015"},{"id":"INC-07652","date":"2011-11","year":2011,"title":"Cross-site scripting (XSS) vulnerability in members/profileCommentsResponse.php in Rayzz Photoz allows remote attackers to inject arbitrary web script or HTML via the profileCom...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-5005"],"affected":"rayzz/photoz","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-5005"},{"id":"INC-07660","date":"2011-07","year":2011,"title":"Unspecified vulnerability in the XML Developer Kit component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.1, Oracle Fusion Middleware 1...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-2231","CVE-2011-2232"],"affected":"oracle/database_server, oracle/fusion_middleware","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-2231"},{"id":"INC-07656","date":"2011-06","year":2011,"title":"Integer overflow in the CursorAsset x32 component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-2120"],"affected":"adobe/shockwave_player","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-2120"},{"id":"INC-14634","date":"2011-04","year":2011,"title":"Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject a...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2011-0462"],"affected":"novell/opensuse_build_service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-0462"},{"id":"INC-07659","date":"2011-02","year":2011,"title":"The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2011-1036"],"affected":"ca/host-based_intrusion_prevention_system, ca/internet_security_suite_2010, ca/internet_security_suite_2011","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2011-1036"},{"id":"INC-07664","date":"2010-07","year":2010,"title":"Multiple cross-site request forgery (CSRF) vulnerabilities in the web management interface in InterSect Alliance Snare Agent 3.2.3 and earlier on Solaris, Snare Agent 3.1.7 and ...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2010-2594"],"affected":"intersect_alliance/snare_agent, sun/solaris, microsoft/windows_2000, microsoft/windows_2003_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-2594"},{"id":"INC-07665","date":"2010-05","year":2010,"title":"SQL injection vulnerability in the Jvehicles (com_jvehicles) component 1.0, 2.0, and 2.1111 for Joomla!","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1873"],"affected":"jvehicles/com_jvehicles, joomla/joomla\\!","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-1873"},{"id":"INC-07666","date":"2010-05","year":2010,"title":"SQL injection vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla!","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1874"],"affected":"com-property/com_properties, joomla/joomla\\!","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-1874"},{"id":"INC-07667","date":"2010-05","year":2010,"title":"Stack-based buffer overflow in CursorArts ZipWrangler 1.20 allows user-assisted remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2010-1685"],"affected":"cursorarts/zipwrangler","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-1685"},{"id":"INC-07663","date":"2010-01","year":2010,"title":"Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which allows remote attackers to create, modi...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2010-0139"],"affected":"cisco/unified_meetingplace","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2010-0139"},{"id":"INC-07671","date":"2009-12","year":2009,"title":"Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to inject arbitrary web script or HTML v...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-4343","CVE-2009-4397","CVE-2009-4400"],"affected":"dominic_eckart/trainincdb, typo3/typo3","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-4343"},{"id":"INC-07674","date":"2009-10","year":2009,"title":"PI Server in OSIsoft PI System before 3.4.380.x does not properly use encryption in the default authentication process, which allows remote attackers to read or modify informati...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2009-0209"],"affected":"osisoft/pi_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-0209"},{"id":"INC-07675","date":"2009-08","year":2009,"title":"Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variab...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2009-2475"],"affected":"sun/java_se, sun/openjdk","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-2475"},{"id":"INC-07680","date":"2009-06","year":2009,"title":"WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a c...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2009-1710"],"affected":"apple/safari","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-1710"},{"id":"INC-07676","date":"2009-06","year":2009,"title":"The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corr...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-1392"],"affected":"mozilla/firefox, mozilla/seamonkey, mozilla/thunderbird","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-1392"},{"id":"INC-07670","date":"2009-06","year":2009,"title":"Cross-site scripting (XSS) vulnerability in Joomla!","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2009-1938"],"affected":"joomla/joomla","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-1938"},{"id":"INC-07678","date":"2009-03","year":2009,"title":"Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2009-1055"],"affected":"sitecore/cms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2009-1055"},{"id":"INC-07672","date":"2009-03","year":2009,"title":"Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized acti...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2008-6532"],"affected":"drupal/drupal","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-6532"},{"id":"INC-07682","date":"2008-10","year":2008,"title":"Cross-site scripting (XSS) vulnerability in Opera.dll in Opera 9.52 allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly es...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-4725"],"affected":"opera/opera_browser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-4725"},{"id":"INC-07686","date":"2008-07","year":2008,"title":"Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in t...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2008-3167"],"affected":"boonex/dolphin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-3167"},{"id":"INC-07688","date":"2008-07","year":2008,"title":"Unspecified vulnerability in the Resource Manager component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6, and Database Control in Enterprise Manager, has unknown impact a...","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-2603"],"affected":"oracle/enterprise_manager","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-2603"},{"id":"INC-07683","date":"2008-06","year":2008,"title":"Cross-site scripting (XSS) vulnerability in the Event Database (aka rlmp_eventdb) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2008-2525"],"affected":"typo3/rlmp_eventdb","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2008-2525"},{"id":"INC-07692","date":"2007-12","year":2007,"title":"Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11 allows remote attack...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-6570"],"affected":"sun/java_system_web_proxy_server, sun/java_system_web_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-6570"},{"id":"INC-07693","date":"2007-09","year":2007,"title":"Multiple cross-site scripting (XSS) vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the (1) una...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-5059"],"affected":"greensql/greensql","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-5059"},{"id":"INC-07690","date":"2007-04","year":2007,"title":"Buffer overflow in IrfanView 3.99 allows remote attackers to execute arbitrary code via a crafted animated cursor (ANI) file.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-1867"],"affected":"irfanview/irfanview","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-1867"},{"id":"INC-07695","date":"2007-04","year":2007,"title":"Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 have unknown impact and remote authenticated attack vectors related to (1) Rules Manager and Expression Filter c...","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-2109"],"affected":"oracle/database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-2109"},{"id":"INC-07694","date":"2007-04","year":2007,"title":"Multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote at...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-2159"],"affected":"drupal/database_administration_module","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-2159"},{"id":"INC-07697","date":"2007-03","year":2007,"title":"Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of service (persistent reboot) via a ma...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-1765"],"affected":"microsoft/windows_2000, microsoft/windows_2003_server, microsoft/windows_vista, microsoft/windows_xp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-1765"},{"id":"INC-07696","date":"2007-03","year":2007,"title":"Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of servic...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-0038"],"affected":"microsoft/windows_2000, microsoft/windows_2003_server, microsoft/windows_vista, microsoft/windows_xp","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-0038"},{"id":"INC-14635","date":"2007-02","year":2007,"title":"GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface ele...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-6500","CVE-2007-0779"],"affected":"mozilla/firefox, mozilla/seamonkey","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-0779"},{"id":"INC-07691","date":"2007-01","year":2007,"title":"Cross-site scripting (XSS) vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php an...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2007-0592"],"affected":"indexcor/ezdatabase","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2007-0592"},{"id":"INC-07700","date":"2006-12","year":2006,"title":"Cross-site scripting (XSS) vulnerability in the Webadmin in @Mail before 4.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving \"un...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-6704"],"affected":"atmail/atmail_webadmin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-6704"},{"id":"INC-07699","date":"2006-03","year":2006,"title":"Cross-site scripting (XSS) vulnerability in issue/createissue.aspx in Gemini 2.0 allows remote attackers to inject arbitrary web script or HTML via the rtcDescription$RadEditor1...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2006-1239"],"affected":"countersoft/gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2006-1239"},{"id":"INC-12571","date":"2005-12","year":2005,"title":"Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the (1) haystack parameter t...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2005-4001"],"affected":"phpyellow/phpyellowtm_lite, phpyellow/phpyellowtm_pro","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2005-4001"},{"id":"INC-07701","date":"2005-11","year":2005,"title":"Unspecified vulnerability in Intelligent Agent in Oracle Database Server 9i up to 9.0.1.5 has unknown impact and attack vectors, aka Oracle Vuln# DB14.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2005-3441"],"affected":"oracle/database_server","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2005-3441"},{"id":"INC-07702","date":"2004-07","year":2004,"title":"Sun Ray Server Software (SRSS) 1.3 and 2.0 for Solaris 2.6, 7 and 8 does not properly detect a smartcard removal when the card is quickly removed, reinserted, and removed again,...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2004-0701"],"affected":"sun/ray_server_software","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2004-0701"},{"id":"INC-07707","date":"2002-03","year":2002,"title":"Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to \"routines for moving the physi...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2002-0062"],"affected":"debian/debian_linux, freebsd/freebsd, redhat/linux, suse/suse_linux","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2002-0062"},{"id":"INC-07708","date":"2001-08","year":2001,"title":"Performance Metrics Collector Daemon (PMCD) in Performance Copilot in IRIX 6.x allows remote attackers to cause a denial of service (resource exhaustion) via an extremely long s...","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2000-0283","CVE-2000-1193"],"affected":"sgi/irix","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2000-1193"},{"id":"INC-07709","date":"2001-07","year":2001,"title":"SNMP agents in 3Com AirConnect AP-4111 and Symbol 41X1 Access Point allow remote attackers to obtain the WEP encryption key by reading it from a MIB when the value should be wri...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2001-0352"],"affected":"3com/3crwe747a, symbol/41x1_access_point","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2001-0352"},{"id":"INC-03798","date":"2024","year":2024,"title":"garak probe: **Agent Breaker probe**","severity":"Medium","attack_vector":"other","owasp_llm":["LLM01","LLM02","LLM03","LLM04","LLM07","LLM10"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"LLM evaluation surface","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://github.com/NVIDIA/garak/blob/main/garak/probes/agent_breaker.py"},{"id":"INC-06816","date":"2020-01-01","year":2020,"title":"NHTSA Investigates Fatal Tesla Crash Potentially Involving Autopilot in California","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-01-39b5"},{"id":"INC-07095","date":"2020-01-01","year":2020,"title":"US Navy Develops AI-Driven Communication for Autonomous Warships","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-01-9a50"},{"id":"INC-06613","date":"2020-01-02","year":2020,"title":"Fatal Tesla Crashes Spark Autopilot Safety Investigations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-02-38b6"},{"id":"INC-06923","date":"2020-01-02","year":2020,"title":"South Korea Plans AI Surveillance Cameras for Crime Prediction in Seoul","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-02-8aae"},{"id":"INC-06764","date":"2020-01-02","year":2020,"title":"Lockport School District's Facial Recognition System Sparks Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-02-8d51"},{"id":"INC-14216","date":"2020-01-02","year":2020,"title":"Google Disables Xiaomi Smart Home Integration After Security Camera Privacy Breach","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-02-96f4"},{"id":"INC-06778","date":"2020-01-02","year":2020,"title":"Mexican Government Plans Nationwide Biometric Data Collection Using AI Systems","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-02-c358"},{"id":"INC-06525","date":"2020-01-03","year":2020,"title":"Elon Musk Warns AI Arms Race Could Trigger World War III","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-03-4ed1"},{"id":"INC-07000","date":"2020-01-03","year":2020,"title":"TikTok's Secret Development of Deepfake Face Swap Feature Raises AI Misuse Concerns","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-03-67ec"},{"id":"INC-06329","date":"2020-01-03","year":2020,"title":"AI-Powered Workplace Harassment Detection Raises Privacy and Trust Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-03-b3c9"},{"id":"INC-06215","date":"2020-01-05","year":2020,"title":"AI and Automation Threaten Millions of Jobs by 2030","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-05-4e0b"},{"id":"INC-06321","date":"2020-01-05","year":2020,"title":"AI-Powered Suicide Prevention on E-Commerce Platforms in China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-05-6c6d"},{"id":"INC-06705","date":"2020-01-06","year":2020,"title":"India Deploys AI Facial Recognition to Monitor Protesters, Raising Human Rights Concerns","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-06-401b"},{"id":"INC-06646","date":"2020-01-06","year":2020,"title":"Global Voter Manipulation and Privacy Violations by Cambridge Analytica's AI Systems","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-06-c7bc"},{"id":"INC-06597","date":"2020-01-07","year":2020,"title":"Facial Recognition AI Raises Privacy Concerns in Public Spaces and Transit Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-07-2eb7"},{"id":"INC-06922","date":"2020-01-07","year":2020,"title":"Sony Unveils AI-Equipped Autonomous EV Prototype for Public Road Testing","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-07-3fa9"},{"id":"INC-06900","date":"2020-01-07","year":2020,"title":"Samsung Unveils NEON 'Artificial Humans,' Raising Job Loss and Deepfake Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-07-4b76"},{"id":"INC-06335","date":"2020-01-07","year":2020,"title":"Airbnb Patents AI to Screen Guests for Personality Traits Using Social Media Data","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-01-07-7aaf"},{"id":"INC-07007","date":"2020-01-07","year":2020,"title":"Toyota Plans AI-Driven 'Woven City' to Test Autonomous Technologies","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-07-c037"},{"id":"INC-06603","date":"2020-01-08","year":2020,"title":"Facial Recognition at Cardiff-Swansea Football Match Sparks Rights Concerns and Police Row","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-08-4d5e"},{"id":"INC-06449","date":"2020-01-08","year":2020,"title":"Chinese Court Rules AI-Generated Article Protected by Copyright","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-08-7b86"},{"id":"INC-06452","date":"2020-01-08","year":2020,"title":"Chinese Safari Park Sued Over Facial Recognition Sparks National Privacy Debate","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-08-85e4"},{"id":"INC-07119","date":"2020-01-08","year":2020,"title":"Waymo Wins $128 Million in Trade Secrets Case Against Uber Over Self-Driving AI Technology","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-08-bd8b"},{"id":"INC-06368","date":"2020-01-09","year":2020,"title":"Apple's AI-Powered Photo Scanning Sparks Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-09-5e98"},{"id":"INC-06477","date":"2020-01-09","year":2020,"title":"Connected Cars Hacked: AI Systems Compromised, Causing Loss of Control and Theft","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-09-688e"},{"id":"INC-06454","date":"2020-01-09","year":2020,"title":"Civil Society Groups Oppose Government Facial Recognition Surveillance Plans in Germany","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-01-09-a07b"},{"id":"INC-06787","date":"2020-01-09","year":2020,"title":"Microsoft Launches Project Artemis AI to Detect and Prevent Online Child Grooming","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-09-a61b"},{"id":"INC-06784","date":"2020-01-10","year":2020,"title":"Microsoft Contractors in China Accessed Skype and Cortana Recordings Without Security Measures","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-10-5847"},{"id":"INC-07077","date":"2020-01-11","year":2020,"title":"US Army Develops AI-Enabled Robotic Combat Units","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-11-377e"},{"id":"INC-06272","date":"2020-01-11","year":2020,"title":"AI-Driven Bots and Ransomware Escalate Cyberattack Threats in Indonesia","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-11-6e8b"},{"id":"INC-06241","date":"2020-01-12","year":2020,"title":"AI Project Aims to Enable Single-Pilot Commercial Flights for Greater Safety and Efficiency","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-12-3552"},{"id":"INC-06720","date":"2020-01-13","year":2020,"title":"Instagram's AI Fact-Checking Flags Digital Art as Misinformation, Hurting Artists","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-13-0dd7"},{"id":"INC-06486","date":"2020-01-13","year":2020,"title":"Croatian Police Secretly Procure Facial Recognition AI System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-13-10d1"},{"id":"INC-06820","date":"2020-01-13","year":2020,"title":"North Rhine-Westphalia Police to Deploy Palantir AI Data Analysis System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-13-456f"},{"id":"INC-07003","date":"2020-01-14","year":2020,"title":"Tinder and Grindr Accused of Selling Sensitive User Data via AI-Driven Advertising Systems","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-1a86"},{"id":"INC-06642","date":"2020-01-14","year":2020,"title":"Global Inaction on Regulating Lethal Autonomous Weapons Raises AI Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-5f8f"},{"id":"INC-06266","date":"2020-01-14","year":2020,"title":"AI-Based Cybersecurity Trials for Buildings and Connected Cars Launched in Japan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-697c"},{"id":"INC-07050","date":"2020-01-14","year":2020,"title":"UK Ministry of Defence Funds AI Projects for Future Warships","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-8959"},{"id":"INC-06356","date":"2020-01-14","year":2020,"title":"Amnesty International Challenges NSO Group Over AI Spyware Abuses","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-d168"},{"id":"INC-06317","date":"2020-01-14","year":2020,"title":"AI-Powered Robots Displace Millions of Human Workers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-14-d5a5"},{"id":"INC-06673","date":"2020-01-15","year":2020,"title":"Google's Project Nightingale Sparks Privacy Concerns Over AI Access to Patient Data","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-15-6bb7"},{"id":"INC-06765","date":"2020-01-15","year":2020,"title":"Lower Saxony Deploys AI to Combat Child Pornography","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-15-b8df"},{"id":"INC-06448","date":"2020-01-15","year":2020,"title":"Chinese Company Unveils AI-Powered Robo-Shark for Military Use","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-15-f357"},{"id":"INC-06253","date":"2020-01-16","year":2020,"title":"AI System Developed to Let Vehicles and Devices 'See' Around Corners Raises Future Safety and Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-16-1f1c"},{"id":"INC-06269","date":"2020-01-16","year":2020,"title":"AI-Driven Automation Threatens Mass Job Loss in Transport and Retail Sectors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-16-fc50"},{"id":"INC-06365","date":"2020-01-17","year":2020,"title":"Apple Siri Labels Israel as 'Zionist Occupation State' Due to Wikipedia Vandalism","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-17-125d"},{"id":"INC-06817","date":"2020-01-17","year":2020,"title":"NHTSA Investigates Tesla AI-Driven Unintended Acceleration Incidents","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-17-c9cd"},{"id":"INC-06558","date":"2020-01-18","year":2020,"title":"Facebook Bans Israeli AI Firm for Subconscious Manipulation of Users","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-18-4d35"},{"id":"INC-06243","date":"2020-01-18","year":2020,"title":"AI Skin Cancer Detection App Enables Early Diagnosis and Saves Life","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-18-8e93"},{"id":"INC-06949","date":"2020-01-18","year":2020,"title":"Telangana Pilots AI Facial Recognition for Voter Verification in Elections","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-01-18-bdac"},{"id":"INC-06223","date":"2020-01-19","year":2020,"title":"AI Expert Warns of Greater Threat from AI Robots than Climate Change","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-19-5399"},{"id":"INC-06738","date":"2020-01-19","year":2020,"title":"Italy Deploys AI Algorithm for Tax Evasion Detection, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-19-717d"},{"id":"INC-06920","date":"2020-01-19","year":2020,"title":"Social Robots Exploit Human Trust, Raising Privacy and Security Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-19-acd5"},{"id":"INC-06729","date":"2020-01-19","year":2020,"title":"Israel Deploys AI-Driven Technology to Detect Hezbollah Tunnels on Lebanon Border","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-19-d1da"},{"id":"INC-06758","date":"2020-01-20","year":2020,"title":"Legal Challenge Against AI-Powered Video Surveillance in Marseille","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-20-5e6d"},{"id":"INC-06899","date":"2020-01-20","year":2020,"title":"Safari's AI-Powered Anti-Tracking Feature Exposes User Privacy","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-20-ecc6"},{"id":"INC-07065","date":"2020-01-21","year":2020,"title":"Uncertainty Over YouTube's Algorithm and Its Potential Role in Radicalization","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-21-1566"},{"id":"INC-07058","date":"2020-01-21","year":2020,"title":"UK Trials Unsupervised AI-Driven Pods in Public Spaces","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-21-17b0"},{"id":"INC-06752","date":"2020-01-21","year":2020,"title":"Kitty Hawk's Autonomous Air Taxis Highlight Future AI Safety Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-21-8b75"},{"id":"INC-06447","date":"2020-01-21","year":2020,"title":"Chinese City Uses AI Facial Recognition to Publicly Shame Pajama Wearers","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-21-a983"},{"id":"INC-06633","date":"2020-01-22","year":2020,"title":"German Data Protection Chief Calls for Ban on Public Facial Recognition AI","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-22-8ea3"},{"id":"INC-06615","date":"2020-01-23","year":2020,"title":"FC Metz Tests Facial Recognition AI, Raising Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-23-086e"},{"id":"INC-06512","date":"2020-01-23","year":2020,"title":"Doomsday Clock Highlights AI-Driven Global Risks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-23-56ea"},{"id":"INC-07147","date":"2020-01-23","year":2020,"title":"Yuval Noah Harari Warns Davos Elites of AI-Driven 'Technological Dictatorships'","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-23-5746"},{"id":"INC-06711","date":"2020-01-23","year":2020,"title":"Indonesia Urged to Develop AI-Enabled Armed Drones Amid Rising Military Tech Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-23-bd2a"},{"id":"INC-06806","date":"2020-01-23","year":2020,"title":"NASA's Curiosity Rover Freezes on Mars After AI Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-23-faa9"},{"id":"INC-14636","date":"2020-01-24","year":2020,"title":"China's AI-Powered Surveillance State Used for Minority Repression, Says U.S. Defense Chief","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-24-b7a2"},{"id":"INC-06909","date":"2020-01-24","year":2020,"title":"Senator Criticizes Tesla Autopilot Over Safety and Misleading Branding","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-24-e462"},{"id":"INC-06717","date":"2020-01-26","year":2020,"title":"Instagram Fails to Fully Enforce Ban on Harmful Plastic Surgery AI Filters","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-26-88dd"},{"id":"INC-06591","date":"2020-01-26","year":2020,"title":"Facial Recognition AI Deployed for Mass Surveillance in London and Moscow Amid Global Regulatory Debate","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-26-f506"},{"id":"INC-06835","date":"2020-01-27","year":2020,"title":"Paytm Payments Bank Uses AI to Block Fraudulent Transactions and Rogue Apps","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-27-633f"},{"id":"INC-06497","date":"2020-01-27","year":2020,"title":"Deepfake AI Technology Raises Concerns Over Fraud and Misinformation Risks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-27-8594"},{"id":"INC-07042","date":"2020-01-27","year":2020,"title":"UK Allows Limited Huawei Participation in 5G Amid AI Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-27-ea3c"},{"id":"INC-07126","date":"2020-01-28","year":2020,"title":"Widespread Availability of AI-Powered License Plate Readers Raises Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-28-324d"},{"id":"INC-06219","date":"2020-01-28","year":2020,"title":"AI Bias Risks False Positives in Search for Alien Life","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-28-a345"},{"id":"INC-06713","date":"2020-01-29","year":2020,"title":"Indonesian Officials Warn of Job Losses from AI-Driven Automation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-29-5e98"},{"id":"INC-06614","date":"2020-01-30","year":2020,"title":"FBI Investigates NSO Group's Pegasus Spyware for Hacking and Surveillance Abuses","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-01-30-081e"},{"id":"INC-06309","date":"2020-02-01","year":2020,"title":"AI-Powered Genome Analysis Accelerates COVID-19 Diagnosis in Zhejiang","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-01-2fb9"},{"id":"INC-07090","date":"2020-02-01","year":2020,"title":"US Military and CIA Expand Use of AI for Battlefield Operations and Espionage","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-01-3c6c"},{"id":"INC-07013","date":"2020-02-01","year":2020,"title":"Turkey Deploys AI-Enabled Armed Drone 'Songar' to Military Forces","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-01-d683"},{"id":"INC-07048","date":"2020-02-03","year":2020,"title":"UK Government Supports Controversial AI Spyware Firm Amid Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-03-24ec"},{"id":"INC-06644","date":"2020-02-03","year":2020,"title":"Global Police Use of Facial Recognition AI Sparks Human Rights Concerns and Legal Challenges","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-03-3fe2"},{"id":"INC-07085","date":"2020-02-03","year":2020,"title":"US Department of Defense Deploys AI-Powered Counter-Drone Systems from Fortem Technologies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-03-7dae"},{"id":"INC-06876","date":"2020-02-03","year":2020,"title":"Researchers Expose Vulnerability in Autonomous Vehicle AI to Projected 'Phantom' Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-03-9b5e"},{"id":"INC-06371","date":"2020-02-03","year":2020,"title":"Artist Manipulates Google Maps AI to Create Fake Traffic Jams in Berlin","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-03-bc1b"},{"id":"INC-06814","date":"2020-02-04","year":2020,"title":"New Zealand and Wisk Launch Autonomous Air Taxi Trial with Cora","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-04-b6c4"},{"id":"INC-07093","date":"2020-02-04","year":2020,"title":"US Navy Accelerates Deployment of AI-Enabled Armed Ocean Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-04-d660"},{"id":"INC-06518","date":"2020-02-05","year":2020,"title":"Dutch Court Rules AI Welfare Fraud Detection System Violates Human Rights","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-05-1962"},{"id":"INC-06351","date":"2020-02-06","year":2020,"title":"Amazon's AI-Driven Choice Badge Misleads Consumers Through Fake Reviews","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-06-1184"},{"id":"INC-06319","date":"2020-02-06","year":2020,"title":"AI-Powered Smart Intersections Planned to Reduce Traffic Accidents in Russia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-06-93af"},{"id":"INC-06338","date":"2020-02-06","year":2020,"title":"Algorithmic Risk Assessment in Probation Leads to Unfair Treatment and Rights Violations","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-06-c43d"},{"id":"INC-07088","date":"2020-02-06","year":2020,"title":"US Grants Nuro Exemption to Deploy Driverless Delivery Vehicles Lacking Standard Safety Features","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-06-f418"},{"id":"INC-06234","date":"2020-02-06","year":2020,"title":"AI Moderation on Social Media Censors Anti-Fatphobia Magazine Cover","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-06-fc0c"},{"id":"INC-07080","date":"2020-02-07","year":2020,"title":"US Army Seeks AI-Enabled 'Sense Through the Wall' Technology for Combat Use","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-07-4f18"},{"id":"INC-06797","date":"2020-02-07","year":2020,"title":"MIT's TextFooler Exposes Vulnerabilities in Leading AI Language Models","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-07-7637"},{"id":"INC-01269","date":"2020-02-07","year":2020,"title":"AI-Powered CT Diagnostics Aid COVID-19 Detection and Mitigate False Negatives in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-07-7cf4"},{"id":"INC-06322","date":"2020-02-07","year":2020,"title":"AI-Powered Surveillance in China During COVID-19 Leads to Widespread Privacy Violations","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-07-aa1b"},{"id":"INC-06769","date":"2020-02-08","year":2020,"title":"Man Suffers Hypothermia After Following Google Maps Across Frozen River","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-08-cf65"},{"id":"INC-06658","date":"2020-02-09","year":2020,"title":"Google and WeWork Face Lawsuits Over AI-Driven Biometric Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-09-e77c"},{"id":"INC-06547","date":"2020-02-10","year":2020,"title":"FAA Probed After Boeing 737 Max Crashes Linked to Automated Flight-Control System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-10-1265"},{"id":"INC-06616","date":"2020-02-10","year":2020,"title":"Fiat Chrysler and AutoX Announce Robotaxi Launch in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-10-1c78"},{"id":"INC-06318","date":"2020-02-10","year":2020,"title":"AI-Powered Skin Cancer Detection Apps Found Unreliable and Poorly Regulated","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-10-3aa4"},{"id":"INC-06943","date":"2020-02-10","year":2020,"title":"São Paulo Metro Faces Legal Action Over Facial Recognition System and Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-10-9bd5"},{"id":"INC-06212","date":"2020-02-10","year":2020,"title":"AI Algorithm Identifies High Suicide Risk via Text Analysis","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-10-ebe4"},{"id":"INC-06439","date":"2020-02-11","year":2020,"title":"China's AI-Powered Social Credit System Restricts Millions' Rights","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-11-900f"},{"id":"INC-06367","date":"2020-02-11","year":2020,"title":"Apple's AI System Scans iCloud and Email for Child Abuse Images","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-11-fb0e"},{"id":"INC-06849","date":"2020-02-12","year":2020,"title":"Police Use of Clearview AI Facial Recognition Sparks Privacy Lawsuits and Rights Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-12-0d5d"},{"id":"INC-06390","date":"2020-02-12","year":2020,"title":"BAE Systems Develops AI Analytics for WMD Threat Detection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-12-526a"},{"id":"INC-06529","date":"2020-02-12","year":2020,"title":"Epiroc and Partners Deploy Autonomous Mining Trucks in Australia, Raising Future AI Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-12-de6d"},{"id":"INC-06544","date":"2020-02-13","year":2020,"title":"Experts Warn of AI Sex Robots Simulating Harmful and Illegal Scenarios","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-13-1f71"},{"id":"INC-06419","date":"2020-02-13","year":2020,"title":"California Police Misuse AI License Plate Readers, Violating Privacy Laws","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-13-4a88"},{"id":"INC-06546","date":"2020-02-13","year":2020,"title":"Experts Warn of Major Job Losses from AI-Driven Automation in Galicia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-13-828e"},{"id":"INC-06398","date":"2020-02-13","year":2020,"title":"Biometric AI Systems Cause Loss of Benefits and Privacy Breaches","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-13-ece1"},{"id":"INC-06265","date":"2020-02-14","year":2020,"title":"AI Welfare Fraud Detection Systems Wrongly Punish the Poor","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-14-6ad3"},{"id":"INC-14637","date":"2020-02-14","year":2020,"title":"Indian Police Use AI Facial Recognition to Reunite Missing Children","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-14-cbdc"},{"id":"INC-06339","date":"2020-02-16","year":2020,"title":"Alipay Facial Recognition System Exploited by Fraudsters Using AI-Generated 3D Avatars","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-16-a375"},{"id":"INC-07076","date":"2020-02-16","year":2020,"title":"US Army Deploys AI-Enabled Smart Glasses for Combat Targeting","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-16-b0e7"},{"id":"INC-06532","date":"2020-02-16","year":2020,"title":"EU Lawmaker Warns of AI Hazards: Hacking Robots and Deepfake Software Pose New Challenges","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-16-db4f"},{"id":"INC-07110","date":"2020-02-16","year":2020,"title":"Voatz Voting App Security Flaws Raise Election Integrity Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-16-e417"},{"id":"INC-06280","date":"2020-02-16","year":2020,"title":"AI-Driven Voice Phishing Enables Financial Fraud in Cyberattacks","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-16-f29f"},{"id":"INC-06846","date":"2020-02-17","year":2020,"title":"Police and Stadium Use of Facial Recognition AI Raises Privacy Concerns in France and Europe","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-17-5e8b"},{"id":"INC-06628","date":"2020-02-17","year":2020,"title":"French Tax Authorities Use AI to Recover Hundreds of Millions in Tax Fraud Crackdown","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-17-7ce4"},{"id":"INC-06255","date":"2020-02-17","year":2020,"title":"AI System Identifies 11 Potentially Hazardous Asteroids Missed by NASA","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-17-bb2e"},{"id":"INC-06601","date":"2020-02-17","year":2020,"title":"Facial Recognition AI Used by Indian Police Sparks Rights Concerns During Protests","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-17-c04b"},{"id":"INC-06599","date":"2020-02-17","year":2020,"title":"Facial Recognition AI Sparks Global Privacy and Rights Violations Debate","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-17-c064"},{"id":"INC-06964","date":"2020-02-18","year":2020,"title":"Tesla Autopilot Prevents Fatalities During Storm Dennis by Emergency Braking","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-18-956e"},{"id":"INC-06491","date":"2020-02-18","year":2020,"title":"DARPA Seeks Funding for AI-Enabled Unmanned 'Flying Gun' Weapon System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-18-9cd7"},{"id":"INC-07027","date":"2020-02-18","year":2020,"title":"Twitter Bots Amplify Climate Change Denial, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-18-df86"},{"id":"INC-06879","date":"2020-02-19","year":2020,"title":"Researchers Trick Tesla's AI into Dangerous Speeding with Simple Tape Hack","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-19-a3e2"},{"id":"INC-14638","date":"2020-02-19","year":2020,"title":"Yemeni Army Downs Houthi AI-Enabled Drone in Al-Jawf","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-19-b7d2"},{"id":"INC-06825","date":"2020-02-20","year":2020,"title":"Ohio Plans Major Expansion of Facial Recognition Database with Updated License Photos","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-20-0323"},{"id":"INC-07089","date":"2020-02-20","year":2020,"title":"US Homeland Security Algorithm Bars Human Rights Investigator from Entry","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-02-20-eabb"},{"id":"INC-06220","date":"2020-02-21","year":2020,"title":"AI Bots Amplify Political and Climate Disinformation on Twitter","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-21-316b"},{"id":"INC-06401","date":"2020-02-21","year":2020,"title":"Boeing 737 Max MCAS AI System Linked to Fatal Crashes and Regulatory Misconduct","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-21-4c6b"},{"id":"INC-06533","date":"2020-02-21","year":2020,"title":"EU Plans Massive Transatlantic Facial Recognition Database with US Link Raises Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-21-5dec"},{"id":"INC-06800","date":"2020-02-21","year":2020,"title":"Moscow Uses AI Facial Recognition to Enforce Coronavirus Quarantine","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-21-8efd"},{"id":"INC-06916","date":"2020-02-22","year":2020,"title":"Smart Speakers' AI Malfunction Leads to Frequent Accidental Eavesdropping and Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-22-1209"},{"id":"INC-14639","date":"2020-02-22","year":2020,"title":"Audit Reveals Overpriced AI Surveillance Software Purchase by Mexican Police Official","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-22-16da"},{"id":"INC-06884","date":"2020-02-22","year":2020,"title":"Robotic Research to Test Fully Autonomous Unmanned Shuttles Without Onboard Attendants","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-22-3930"},{"id":"INC-06461","date":"2020-02-24","year":2020,"title":"Clearview AI Suffers Data Breach Exposing Law Enforcement Client List","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-24-1735"},{"id":"INC-06327","date":"2020-02-24","year":2020,"title":"AI-Powered Wearable Patch Predicts and Prevents Heart Failure Readmissions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-24-2b11"},{"id":"INC-06409","date":"2020-02-24","year":2020,"title":"Brazilian Police Deploy Live Facial Recognition at Carnival, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-24-a966"},{"id":"INC-07062","date":"2020-02-24","year":2020,"title":"UN Disarmament Chief Warns of AI Military Risks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-24-f3cd"},{"id":"INC-06688","date":"2020-02-26","year":2020,"title":"ICE Uses AI Facial Recognition for Warrantless Searches on Maryland Immigrant Drivers' Licenses","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-26-29bd"},{"id":"INC-06640","date":"2020-02-26","year":2020,"title":"Global Campaign Calls for Ban on AI-Powered Killer Robots","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-26-39b3"},{"id":"INC-06342","date":"2020-02-26","year":2020,"title":"Amazon Alexa Recordings Expose Cheating, Raise Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-26-7f94"},{"id":"INC-06388","date":"2020-02-26","year":2020,"title":"Babylon Health AI Chatbot Faces Criticism Over Unsafe Medical Advice and Data Privacy Breach","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-26-bc4b"},{"id":"INC-07006","date":"2020-02-26","year":2020,"title":"Toronto Smart City Proposal Faces Ongoing AI-Driven Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-26-ead8"},{"id":"INC-06258","date":"2020-02-27","year":2020,"title":"AI Systems Cause Job Losses and Data Breaches, Raise Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-27-42d8"},{"id":"INC-06463","date":"2020-02-27","year":2020,"title":"Clearview AI's Facial Recognition App Sparks Privacy Violations and Regulatory Action","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-27-54df"},{"id":"INC-06880","date":"2020-02-27","year":2020,"title":"Rheinmetall and Australian Partners Develop Autonomous Military Vehicle Technologies","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-27-aab8"},{"id":"INC-06624","date":"2020-02-27","year":2020,"title":"French Court Blocks Facial Recognition in High Schools Over Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-27-d792"},{"id":"INC-07060","date":"2020-02-28","year":2020,"title":"Ultrasonic 'Surfing Attacks' Exploit AI Voice Assistants for Unauthorized Access","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-28-074c"},{"id":"INC-07125","date":"2020-02-28","year":2020,"title":"West Virginia Abandons Voatz Voting App After Security Flaws Exposed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-28-3e4b"},{"id":"INC-06424","date":"2020-02-28","year":2020,"title":"Canadian Privacy Commissioner Investigates RCMP's Use of Clearview AI Facial Recognition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-28-70c3"},{"id":"INC-06507","date":"2020-02-29","year":2020,"title":"Delivery of AI-Enabled Armed Drones to Turkish Gendarmerie Raises Future Risk Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-02-29-5bba"},{"id":"INC-06291","date":"2020-03-01","year":2020,"title":"AI-Enabled Turkish Drones Cause Mass Casualties in Syrian Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-01-4b6a"},{"id":"INC-06687","date":"2020-03-02","year":2020,"title":"ICE Sued for Manipulating AI Risk Assessment to Unlawfully Detain Immigrants","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-02-3eff"},{"id":"INC-06910","date":"2020-03-03","year":2020,"title":"Senators Probe Google and Ascension Over Project Nightingale's AI-Driven Health Data Practices","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-03-3e73"},{"id":"INC-06481","date":"2020-03-03","year":2020,"title":"Controversy Over GendNotes Police App and Automated Sensitive Data Collection in France","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-03-bdda"},{"id":"INC-06306","date":"2020-03-03","year":2020,"title":"AI-Powered Facial Recognition Deployed in Turkish Shopping Malls Raises Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-03-e5c4"},{"id":"INC-06669","date":"2020-03-03","year":2020,"title":"Google's AI Health Data Practices Spark Privacy Backlash and Lawsuit","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-03-eae8"},{"id":"INC-06392","date":"2020-03-04","year":2020,"title":"Banjo AI System Enables Mass Surveillance in Utah, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-04-5835"},{"id":"INC-06714","date":"2020-03-04","year":2020,"title":"Innocent Man Wrongly Targeted by AI-Driven Geofence Warrant","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-04-5864"},{"id":"INC-06310","date":"2020-03-04","year":2020,"title":"AI-Powered Kamikaze Drones Deployed in Turkish Military Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-04-645c"},{"id":"INC-06703","date":"2020-03-04","year":2020,"title":"India Approves Nationwide Automated Facial Recognition for Police Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-04-6a32"},{"id":"INC-06666","date":"2020-03-05","year":2020,"title":"Google Wins $179 Million in Self-Driving AI Trade Secrets Case Against Ex-Uber Executive","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-05-07b1"},{"id":"INC-06517","date":"2020-03-05","year":2020,"title":"Dutch Benefits Agency Reviews AI Fraud Detection After Privacy Ruling","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-05-3577"},{"id":"INC-06311","date":"2020-03-05","year":2020,"title":"AI-Powered Mayflower Ship Prepares for Uncrewed Atlantic Crossing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-05-482a"},{"id":"INC-06690","date":"2020-03-05","year":2020,"title":"IIT Madras Develops AI Drone to Counter Rogue Drones, Raising Future Risk Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-05-84b3"},{"id":"INC-07097","date":"2020-03-05","year":2020,"title":"US Officials Warn of AI-Driven Security Risks from TikTok, Propose Government Ban","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-05-c884"},{"id":"INC-06460","date":"2020-03-06","year":2020,"title":"Clearview AI Misused for Private Surveillance and Privacy Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-06-03fd"},{"id":"INC-06314","date":"2020-03-06","year":2020,"title":"AI-Powered Police Body Cameras and Robot Vacuums Raise Privacy Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-06-5db3"},{"id":"INC-06873","date":"2020-03-06","year":2020,"title":"Researchers Demonstrate AI Vulnerability in Autonomous Vehicle Perception Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-06-937c"},{"id":"INC-06476","date":"2020-03-07","year":2020,"title":"Concerns Over Facial Recognition Rollouts in Singapore and U.S. Schools","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-07-26c2"},{"id":"INC-06968","date":"2020-03-07","year":2020,"title":"Tesla Faces Regulatory Action and Consumer Backlash Over AI Hardware Downgrade in China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-07-4abf"},{"id":"INC-07094","date":"2020-03-08","year":2020,"title":"US Navy Develops AI-Controlled Submarines Capable of Lethal Autonomy","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-08-484d"},{"id":"INC-06450","date":"2020-03-09","year":2020,"title":"Chinese Facial Recognition AI Identifies Masked Individuals, Raising Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-09-0cc6"},{"id":"INC-06428","date":"2020-03-10","year":2020,"title":"Chess Board Startup Uses AI-Generated Fake Engineers and Product Demo to Defraud Backers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-10-3e8e"},{"id":"INC-07037","date":"2020-03-10","year":2020,"title":"Uber Resumes Self-Driving Car Testing in San Francisco After Fatal Crash","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-10-6d7c"},{"id":"INC-06467","date":"2020-03-11","year":2020,"title":"Clearview AI's Facial Recognition Sparks Legal, Privacy, and Security Incidents","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-11-97b1"},{"id":"INC-06707","date":"2020-03-11","year":2020,"title":"India's Faulty Facial Recognition System Misidentifies Delhi Rioters","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-11-98fe"},{"id":"INC-06489","date":"2020-03-11","year":2020,"title":"DARPA Develops AI for Autonomous Jet Dogfighting, Raising Future Risk Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-11-e83d"},{"id":"INC-14640","date":"2020-03-12","year":2020,"title":"Volkswagen Aims for Zero Accidents with AI-Driven Vehicle Software by 2050","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-12-0b72"},{"id":"INC-06730","date":"2020-03-14","year":2020,"title":"Israel Deploys AI-Enabled Surveillance to Track COVID-19 Carriers, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-14-319e"},{"id":"INC-07015","date":"2020-03-14","year":2020,"title":"Turkey Deploys AI-Enabled Bayraktar TB2 Drones for Border Patrols at Evros","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-14-53dc"},{"id":"INC-06442","date":"2020-03-14","year":2020,"title":"China's First AI-Generated Article Copyright Infringement Case Decided","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-14-5900"},{"id":"INC-07045","date":"2020-03-14","year":2020,"title":"UK Collaboration with China on Facial Recognition Tech Raises Human Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-14-f3e0"},{"id":"INC-06498","date":"2020-03-16","year":2020,"title":"Deepfake AI Used in Financial Fraud and Phishing Scams","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-16-9651"},{"id":"INC-06998","date":"2020-03-16","year":2020,"title":"TikTok's AI Moderation Suppresses Content from Marginalized Groups","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-03-16-a666"},{"id":"INC-06247","date":"2020-03-17","year":2020,"title":"AI Surveillance Drones Enforce COVID-19 Lockdown in Spain","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-17-177e"},{"id":"INC-06246","date":"2020-03-17","year":2020,"title":"AI Surveillance and Fever Detection Technologies Raise Privacy Concerns Amid COVID-19 Response","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-17-454e"},{"id":"INC-06955","date":"2020-03-17","year":2020,"title":"Tesla Autopilot Design Flaws and Regulatory Gaps Blamed in Fatal 2019 Crash","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-17-cdf9"},{"id":"INC-06323","date":"2020-03-17","year":2020,"title":"AI-Powered Surveillance in East Asia Raises Privacy and Human Rights Concerns During COVID-19 Response","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-17-f055"},{"id":"INC-07114","date":"2020-03-18","year":2020,"title":"Volvo Recalls Over 700,000 Vehicles Due to AI-Driven Emergency Braking System Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-18-b475"},{"id":"INC-06850","date":"2020-03-19","year":2020,"title":"Polish Government Deploys AI App for Quarantine Enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-19-7da4"},{"id":"INC-06917","date":"2020-03-20","year":2020,"title":"Smart Speakers' AI Raise Privacy Concerns for Remote Workers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-20-ee93"},{"id":"INC-06262","date":"2020-03-21","year":2020,"title":"AI Tool Guides Life-or-Death Covid-19 Treatment Decisions in China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-21-cb18"},{"id":"INC-06307","date":"2020-03-24","year":2020,"title":"AI-Powered Facial Recognition Used for Quarantine Enforcement in Moscow","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-24-abd3"},{"id":"INC-06308","date":"2020-03-24","year":2020,"title":"AI-Powered Fever Detection and Contact Tracing Deployed for COVID-19 Control in Hong Kong","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-24-b4c2"},{"id":"INC-06249","date":"2020-03-25","year":2020,"title":"AI Surveillance Technologies Used to Enforce Covid-19 Quarantines and Restrict Civil Liberties","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-25-05da"},{"id":"INC-06537","date":"2020-03-25","year":2020,"title":"Exaggerated Claims of AI Outperforming Doctors in Medical Imaging Raise Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-25-d6c4"},{"id":"INC-07025","date":"2020-03-26","year":2020,"title":"TuSimple and ZF Partner to Develop Autonomous Truck Technology, Raising Future AI Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-26-4695"},{"id":"INC-06312","date":"2020-03-26","year":2020,"title":"AI-Powered Pandemic Drones Raise Privacy and Misidentification Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-26-99cb"},{"id":"INC-06771","date":"2020-03-27","year":2020,"title":"Massive Sale of Masked Face Photos for AI Training Sparks Privacy Fears in China","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-27-8173"},{"id":"INC-06833","date":"2020-03-29","year":2020,"title":"Pandemic-Era AI Surveillance Raises Global Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-03-29-e82e"},{"id":"INC-06235","date":"2020-04-01","year":2020,"title":"AI Moderation Shortfalls During Lockdown Linked to Rise in Online Child Abuse","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-01-93d3"},{"id":"INC-07009","date":"2020-04-01","year":2020,"title":"Trump Campaign Uses AI-Generated Audio to Falsely Attribute 'Hoax' Comment to Biden","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-01-b07e"},{"id":"INC-06221","date":"2020-04-03","year":2020,"title":"AI Bots Drive Majority of Pro-Bolsonaro Tweets, Study Finds","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-03-1035"},{"id":"INC-06593","date":"2020-04-03","year":2020,"title":"Facial Recognition AI Expands Amid COVID-19, Raising Civil Liberties Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-03-1274"},{"id":"INC-06508","date":"2020-04-04","year":2020,"title":"Delivery of AI-Enabled Kargu-2 Armed Drones to Security Forces Raises Risk Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-04-7036"},{"id":"INC-06469","date":"2020-04-05","year":2020,"title":"Clearview AI's Facial Recognition System Linked to Far-Right Extremists and Human Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-05-34e1"},{"id":"INC-06665","date":"2020-04-05","year":2020,"title":"Google Sued for Unlawful Biometric Data Collection from Schoolchildren via AI Tools","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-05-e61b"},{"id":"INC-06602","date":"2020-04-07","year":2020,"title":"Facial Recognition AI Used to Enforce Quarantine and Monitor Public Health During COVID-19","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-07-6f2c"},{"id":"INC-06416","date":"2020-04-07","year":2020,"title":"California Approves Nuro's Driverless Delivery Vehicles for Public Road Testing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-07-9848"},{"id":"INC-06313","date":"2020-04-09","year":2020,"title":"AI-Powered Phone Apps Developed for COVID-19 Diagnosis via Voice and Cough Analysis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-09-3815"},{"id":"INC-06490","date":"2020-04-09","year":2020,"title":"DARPA Launches GARD Program to Defend AI Against Adversarial Attacks","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-09-d666"},{"id":"INC-06229","date":"2020-04-10","year":2020,"title":"AI Imaging Systems Aid COVID-19 Diagnosis and Harm Reduction in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-10-29ca"},{"id":"INC-06760","date":"2020-04-10","year":2020,"title":"Libyan Army Downs Turkish AI-Powered Drones Targeting Military and Civilian Sites","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-10-9fa9"},{"id":"INC-06386","date":"2020-04-10","year":2020,"title":"AutoX and Didi Launch Major Robotaxi Operations in Shanghai","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-10-b2b3"},{"id":"INC-06951","date":"2020-04-11","year":2020,"title":"Tencent Disables QQ Group Recommendations After AI System Exposes Minors to Harmful Content","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-11-072f"},{"id":"INC-06641","date":"2020-04-13","year":2020,"title":"Global Concerns Rise Over AI Facial Recognition Surveillance and Regulation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-13-11ba"},{"id":"INC-06520","date":"2020-04-13","year":2020,"title":"Dutch Scientists Warn of Risks in AI-Enabled COVID-19 Tracking Apps","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-13-1876"},{"id":"INC-06813","date":"2020-04-14","year":2020,"title":"New Taipei Launches Autonomous Bus Testing for Public Transport","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-14-903b"},{"id":"INC-06735","date":"2020-04-15","year":2020,"title":"Israeli AI-Enabled Drone Targets Hezbollah Vehicle on Syria-Lebanon Border","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-15-98c1"},{"id":"INC-06795","date":"2020-04-16","year":2020,"title":"MIT AI Predicts Catastrophic COVID-19 Surge if Social Distancing Ends Prematurely","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-16-164b"},{"id":"INC-06796","date":"2020-04-16","year":2020,"title":"MIT Researchers Test AI App to Diagnose COVID-19 from Cough Sounds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-16-b677"},{"id":"INC-06630","date":"2020-04-16","year":2020,"title":"Fujitsu AI System Reduces Ship Collision Risks in Tokyo Bay Trial","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-16-d2f1"},{"id":"INC-06684","date":"2020-04-17","year":2020,"title":"Hyundai Recalls 2020 Sonata and Nexo Over AI Parking Assist Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-17-b751"},{"id":"INC-06299","date":"2020-04-17","year":2020,"title":"AI-Generated Virtual Avatars of the Deceased Raise Privacy and Ethical Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-17-c167"},{"id":"INC-06377","date":"2020-04-19","year":2020,"title":"Australian Universities' AI Exam Proctoring Sparks Privacy and Rights Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-19-c334"},{"id":"INC-06750","date":"2020-04-19","year":2020,"title":"Karsan Develops Level-4 Autonomous Electric Bus Prototype","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-19-c7da"},{"id":"INC-14641","date":"2020-04-20","year":2020,"title":"AI Voice Robots Enable Large-Scale Scam Calls in China’s '95' Number Segment","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-20-12f0"},{"id":"INC-06904","date":"2020-04-20","year":2020,"title":"Scientists Warn of Mass Surveillance Risks from AI-Enabled COVID-19 Contact-Tracing Apps","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-20-1ab1"},{"id":"INC-06226","date":"2020-04-20","year":2020,"title":"AI Facial Recognition Used to Prevent Telecom Fraud and Raises Privacy Concerns in China","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-20-30bd"},{"id":"INC-06737","date":"2020-04-20","year":2020,"title":"Italian Parliament Debates Privacy and Legal Safeguards for AI-Powered 'Immuni' Contact Tracing App","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-04-20-a512"},{"id":"INC-06890","date":"2020-04-21","year":2020,"title":"Russia Develops Autonomous Combat Robot with Lethal Capabilities","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-21-5a5a"},{"id":"INC-06347","date":"2020-04-21","year":2020,"title":"Amazon Ring Considers Adding AI-Powered Facial and License Plate Recognition to Home Cameras","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-21-8de9"},{"id":"INC-06337","date":"2020-04-21","year":2020,"title":"Alberta Privacy Commissioner Investigates AI-Powered Babylon Health App Over Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-21-f136"},{"id":"INC-07129","date":"2020-04-22","year":2020,"title":"Widespread Use of AI Facial Recognition Leads to Privacy Violations and Legal Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-22-24b1"},{"id":"INC-06568","date":"2020-04-23","year":2020,"title":"Facebook Removes 'Pseudoscience' Ad Category After AI-Driven Misinformation Targeting","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-23-4cc1"},{"id":"INC-14642","date":"2020-04-23","year":2020,"title":"AI Surveillance in Russia's Lockdown Raises Human Rights Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-23-af7f"},{"id":"INC-07099","date":"2020-04-24","year":2020,"title":"US Police Test AI-Equipped Drones for Covid-19 Symptom Detection in Crowds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-24-2767"},{"id":"INC-06478","date":"2020-04-25","year":2020,"title":"Connecticut Town Cancels AI-Powered Pandemic Drone Program After Privacy Outcry","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-25-143e"},{"id":"INC-06715","date":"2020-04-27","year":2020,"title":"Instagram Algorithm Manipulated by Coordinated 'Pods' Using AI Detection Tools","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-27-4480"},{"id":"INC-06670","date":"2020-04-27","year":2020,"title":"Google's AI Health Screening Tool Fails in Real-World Clinical Trials","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-27-9884"},{"id":"INC-06682","date":"2020-04-30","year":2020,"title":"Hungarian Police Deploy Facial Recognition for Identity Checks, Raising Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-04-30-0901"},{"id":"INC-07133","date":"2020-05-01","year":2020,"title":"Xiaomi Accused of AI-Driven User Data Tracking and Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-01-9308"},{"id":"INC-06859","date":"2020-05-02","year":2020,"title":"Privacy Concerns Raised Over India's Aarogya Setu COVID-19 App","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-02-f132"},{"id":"INC-06273","date":"2020-05-02","year":2020,"title":"AI-Driven Information Warfare Tool Repurposed for US Political Campaigns","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-02-f51e"},{"id":"INC-07053","date":"2020-05-03","year":2020,"title":"UK Plans AI-Driven Facial Recognition Health Passports for COVID-19 Response","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-05-03-1551"},{"id":"INC-07106","date":"2020-05-03","year":2020,"title":"Utah Suspends AI Policing Contract Over CEO's Extremist Past and Bias Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-03-b1f4"},{"id":"INC-06858","date":"2020-05-04","year":2020,"title":"Privacy Concerns Over Palantir's AI Use in NHS and Covid-19 Data Projects","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-04-58a8"},{"id":"INC-07105","date":"2020-05-04","year":2020,"title":"US Universities Develop AI-Powered COVID-19 Surveillance and Risk Scoring System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-05-04-7b59"},{"id":"INC-06453","date":"2020-05-04","year":2020,"title":"Civil Liberties Groups Warn of Privacy Risks from AI-Powered Fever-Detecting Drones","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-04-874b"},{"id":"INC-06733","date":"2020-05-04","year":2020,"title":"Israel Procures AI-Enabled Spike FireFly Loitering Munitions for Urban Combat","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-04-c10d"},{"id":"INC-06403","date":"2020-05-05","year":2020,"title":"Boeing Unveils AI-Enabled Loyal Wingman Drone for Australian Military","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-05-6dfc"},{"id":"INC-06457","date":"2020-05-05","year":2020,"title":"Clearview AI Faces Legal Action Over Facial Recognition Use by Private Firms","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-05-9f10"},{"id":"INC-06677","date":"2020-05-06","year":2020,"title":"Greece Leases Israeli AI-Enabled Drones for Border Surveillance","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-06-2bd6"},{"id":"INC-06763","date":"2020-05-07","year":2020,"title":"Lockheed Martin Demonstrates AI-Powered Autonomous ISR System in Simulated Denied Communications Environment","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-07-bb93"},{"id":"INC-07121","date":"2020-05-07","year":2020,"title":"WeChat Uses AI to Monitor and Censor International Users' Content for Chinese Censorship System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-07-e601"},{"id":"INC-06288","date":"2020-05-08","year":2020,"title":"AI-Enabled Drones Used for Policing and Warfare Cause Privacy and Physical Harm Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-08-684f"},{"id":"INC-06527","date":"2020-05-08","year":2020,"title":"Elon Musk's Neuralink Plans Human Brain Implant Within a Year","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-08-e2a8"},{"id":"INC-06946","date":"2020-05-09","year":2020,"title":"Tech Giants Face Lawsuits Over AI-Driven Biometric Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-09-175d"},{"id":"INC-07012","date":"2020-05-09","year":2020,"title":"Turkey Begins Serial Production of Armed Autonomous Ground Vehicles","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-09-2f2d"},{"id":"INC-07056","date":"2020-05-10","year":2020,"title":"UK Police Deploy AI Technologies Without Public Consultation, Raising Bias and Trust Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-10-1ae3"},{"id":"INC-06465","date":"2020-05-11","year":2020,"title":"Clearview AI's Facial Recognition Sparks Global Privacy and Rights Violations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-11-491d"},{"id":"INC-07103","date":"2020-05-12","year":2020,"title":"US Senator Calls for Oversight After AI Spyware Pegasus Pitched to Police","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-12-0d97"},{"id":"INC-06612","date":"2020-05-12","year":2020,"title":"FarEasTone Uses AI to Block Over 99% of Scam SMS, Preventing Financial Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-12-1514"},{"id":"INC-06572","date":"2020-05-12","year":2020,"title":"Facebook Uses AI to Remove 50 Million COVID-19 Misinformation Posts","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-12-393e"},{"id":"INC-06233","date":"2020-05-12","year":2020,"title":"AI Moderation on Facebook and Twitter Struggles to Contain COVID-19 Misinformation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-12-b81f"},{"id":"INC-06623","date":"2020-05-12","year":2020,"title":"Ford Recalls 40,000 Vehicles Over Faulty AI Collision Avoidance System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-12-ecfd"},{"id":"INC-07001","date":"2020-05-13","year":2020,"title":"TikTok/Douyin AI Algorithms Used for Censorship and Propaganda, Raising Global Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-13-63a8"},{"id":"INC-06303","date":"2020-05-13","year":2020,"title":"AI-Powered COVID-19 Surveillance Apps Raise Privacy Concerns in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-13-700b"},{"id":"INC-06681","date":"2020-05-13","year":2020,"title":"Human Rights Watch Warns COVID-19 Tracking Apps Violate Human Rights","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-13-9146"},{"id":"INC-06556","date":"2020-05-13","year":2020,"title":"Facebook Apologizes for AI Moderation Failures in 2018 Sri Lanka Violence","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-13-b4ce"},{"id":"INC-06531","date":"2020-05-13","year":2020,"title":"EU Consumer Groups Warn of AI-Driven Privacy Risks in Google-Fitbit Merger","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-13-f7f2"},{"id":"INC-06988","date":"2020-05-14","year":2020,"title":"TikTok Accused of Violating Children's Privacy Laws Through AI Data Collection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-14-0912"},{"id":"INC-06751","date":"2020-05-15","year":2020,"title":"Karsan's Level-4 Autonomous Bus Receives First Order for Pilot Deployment in Romania","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-15-1c4d"},{"id":"INC-06761","date":"2020-05-16","year":2020,"title":"Libyan Army Shoots Down Turkish AI Drones in Tripoli Conflict","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-16-ce7c"},{"id":"INC-06657","date":"2020-05-17","year":2020,"title":"Google AI System Displays Defamatory Label About Cristina Kirchner","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-17-2e47"},{"id":"INC-06250","date":"2020-05-17","year":2020,"title":"AI Symptom Checkers Found Inaccurate, Risking Public Health","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-17-95c2"},{"id":"INC-06826","date":"2020-05-17","year":2020,"title":"OnePlus 8 Pro's AI Camera Filter Disabled Over Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-17-b65b"},{"id":"INC-06304","date":"2020-05-18","year":2020,"title":"AI-Powered Drones Used for COVID-19 Surveillance Raise Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-18-7e5e"},{"id":"INC-06663","date":"2020-05-18","year":2020,"title":"Google Nest Hub Bug Exposes Private Video Footage to Unauthorized Users","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-18-c916"},{"id":"INC-07075","date":"2020-05-20","year":2020,"title":"US and Russia Advance AI-Enabled Autonomous Combat Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-20-47d3"},{"id":"INC-06369","date":"2020-05-20","year":2020,"title":"Apple's Siri AI Accused of Mass Privacy Violations by Whistleblower","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-20-734e"},{"id":"INC-06944","date":"2020-05-21","year":2020,"title":"Tainan Considers Autonomous Metro System with AI-Driven Virtual Tracks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-21-0e07"},{"id":"INC-07148","date":"2020-05-21","year":2020,"title":"Zuckerberg Admits Facebook's AI Failed to Prevent 2016 Election Disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-21-4daf"},{"id":"INC-06305","date":"2020-05-21","year":2020,"title":"AI-Powered Exam Proctoring Sparks Privacy Backlash in French Universities","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-21-77b5"},{"id":"INC-06464","date":"2020-05-21","year":2020,"title":"Clearview AI's Facial Recognition Sparks Global Privacy and Rights Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-21-c90d"},{"id":"INC-07104","date":"2020-05-23","year":2020,"title":"US Tech Giants Enable Blacklisted Chinese AI Surveillance Firms Linked to Human Rights Abuses","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-23-c78a"},{"id":"INC-06260","date":"2020-05-25","year":2020,"title":"AI Systems Fail Amid COVID-19 Mask Usage and Behavioral Shifts","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-25-02ac"},{"id":"INC-06837","date":"2020-05-25","year":2020,"title":"Permanent Health Code AI System in Hangzhou Raises Privacy and Discrimination Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-05-25-48f5"},{"id":"INC-06372","date":"2020-05-25","year":2020,"title":"Artist Tricks Google Maps AI to Create Fake Traffic Jams in Berlin","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-25-7ddf"},{"id":"INC-07136","date":"2020-05-26","year":2020,"title":"YouTube AI Moderation System Censors Comments Critical of Chinese Communist Party","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-26-2362"},{"id":"INC-06564","date":"2020-05-26","year":2020,"title":"Facebook Executives Ignored Internal Warnings About AI-Driven Polarization and Extremism","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-26-3685"},{"id":"INC-06742","date":"2020-05-27","year":2020,"title":"Japan's Super City Law Raises AI-Driven Privacy and Surveillance Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-27-16c7"},{"id":"INC-06830","date":"2020-05-28","year":2020,"title":"Pakistan Repurposes AI Surveillance Tech for COVID-19 Tracking, Raising Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-28-bbfa"},{"id":"INC-06724","date":"2020-05-29","year":2020,"title":"Iran Unveils AI-Powered Unmanned Combat Submarine, Joining Elite Naval Powers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-29-8a9a"},{"id":"INC-06847","date":"2020-05-29","year":2020,"title":"Police Crackdown Reduces Harmful Bot Activity Spreading Fake News in Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-29-f7ca"},{"id":"INC-06360","date":"2020-05-31","year":2020,"title":"Amsterdam University Students Sue Over AI Exam Surveillance Software","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-05-31-acec"},{"id":"INC-06719","date":"2020-06-01","year":2020,"title":"Instagram's AI Anti-Spam System Wrongly Blocks Black Lives Matter Posts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-01-1c51"},{"id":"INC-06468","date":"2020-06-01","year":2020,"title":"Clearview AI's Facial Recognition Sparks Privacy Lawsuits and Protest Surveillance Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-01-4526"},{"id":"INC-06499","date":"2020-06-02","year":2020,"title":"Deepfake AI Used in Ransomware and Fraud Schemes Raises Global Alarm","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-02-c654"},{"id":"INC-06759","date":"2020-06-03","year":2020,"title":"LGBTQ Creators Sue YouTube Over Alleged Algorithmic Discrimination","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-03-06e1"},{"id":"INC-06991","date":"2020-06-03","year":2020,"title":"TikTok Apologizes for AI-Driven Suppression of Black Lives Matter Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-03-900f"},{"id":"INC-07072","date":"2020-06-05","year":2020,"title":"US Air Force Plans Human vs. AI Fighter Jet Dogfight","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-05-295e"},{"id":"INC-07018","date":"2020-06-05","year":2020,"title":"Turkey Develops Autonomous Swarm Military Robots with AI","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-05-7a94"},{"id":"INC-06857","date":"2020-06-05","year":2020,"title":"Predator Drone Surveillance of Minneapolis Protesters Sparks Rights Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-05-a2b0"},{"id":"INC-14643","date":"2020-06-05","year":2020,"title":"Israel Plans AI-Enabled Armed Robot Border Wall with Gaza","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-05-ea30"},{"id":"INC-06456","date":"2020-06-08","year":2020,"title":"Clearview AI and Amazon Face Legal and Ethical Scrutiny Over Facial Recognition Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-08-64f9"},{"id":"INC-06514","date":"2020-06-08","year":2020,"title":"Dubai Deploys AI Platform to Monitor COVID-19 Safety Compliance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-08-9f94"},{"id":"INC-07035","date":"2020-06-08","year":2020,"title":"U.S. Army Reveals and Tests AI-Enabled Hypersonic Loitering Weapon System","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-08-ac25"},{"id":"INC-06282","date":"2020-06-08","year":2020,"title":"AI-Enabled Armed Drones Used in Fatal Border Operation Against PKK Militants","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-08-e1be"},{"id":"INC-06731","date":"2020-06-08","year":2020,"title":"Israel Halts AI-Enabled Phone Surveillance of COVID-19 Patients Amid Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-08-fad5"},{"id":"INC-06397","date":"2020-06-09","year":2020,"title":"Belgian Coast Deploys AI Cameras for Tourist Crowd Monitoring","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-09-b67f"},{"id":"INC-06963","date":"2020-06-10","year":2020,"title":"Tesla Autopilot Prevents Collision with Wild Boar in Belgium","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-10-258f"},{"id":"INC-06843","date":"2020-06-10","year":2020,"title":"PimEyes Facial Recognition Tool Raises Global Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-10-713a"},{"id":"INC-06891","date":"2020-06-10","year":2020,"title":"Russia Develops Global AI-Enabled Drone Network, Raising Fears of Autonomous Weapons Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-10-ad2e"},{"id":"INC-06790","date":"2020-06-11","year":2020,"title":"Microsoft Refuses to Sell Facial Recognition AI to Police Amid Misuse Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-11-c493"},{"id":"INC-14644","date":"2020-06-12","year":2020,"title":"AI-Powered Drones Monitor Social Distancing and Mask Compliance, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-12-a1d9"},{"id":"INC-06740","date":"2020-06-12","year":2020,"title":"Japan Launches Large-Scale Autonomous Ship Trials, Raising Future AI Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-12-e687"},{"id":"INC-06550","date":"2020-06-14","year":2020,"title":"FaceApp's AI Gender-Swap Feature Raises Privacy and Rights Concerns","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-14-c398"},{"id":"INC-07024","date":"2020-06-15","year":2020,"title":"Turkish Military Deploys AI-Powered Swarming Kamikaze Drones with Facial Recognition","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-15-0629"},{"id":"INC-06598","date":"2020-06-15","year":2020,"title":"Facial Recognition AI Services Raise Privacy and Safety Concerns in EU and Beyond","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-15-5b0a"},{"id":"INC-06747","date":"2020-06-15","year":2020,"title":"John Oliver Highlights Harms of Facial Recognition AI Used by Law Enforcement and Private Firms","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-15-645a"},{"id":"INC-06897","date":"2020-06-15","year":2020,"title":"Russian Schools Deploy AI Facial Recognition Surveillance System","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-15-729a"},{"id":"INC-06359","date":"2020-06-16","year":2020,"title":"Amnesty International Warns COVID-19 Tracing Apps Violate Human Rights","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-16-db43"},{"id":"INC-14645","date":"2020-06-17","year":2020,"title":"Santa Cruz Bans Predictive Policing Over Algorithmic Bias and Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-17-0154"},{"id":"INC-06625","date":"2020-06-17","year":2020,"title":"French Data Regulator Warns Against Unchecked Use of AI Surveillance Cameras During Covid-19","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-17-c0e2"},{"id":"INC-06437","date":"2020-06-18","year":2020,"title":"China's AI-Driven Mass DNA Collection Enables Unprecedented Surveillance and Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-18-42e7"},{"id":"INC-07140","date":"2020-06-19","year":2020,"title":"YouTube Sued Over Alleged AI-Driven Racial Discrimination Against Black Creators","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-19-2258"},{"id":"INC-06494","date":"2020-06-19","year":2020,"title":"Deep Learning in Search Engines Causes Sexist Bias, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-19-4780"},{"id":"INC-06919","date":"2020-06-19","year":2020,"title":"Snapchat Faces Backlash Over AI Juneteenth Filter Requiring Users to Smile to Break Chains","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-19-6269"},{"id":"INC-06607","date":"2020-06-20","year":2020,"title":"Facial Recognition Misuse in China: Property Theft and Legal Disputes Highlight AI Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-20-4282"},{"id":"INC-06799","date":"2020-06-20","year":2020,"title":"Moroccan Journalist Targeted by AI-Driven Spyware Pegasus","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-20-6b83"},{"id":"INC-06259","date":"2020-06-20","year":2020,"title":"AI Systems Exhibit Racial Bias, Leading to Discriminatory Outcomes","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-20-e885"},{"id":"INC-06543","date":"2020-06-21","year":2020,"title":"Experts Warn of AI Hazards: Unpredictable Algorithms and Societal Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-21-dec2"},{"id":"INC-06203","date":"2020-06-22","year":2020,"title":"7-Eleven Australia's Nationwide Facial Recognition Rollout Raises Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-8434"},{"id":"INC-06823","date":"2020-06-22","year":2020,"title":"NYCLU Sues Over Facial Recognition in Lockport Schools for Privacy and Bias Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-a64b"},{"id":"INC-06856","date":"2020-06-22","year":2020,"title":"Potential Accessibility Risks in Self-Driving Taxi Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-a9b8"},{"id":"INC-06938","date":"2020-06-22","year":2020,"title":"Study Finds Uber and Lyft Algorithms Charge Higher Fares in Non-White Neighborhoods","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-d311"},{"id":"INC-06683","date":"2020-06-22","year":2020,"title":"Hungarian-Austrian Autonomous Vehicle Test on Public Road Highlights AI Infrastructure Development","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-de8d"},{"id":"INC-06996","date":"2020-06-22","year":2020,"title":"TikTok's AI Algorithm Criticized for Promoting Harmful Content and Censorship","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-22-fefc"},{"id":"INC-06208","date":"2020-06-23","year":2020,"title":"ACLU Raises Alarm Over Facial Recognition Screening at Hawaii Airports","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-23-0ee4"},{"id":"INC-06581","date":"2020-06-23","year":2020,"title":"Facebook's AI Fails to Curb Hate Speech in Private Groups","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-23-700d"},{"id":"INC-06510","date":"2020-06-23","year":2020,"title":"Didi Chuxing Plans Massive Robotaxi Deployment with BAIC Partnership","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-23-b94c"},{"id":"INC-06643","date":"2020-06-24","year":2020,"title":"Global Outcry Over AI Crime Prediction Software Due to Racial Bias Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-24-4d81"},{"id":"INC-06276","date":"2020-06-24","year":2020,"title":"AI-Driven Social Credit Scores Deny Financial Services Globally","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-24-9505"},{"id":"INC-06271","date":"2020-06-24","year":2020,"title":"AI-Driven Bots and Algorithms Manipulate Social Media, Fueling Misinformation and Division","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-24-bf0b"},{"id":"INC-14646","date":"2020-06-25","year":2020,"title":"UN Calls for Moratorium on Facial Recognition at Peaceful Protests Amid Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-06-25-550d"},{"id":"INC-06958","date":"2020-06-26","year":2020,"title":"Tesla Autopilot Mistakes Burger King Logo for Stop Sign, Prompting Safety Concerns and Viral Marketing","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-26-83d4"},{"id":"INC-06634","date":"2020-06-28","year":2020,"title":"German Debate on AI-Enabled Armed Drones Raises Ethical and Political Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-28-3eda"},{"id":"INC-06400","date":"2020-06-28","year":2020,"title":"Boeing 737 Max AI System Malfunction Leads to Fatal Crashes and Regulatory Overhaul","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-28-4dfd"},{"id":"INC-06685","date":"2020-06-29","year":2020,"title":"IAI and Iron Drone Integrate Autonomous AI Interceptor Drones for Anti-Drone Defense","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-29-9402"},{"id":"INC-06855","date":"2020-06-29","year":2020,"title":"Portuguese Data Protection Authority Flags Risks in Covid-19 Contact Tracing App's Use of Google and Apple Interfaces","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-29-cd7c"},{"id":"INC-06704","date":"2020-06-30","year":2020,"title":"India Bans TikTok Over National Security and Data Privacy Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-06-30-a251"},{"id":"INC-06222","date":"2020-07-01","year":2020,"title":"AI Camera System Deployed in Japanese Banks to Prevent Phone Fraud","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-01-2807"},{"id":"INC-07026","date":"2020-07-01","year":2020,"title":"TuSimple Launches Autonomous Freight Network with Major Logistics Partners","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-01-3dea"},{"id":"INC-06734","date":"2020-07-01","year":2020,"title":"Israel Reinstates AI-Powered Shin Bet Surveillance for COVID-19 Tracking Amid Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-01-aa2e"},{"id":"INC-07112","date":"2020-07-01","year":2020,"title":"Voice Assistants' False Triggers Lead to Widespread Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-01-b7d8"},{"id":"INC-06777","date":"2020-07-02","year":2020,"title":"Mercadona's Facial Recognition System Sparks Privacy and Legal Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-02-84aa"},{"id":"INC-06300","date":"2020-07-02","year":2020,"title":"AI-Powered 'Virtual Wall' Deployed on US-Mexico Border Raises Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-02-8528"},{"id":"INC-07020","date":"2020-07-02","year":2020,"title":"Turkey Launches Investigation into TikTok Over AI-Driven Data Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-02-96bc"},{"id":"INC-06348","date":"2020-07-02","year":2020,"title":"Amazon Ring Partnerships with Police Raise Civil Rights and Surveillance Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-07-02-cafd"},{"id":"INC-06728","date":"2020-07-02","year":2020,"title":"Israel Deploys AI-Driven Military Intelligence Unit 9900","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-02-ed02"},{"id":"INC-06600","date":"2020-07-05","year":2020,"title":"Facial Recognition AI Sparks Human Rights and Civil Liberties Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-05-10f6"},{"id":"INC-06462","date":"2020-07-06","year":2020,"title":"Clearview AI Suspends Facial Recognition Services in Canada Amid Privacy Investigation","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-06-b6f6"},{"id":"INC-06530","date":"2020-07-06","year":2020,"title":"Ethical Gaps in AI for Autonomous Vehicles Pose Future Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-06-bf42"},{"id":"INC-06557","date":"2020-07-08","year":2020,"title":"Facebook Audit Finds AI Moderation Failures Harm Civil Rights","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-07-08-9e8e"},{"id":"INC-07083","date":"2020-07-08","year":2020,"title":"US Considers TikTok Ban Over AI-Driven Security and Misinformation Concerns","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-08-a90a"},{"id":"INC-14647","date":"2020-07-08","year":2020,"title":"US Investigates TikTok for Alleged Violations of Children's Privacy Agreement","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-08-db8a"},{"id":"INC-07061","date":"2020-07-09","year":2020,"title":"UN Condemns US Drone Strike Killing Iranian General Soleimani as Unlawful Use of AI Weapons","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-09-2cfd"},{"id":"INC-06493","date":"2020-07-09","year":2020,"title":"Dataminr AI Used to Surveil Black Lives Matter Protesters via Twitter Data","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-09-83d3"},{"id":"INC-06992","date":"2020-07-10","year":2020,"title":"TikTok Faces Global Scrutiny Over AI-Driven Data Privacy and Espionage Concerns","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-10-2c0c"},{"id":"INC-07124","date":"2020-07-10","year":2020,"title":"WeRide Begins Fully Driverless Vehicle Testing in China, Raising AI Safety Concerns","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-10-6e6f"},{"id":"INC-06667","date":"2020-07-10","year":2020,"title":"Google's AI Algorithms Allegedly Manipulate Voter Behavior in US Elections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-10-93bb"},{"id":"INC-06989","date":"2020-07-12","year":2020,"title":"TikTok Algorithm Amplifies Viral Nazi Chant Before Removal","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-12-00cf"},{"id":"INC-06868","date":"2020-07-13","year":2020,"title":"RCMP Faces Lawsuit Over Use of Clearview AI Facial Recognition Technology in Canada","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-13-35c7"},{"id":"INC-06912","date":"2020-07-13","year":2020,"title":"Shipt Workers Protest Algorithmic Pay Cuts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-13-9728"},{"id":"INC-07127","date":"2020-07-13","year":2020,"title":"Widespread Harm from AI-Powered Facial Recognition and Deepfake Tools in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-13-ad1b"},{"id":"INC-06466","date":"2020-07-13","year":2020,"title":"Clearview AI's Facial Recognition Sparks Global Privacy Violations and Investigations","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-13-f7b7"},{"id":"INC-07068","date":"2020-07-14","year":2020,"title":"US Air Force Advances Testing of AI-Enabled Autonomous Swarming Munitions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-0761"},{"id":"INC-07146","date":"2020-07-14","year":2020,"title":"YouTube's Biased AI Recommendations Spread Health Misinformation and Worsen Disparities","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-13c4"},{"id":"INC-06236","date":"2020-07-14","year":2020,"title":"AI Navigation Errors Endanger Tourists in Sardinia's Gorropu Canyon","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-9914"},{"id":"INC-06836","date":"2020-07-14","year":2020,"title":"Pegasus Spyware Used for Unauthorized Surveillance of Spanish Politicians and Activists","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-b471"},{"id":"INC-06791","date":"2020-07-14","year":2020,"title":"Microsoft's AI Editor Causes Job Losses and Misidentification Incident at MSN News","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-d1c3"},{"id":"INC-07067","date":"2020-07-14","year":2020,"title":"Urban Canyons Pose GPS Signal Risks for Autonomous Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-14-f61e"},{"id":"INC-07063","date":"2020-07-15","year":2020,"title":"UN Expert Warns AI Technologies Entrench Racial Discrimination","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-07-15-5ad6"},{"id":"INC-06947","date":"2020-07-15","year":2020,"title":"Tech Giants Sued for Unlawful Use of Biometric Data in AI Facial Recognition Training","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-15-79ef"},{"id":"INC-06302","date":"2020-07-15","year":2020,"title":"AI-Powered Biometric ID and Vaccine Payment System Trialed in Africa Raises Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-15-9266"},{"id":"INC-06292","date":"2020-07-15","year":2020,"title":"AI-Generated Deepfake Persona Used to Spread Disinformation and Defame Activists","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-15-a55f"},{"id":"INC-06808","date":"2020-07-15","year":2020,"title":"Navistar and TuSimple Announce Partnership to Develop Autonomous Trucks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-15-bc2c"},{"id":"INC-06417","date":"2020-07-17","year":2020,"title":"California Grants AutoX Permit for Driverless AI Vehicle Testing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-17-3680"},{"id":"INC-06381","date":"2020-07-18","year":2020,"title":"Autonomous Bus Demonstration in Sanda City","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-18-5e10"},{"id":"INC-07084","date":"2020-07-18","year":2020,"title":"US Court Allows WhatsApp Lawsuit Against NSO Group Over AI-Driven Spyware Attacks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-18-ae71"},{"id":"INC-06924","date":"2020-07-19","year":2020,"title":"South Korean Go Player Jailed for Using AI to Cheat in Tournament","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-19-2238"},{"id":"INC-06254","date":"2020-07-20","year":2020,"title":"AI System Developed to Predict Deadly Volcanic Eruptions in New Zealand","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-20-b95d"},{"id":"INC-06375","date":"2020-07-20","year":2020,"title":"Aurora Expands Autonomous Vehicle Testing to Texas Freight Routes","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-20-c9a1"},{"id":"INC-06672","date":"2020-07-20","year":2020,"title":"Google's COVID-19 Contact Tracing Apps Raise Privacy Concerns Over Location Data Collection","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-20-dae2"},{"id":"INC-07014","date":"2020-07-21","year":2020,"title":"Turkey Deploys AI-Enabled Armed Drone Songar in Military Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-21-13c9"},{"id":"INC-07102","date":"2020-07-21","year":2020,"title":"US Senate Reports Highlight China's Global AI-Driven Digital Authoritarianism and Human Rights Abuses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-21-bb45"},{"id":"INC-06925","date":"2020-07-22","year":2020,"title":"Spain Plans Facial Recognition Surveillance at Mass Events, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-22-18da"},{"id":"INC-06430","date":"2020-07-23","year":2020,"title":"China and Russia Face AI Hazards from Military and Economic Robot Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-23-6560"},{"id":"INC-06569","date":"2020-07-23","year":2020,"title":"Facebook Settles Facial Recognition Privacy Lawsuit for $650 Million","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-23-a835"},{"id":"INC-06651","date":"2020-07-23","year":2020,"title":"Google Ad Tool's AI Links Searches for 'Black Girls' to Pornographic Keywords","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-07-23-bf88"},{"id":"INC-14648","date":"2020-07-23","year":2020,"title":"US and UK Condemn Russia's AI-Enabled Anti-Satellite Weapon Test in Space","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-23-e09a"},{"id":"INC-06436","date":"2020-07-24","year":2020,"title":"China's AI-Driven DNA Surveillance Raises Human Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-24-56ff"},{"id":"INC-07069","date":"2020-07-24","year":2020,"title":"US Air Force Awards $400M Contracts for AI-Enabled Skyborg Combat Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-24-b907"},{"id":"INC-14649","date":"2020-07-24","year":2020,"title":"Israel Deploys AI-Powered Surveillance System in Southern West Bank","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-24-e12b"},{"id":"INC-07087","date":"2020-07-24","year":2020,"title":"US Eases Export Restrictions on AI-Enabled Armed Drones, Raising Global Risk Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-24-f363"},{"id":"INC-06214","date":"2020-07-25","year":2020,"title":"AI Algorithms Promote and Recommend Neo-Nazi Products on Major Platforms","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-25-80de"},{"id":"INC-06881","date":"2020-07-25","year":2020,"title":"Rite Aid's Discriminatory Use of Facial Recognition AI in U.S. Stores","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-07-25-fc80"},{"id":"INC-06888","date":"2020-07-26","year":2020,"title":"Russia Announces Near-Deployment of AI-Enabled Hypersonic and Nuclear Drone Weapons","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-26-473b"},{"id":"INC-06336","date":"2020-07-26","year":2020,"title":"Airbus Successfully Tests AI-Powered Autonomous Passenger Jet","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-26-7653"},{"id":"INC-14650","date":"2020-07-26","year":2020,"title":"US Scrutiny of TikTok Raises AI-Driven Election Interference and Data Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-26-ba09"},{"id":"INC-06526","date":"2020-07-27","year":2020,"title":"Elon Musk Warns of Future AI Dangers, Citing DeepMind as Major Concern","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-27-7ea1"},{"id":"INC-06985","date":"2020-07-27","year":2020,"title":"Texas Investigates Facebook Over Alleged Illegal Biometric Data Collection via AI","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-27-9b83"},{"id":"INC-06451","date":"2020-07-28","year":2020,"title":"Chinese Food Delivery Giant Pilots Autonomous Delivery Vehicles and Drones","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-28-bcda"},{"id":"INC-06744","date":"2020-07-28","year":2020,"title":"Japanese Lawmakers Propose Restrictions on Chinese AI-Driven Apps Over Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-28-db19"},{"id":"INC-06921","date":"2020-07-29","year":2020,"title":"Sony to Begin Public Road Testing of AI-Enabled Vision-S Electric Car","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-29-e73b"},{"id":"INC-06396","date":"2020-07-30","year":2020,"title":"Beijing Court Rules TikTok/Douyin Infringed User Personal Information Rights","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-07-30-2634"},{"id":"INC-06295","date":"2020-08-01","year":2020,"title":"AI-Generated Deepfake Voice Used in CEO Impersonation Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-01-1bf4"},{"id":"INC-06660","date":"2020-08-02","year":2020,"title":"Google Home Smart Speakers Accidentally Enable Always-On Listening, Raising Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-02-7db3"},{"id":"INC-07130","date":"2020-08-02","year":2020,"title":"Widespread Use of Facial Recognition AI Raises Privacy and Misuse Concerns in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-02-85de"},{"id":"INC-06911","date":"2020-08-03","year":2020,"title":"Serbia's AI-Powered Biometric Surveillance Sparks Human Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-03-698b"},{"id":"INC-06822","date":"2020-08-03","year":2020,"title":"NSO Group's Pegasus Spyware Used for Targeted Surveillance of Activists and Journalists","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-03-8ab6"},{"id":"INC-06441","date":"2020-08-04","year":2020,"title":"China's BeiDou Satellite System Raises Global Surveillance and Military Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-04-2e71"},{"id":"INC-06541","date":"2020-08-04","year":2020,"title":"Experts Warn Deepfakes Are Top AI Crime Threat for the Future","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-04-924e"},{"id":"INC-06874","date":"2020-08-05","year":2020,"title":"Researchers Demonstrate AI-Powered Attack on Airport Facial Recognition Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-05-8a6f"},{"id":"INC-06207","date":"2020-08-06","year":2020,"title":"AAA Study Reveals Safety Risks in Active Driving Assistance AI Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-66df"},{"id":"INC-06766","date":"2020-08-06","year":2020,"title":"Macy's Sued for Biometric Privacy Violations Over Use of Clearview AI Facial Recognition","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-87b3"},{"id":"INC-06653","date":"2020-08-06","year":2020,"title":"Google AI Knowledge Panel Labels Argentine Vice President as 'Thief', Triggers Legal Action","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-ae90"},{"id":"INC-06914","date":"2020-08-06","year":2020,"title":"Singapore Trials AI Drones for Social Distancing Enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-da22"},{"id":"INC-06664","date":"2020-08-06","year":2020,"title":"Google Removes Thousands of AI-Detected YouTube Channels Linked to China for Disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-e521"},{"id":"INC-06767","date":"2020-08-06","year":2020,"title":"Major AI Image Recognition Systems Exhibit Gender Bias in Mask Detection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-08-06-eb44"},{"id":"INC-06679","date":"2020-08-07","year":2020,"title":"Guangzhou Expands Autonomous Vehicle Testing with Driverless Road Trials","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-07-1034"},{"id":"INC-06277","date":"2020-08-07","year":2020,"title":"AI-Driven Social Credit Systems Raise Risks of Discrimination and Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-08-07-4c90"},{"id":"INC-06708","date":"2020-08-08","year":2020,"title":"Indian Army Launches Study on AI and Autonomous Weapons Amid China Tensions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-08-cb72"},{"id":"INC-06261","date":"2020-08-09","year":2020,"title":"AI Systems Vulnerable to Data Poisoning and Image-Scaling Attacks Pose Security Risks","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-09-6d2a"},{"id":"INC-06432","date":"2020-08-09","year":2020,"title":"China Launches Robotaxi Pilot Projects Amid AI Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-09-6f98"},{"id":"INC-06594","date":"2020-08-10","year":2020,"title":"Facial Recognition AI Leads to Rights Violations, Bias, and Global Backlash","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-08-10-5315"},{"id":"INC-06803","date":"2020-08-10","year":2020,"title":"MTA Urges Apple to Improve Face ID Amid Mask-Related Health Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-10-7472"},{"id":"INC-06645","date":"2020-08-10","year":2020,"title":"Global Push to Ban AI-Powered Killer Robots Intensifies Amid Regulatory Delays","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-10-7eea"},{"id":"INC-06854","date":"2020-08-10","year":2020,"title":"Portugal Not Among Countries Seeking Ban on Autonomous Killer Robots","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-10-e4aa"},{"id":"INC-06228","date":"2020-08-11","year":2020,"title":"AI Image Analysis Trial to Enhance Railway Crossing Safety in Japan","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-11-4fb3"},{"id":"INC-06994","date":"2020-08-11","year":2020,"title":"TikTok Secretly Collected Android User Data in Violation of Google Policies","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-11-9c7b"},{"id":"INC-06570","date":"2020-08-11","year":2020,"title":"Facebook Sued for Alleged Illegal Biometric Data Collection via Instagram's AI Facial Recognition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-11-a52f"},{"id":"INC-07023","date":"2020-08-11","year":2020,"title":"Turkish Drone Strike Kills Iraqi Soldiers, Triggers Diplomatic Crisis","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-11-b891"},{"id":"INC-06798","date":"2020-08-11","year":2020,"title":"MLB Considers AI-Powered Cameras to Monitor Fan Mask Compliance","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-11-eab3"},{"id":"INC-06636","date":"2020-08-13","year":2020,"title":"German Police Use AI-Generated Child Abuse Material in Investigations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-13-601d"},{"id":"INC-06343","date":"2020-08-13","year":2020,"title":"Amazon Alexa Vulnerability Exposed Users' Personal Data to Hackers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-13-7f93"},{"id":"INC-06395","date":"2020-08-13","year":2020,"title":"Bayraktar AKINCI TİHA: AI-Enabled Armed Drone Successfully Completes Test Flights","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-13-8b55"},{"id":"INC-06576","date":"2020-08-13","year":2020,"title":"Facebook's AI Algorithm Promotes Holocaust Denial Content","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-13-9308"},{"id":"INC-06583","date":"2020-08-14","year":2020,"title":"Facebook's AI Moderation Fails to Curb Hate Speech in India Due to Policy Interference","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-14-e678"},{"id":"INC-06297","date":"2020-08-16","year":2020,"title":"AI-Generated Fake Blog Posts Fool Readers on Hacker News","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-16-b782"},{"id":"INC-06256","date":"2020-08-17","year":2020,"title":"AI System Prevents Harm by Detecting Misdeclared Hazardous Cargo in Shipping","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-17-4eec"},{"id":"INC-06934","date":"2020-08-17","year":2020,"title":"Student's University Offer Revoked After Biased Grading Algorithm Downgrades Results","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-08-17-6ac8"},{"id":"INC-07047","date":"2020-08-18","year":2020,"title":"UK Government Considers Legalizing Automated Lane Keeping Systems on Roads","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-18-5a93"},{"id":"INC-06577","date":"2020-08-19","year":2020,"title":"Facebook's AI Algorithms Amplify Harmful COVID-19 Misinformation","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-19-e4c3"},{"id":"INC-06587","date":"2020-08-20","year":2020,"title":"Facebook's AI Removes Millions of Harmful COVID-19 Misinformation Posts","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-20-2e0d"},{"id":"INC-06379","date":"2020-08-20","year":2020,"title":"Austrian Data Protection Authority Halts Job Seeker Algorithm Over Legal and Discrimination Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-08-20-3e64"},{"id":"INC-06560","date":"2020-08-21","year":2020,"title":"Facebook Considers Political Ad 'Kill Switch' to Prevent Post-Election Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-21-5a83"},{"id":"INC-06966","date":"2020-08-21","year":2020,"title":"Tesla Develops AI System to Detect Children in Cars and Prevent Heatstroke","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-21-67f0"},{"id":"INC-06251","date":"2020-08-23","year":2020,"title":"AI System Developed to Block Harmful Content on Children's Devices","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-23-817a"},{"id":"INC-06732","date":"2020-08-23","year":2020,"title":"Israel Mediates Sale of NSO Pegasus Spyware to Gulf States for Dissident Surveillance","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-23-a339"},{"id":"INC-06528","date":"2020-08-24","year":2020,"title":"Elon Musk's Neuralink to Demonstrate AI Brain Implant Prototype","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-24-c8d2"},{"id":"INC-06622","date":"2020-08-24","year":2020,"title":"Ford Develops AI Tool to Predict and Prevent Traffic Accidents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-24-f8bc"},{"id":"INC-07091","date":"2020-08-25","year":2020,"title":"US Military Plans AI-Controlled Command Systems Raise Risk of Catastrophic Harm","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-01f8"},{"id":"INC-06283","date":"2020-08-25","year":2020,"title":"AI-Enabled Autonomous Drone Swarms Pose Escalating Military Risks and Realized Harm","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-1ddc"},{"id":"INC-06293","date":"2020-08-25","year":2020,"title":"AI-Generated Deepfake Porn Causes Widespread Harm and Rights Violations","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-848e"},{"id":"INC-07145","date":"2020-08-25","year":2020,"title":"YouTube's AI Over-Enforcement During COVID-19 Lockdown Leads to Mass Video Removals","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-85d5"},{"id":"INC-06626","date":"2020-08-25","year":2020,"title":"French Municipalities Sanctioned for Unlawful Use of AI License Plate Recognition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-c1c1"},{"id":"INC-06252","date":"2020-08-25","year":2020,"title":"AI System Developed to Detect Illicit Cryptocurrency Mining on Supercomputers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-25-df67"},{"id":"INC-07113","date":"2020-08-26","year":2020,"title":"Volkswagen and Audi Begin Testing Autonomous Vehicles in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-26-ca7e"},{"id":"INC-07039","date":"2020-08-28","year":2020,"title":"Uber Self-Driving Car Fatality Prompts Safety Overhaul and Transparency Pledge","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-28-0a47"},{"id":"INC-06815","date":"2020-08-30","year":2020,"title":"New Zealand Police Secretly Deploy AI Facial Recognition System, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-30-066c"},{"id":"INC-06350","date":"2020-08-31","year":2020,"title":"Amazon's AI Surveillance Allegedly Used to Suppress Unionization Efforts","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-31-18e9"},{"id":"INC-06810","date":"2020-08-31","year":2020,"title":"Neuralink and BrainOS Brain-Computer Interface Demonstrations Spark Debate on AI Risks and Potential","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-31-1eff"},{"id":"INC-06344","date":"2020-08-31","year":2020,"title":"Amazon Begins Testing AI-Powered Delivery Drones in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-31-78fa"},{"id":"INC-06592","date":"2020-08-31","year":2020,"title":"Facial Recognition AI Enables Arrest in NYC Subway Attempted Assault Case","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-08-31-967c"},{"id":"INC-06540","date":"2020-09-01","year":2020,"title":"Experts Warn AI-Powered COVID-19 Tools Threaten Digital Rights","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-09-01-0ab6"},{"id":"INC-06668","date":"2020-09-01","year":2020,"title":"Google's AI Autocomplete Suppresses Negative Black Lives Matter Suggestions","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-01-8cf3"},{"id":"INC-06423","date":"2020-09-01","year":2020,"title":"Canadian Predictive Policing AI Raises Human Rights Concerns, Report Warns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-09-01-9206"},{"id":"INC-06896","date":"2020-09-02","year":2020,"title":"Russian Railways Begin Testing AI-Equipped Trains to Reduce Human Error","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-02-cff1"},{"id":"INC-06480","date":"2020-09-03","year":2020,"title":"Controversy Over Facial Recognition System in Taichung Girls' High School Dormitory","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-03-1faf"},{"id":"INC-07122","date":"2020-09-04","year":2020,"title":"WeChat's AI-Driven Censorship and Surveillance Causes Harm to Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-04-109e"},{"id":"INC-06482","date":"2020-09-04","year":2020,"title":"Controversy Over Suzhou's AI-Driven 'Civilization Code' Scoring System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-09-04-2570"},{"id":"INC-06935","date":"2020-09-04","year":2020,"title":"Students Exploit AI Grading Algorithm with Keyword Trick to Obtain Higher Scores","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-04-94a8"},{"id":"INC-06990","date":"2020-09-04","year":2020,"title":"TikTok and WeChat AI Algorithms Enable Global Censorship and Fail to Prevent Harmful Content Spread","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-04-c4dc"},{"id":"INC-00927","date":"2020-09-06","year":2020,"title":"Turkish Armed Drone Operation Neutralizes Six in Bitlis","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-06-15e9"},{"id":"INC-06415","date":"2020-09-06","year":2020,"title":"ByteDance AI Algorithms Used to Spread Chinese Government Propaganda via Toutiao App","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-06-e7bb"},{"id":"INC-06986","date":"2020-09-07","year":2020,"title":"Therapists Warn of Risks from Overreliance on Digital Health Apps","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-07-3721"},{"id":"INC-06901","date":"2020-09-07","year":2020,"title":"Saudi-Led Coalition Intercepts Houthi AI-Enabled Drone Attack on Civilian Airport","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-07-5919"},{"id":"INC-06981","date":"2020-09-07","year":2020,"title":"Tesla Sudden Acceleration Incident in China Causes Fatalities and Injuries","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-07-bbd4"},{"id":"INC-06999","date":"2020-09-08","year":2020,"title":"TikTok's AI Moderation System Shadow-Bans LGBTQ+ Hashtags Globally","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-08-3cba"},{"id":"INC-07086","date":"2020-09-08","year":2020,"title":"US Deploys AI-Enabled Israeli Drone Defense System for Special Forces","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-08-71e3"},{"id":"INC-06394","date":"2020-09-09","year":2020,"title":"Bayraktar AKINCI Armed Drone Receives Critical Design Approval","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-09-541b"},{"id":"INC-07073","date":"2020-09-09","year":2020,"title":"US Air Force Tests AI-Powered Robotic Dogs in Military Exercises","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-09-dddd"},{"id":"INC-07011","date":"2020-09-10","year":2020,"title":"Turkey Advances AI-Enabled Autonomous Military Swarm Technologies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-0cbd"},{"id":"INC-06619","date":"2020-09-10","year":2020,"title":"First AI-Guided Munition Fired from Turkish UAV","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-0d10"},{"id":"INC-06446","date":"2020-09-10","year":2020,"title":"Chinese Brain-Control AI Technologies Cause Harm to Citizens","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-6f77"},{"id":"INC-06206","date":"2020-09-10","year":2020,"title":"AAA Research Warns AI Driver Assistance Marketing May Lead to Dangerous Overconfidence","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-84b4"},{"id":"INC-06363","date":"2020-09-10","year":2020,"title":"Anduril Deploys AI-Powered Drones and Surveillance Towers for Border and Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-a174"},{"id":"INC-06960","date":"2020-09-10","year":2020,"title":"Tesla Autopilot Misuse and Misleading Naming Raise Safety Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-10-f4e1"},{"id":"INC-06267","date":"2020-09-11","year":2020,"title":"AI-Controlled Fighter Jets Defeat Human Pilots in Pentagon Simulations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-11-6e7d"},{"id":"INC-06686","date":"2020-09-11","year":2020,"title":"IBM Urges US to Restrict Export of Facial Recognition AI Over Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-11-c663"},{"id":"INC-07074","date":"2020-09-11","year":2020,"title":"US and Russia Advance AI-Controlled Fighter Jet Combat Trials","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-11-e432"},{"id":"INC-07059","date":"2020-09-12","year":2020,"title":"Ukraine's Justice Ministry Deploys AI 'Kassandra' for Recidivism Risk Assessment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-12-c4a7"},{"id":"INC-06832","date":"2020-09-14","year":2020,"title":"Palantir's AI Deployment at UK Border Raises Disruption Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-14-5484"},{"id":"INC-07100","date":"2020-09-14","year":2020,"title":"US Scrutinizes TikTok-Oracle Partnership Over AI Algorithm Control and Security Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-14-d067"},{"id":"INC-06404","date":"2020-09-15","year":2020,"title":"Boeing's AI-Powered Loyal Wingman Drone Completes First Engine Test, Raising Future Military AI Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-15-0e6a"},{"id":"INC-07038","date":"2020-09-15","year":2020,"title":"Uber Self-Driving Car Fatality Leads to Negligent Homicide Charge for Safety Driver","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-15-5a11"},{"id":"INC-06637","date":"2020-09-15","year":2020,"title":"German Scientists Develop AI Algorithm to Make Self-Driving Cars Accident-Resistant","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-15-6e76"},{"id":"INC-06248","date":"2020-09-15","year":2020,"title":"AI Surveillance Drones Raise Civil Liberties and Safety Concerns in U.S. Cities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-15-8c1a"},{"id":"INC-06582","date":"2020-09-15","year":2020,"title":"Facebook's AI Failures Enable Global Political Manipulation and Disinformation Campaigns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-15-df59"},{"id":"INC-07029","date":"2020-09-16","year":2020,"title":"Twitter Labels AI-Manipulated Biden Video Shared by Trump as 'Manipulated Media'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-16-309a"},{"id":"INC-06294","date":"2020-09-16","year":2020,"title":"AI-Generated Deepfake Videos Fuel Disinformation About Biden's Health","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-16-98b6"},{"id":"INC-07098","date":"2020-09-16","year":2020,"title":"US Plans Major Naval Expansion with AI-Driven Unmanned Vessels to Counter China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-16-9b30"},{"id":"INC-06954","date":"2020-09-16","year":2020,"title":"Tesla App Glitch Allows Unauthorized Remote Control of Vehicles in China","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-16-a752"},{"id":"INC-14651","date":"2020-09-17","year":2020,"title":"AI Face-Swapping Technology Drives Surge in Portrait Rights Infringement Cases in Beijing","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-17-258d"},{"id":"INC-06983","date":"2020-09-17","year":2020,"title":"Tesla's AI Cameras in Cars Spark Data Privacy Violations in Germany","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-17-6af6"},{"id":"INC-06571","date":"2020-09-18","year":2020,"title":"Facebook Sued Over Instagram's Unauthorized Camera Access and Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-18-3eb5"},{"id":"INC-06357","date":"2020-09-18","year":2020,"title":"Amnesty International Raises Human Rights Concerns Over Argentina's Cuidar App","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-18-6e7f"},{"id":"INC-06354","date":"2020-09-18","year":2020,"title":"Amazon's Zoox Approved for Fully Driverless Car Testing in California","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-18-f2d6"},{"id":"INC-06757","date":"2020-09-19","year":2020,"title":"LAPD's Extensive Use of Facial Recognition AI Linked to Wrongful Arrests and Transparency Issues","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-19-69a8"},{"id":"INC-06535","date":"2020-09-20","year":2020,"title":"European AI Surveillance Technology Linked to Human Rights Abuses in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-20-715c"},{"id":"INC-06444","date":"2020-09-20","year":2020,"title":"Chinese AI Firm Zhenhua Data Monitors 1,480 Taiwanese Figures, Raising Privacy and Security Fears","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-20-7d19"},{"id":"INC-06908","date":"2020-09-20","year":2020,"title":"Security Risks of Chinese AI-Enabled Drones in Australia Raise National Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-20-b036"},{"id":"INC-06655","date":"2020-09-20","year":2020,"title":"Google AI Search Algorithm Suppresses Conservative News Sites","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-20-c3a0"},{"id":"INC-06455","date":"2020-09-21","year":2020,"title":"Civilian Harm and Risks from AI-Driven Military and Police Drones","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-21-262b"},{"id":"INC-06274","date":"2020-09-21","year":2020,"title":"AI-Driven Price Discrimination in Online Tourism Platforms Harms Consumers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-09-21-2c0d"},{"id":"INC-06257","date":"2020-09-21","year":2020,"title":"AI System Uncovers Debtor's Hidden Assets, Enables Court Enforcement in Guangzhou","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-21-bffe"},{"id":"INC-06961","date":"2020-09-22","year":2020,"title":"Tesla Autopilot Misuse and Safety Concerns Lead to Legal Action and Fatalities","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-22-0887"},{"id":"INC-06898","date":"2020-09-22","year":2020,"title":"Russian State Media Uses Deepfake AI to Satirize Trump Post-Election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-22-44d0"},{"id":"INC-06516","date":"2020-09-23","year":2020,"title":"Dubai's Al Habtoor Partners with Mobileye to Deploy Self-Driving Robo-Taxis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-2119"},{"id":"INC-06370","date":"2020-09-23","year":2020,"title":"Apple's Siri Glitch Links Police Departments to Terrorists, Prompting Outrage and Apology","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-27b4"},{"id":"INC-06722","date":"2020-09-23","year":2020,"title":"Iran Bans Algorithmic Trading in Stock Markets Over Stability Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-45a1"},{"id":"INC-14652","date":"2020-09-23","year":2020,"title":"Tesla Autopilot Fails Pedestrian Detection Test, Hits Dummies","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-93f0"},{"id":"INC-06676","date":"2020-09-23","year":2020,"title":"Gradient App's AI Ethnicity Filter Sparks Accusations of Digital Blackface and Racism","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-94cc"},{"id":"INC-06426","date":"2020-09-23","year":2020,"title":"CBP Facial Recognition Data Breach Exposes Biometric Information of Travelers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-e0ab"},{"id":"INC-06725","date":"2020-09-23","year":2020,"title":"IRGC Deploys AI-Enabled Drones to Track US Aircraft Carrier in Persian Gulf","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-e8a5"},{"id":"INC-07008","date":"2020-09-23","year":2020,"title":"TRATON and TuSimple Partner to Develop Autonomous Trucks in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-23-f8db"},{"id":"INC-06748","date":"2020-09-24","year":2020,"title":"Kamenz Launches AI-Driven Autonomous Flight Research Center","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-24-14a7"},{"id":"INC-07141","date":"2020-09-24","year":2020,"title":"YouTube Uses AI to Counter Misinformation on US Mail-In Voting","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-24-f494"},{"id":"INC-06281","date":"2020-09-24","year":2020,"title":"AI-Driven Workplace Automation Poses Greater Job Risks for Women, Study Finds","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-24-f8d7"},{"id":"INC-07081","date":"2020-09-25","year":2020,"title":"US Army Tests AI-Enabled Warfare in Project Convergence Exercises","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-25-7b24"},{"id":"INC-06278","date":"2020-09-25","year":2020,"title":"AI-Driven Social Media Algorithms Linked to Teen Suicide in Molly Russell Case","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-25-a0f5"},{"id":"INC-06913","date":"2020-09-25","year":2020,"title":"Singapore Deploys AI Facial Verification in National ID Scheme, Raising Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-25-cb08"},{"id":"INC-06939","date":"2020-09-26","year":2020,"title":"Study Warns 20% of Brazilian Federal Jobs at Risk of Automation by AI","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-26-abb2"},{"id":"INC-06831","date":"2020-09-28","year":2020,"title":"Palantir AI Systems Linked to Human Rights Violations in ICE Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-28-14e6"},{"id":"INC-07049","date":"2020-09-28","year":2020,"title":"UK Military Develops AI-Enabled Shotgun Drone for Indoor Combat","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-28-1519"},{"id":"INC-06376","date":"2020-09-28","year":2020,"title":"Australia Plans Facial Recognition and Biometric Liveness for Digital Identity, Raising Security Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-28-b2ca"},{"id":"INC-06894","date":"2020-09-28","year":2020,"title":"Russia's Facial Recognition Expansion Leads to Privacy Violations and Data Breaches","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-28-cebd"},{"id":"INC-06905","date":"2020-09-28","year":2020,"title":"Second Autonomous Bus Trial Conducted in Ibaraki Prefecture","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-28-efc5"},{"id":"INC-07117","date":"2020-09-29","year":2020,"title":"Watchdog Group Criticizes Facebook's AI for Failing to Prevent Election Misinformation","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-29-20ac"},{"id":"INC-06328","date":"2020-09-29","year":2020,"title":"AI-Powered Wearable Predicts Epileptic Seizures in Advance","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-29-6108"},{"id":"INC-06962","date":"2020-09-29","year":2020,"title":"Tesla Autopilot Misuse and Safety Incidents Highlight AI Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-29-8247"},{"id":"INC-06621","date":"2020-09-29","year":2020,"title":"Flawed Universal Credit Algorithm Pushes UK Claimants into Poverty","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-29-8614"},{"id":"INC-06225","date":"2020-09-29","year":2020,"title":"AI Face-Swapping and Facial Recognition Lead to Privacy Violations and Fraud in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-29-c6e3"},{"id":"INC-06366","date":"2020-09-30","year":2020,"title":"Apple Watch Heart Monitor AI Triggers Unnecessary Hospital Visits Due to False Positives","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-30-407a"},{"id":"INC-06290","date":"2020-09-30","year":2020,"title":"AI-Enabled Military Drones Cause Harm in Nagorno-Karabakh Conflict","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-30-7f93"},{"id":"INC-06320","date":"2020-09-30","year":2020,"title":"AI-Powered Social Media Surveillance by Dataminr Sparks Debate on Civil Liberties","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-30-e77f"},{"id":"INC-06870","date":"2020-09-30","year":2020,"title":"Replika AI Chatbot Incites User to Commit Murder During Journalistic Experiment","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-09-30-f579"},{"id":"INC-06844","date":"2020-10-01","year":2020,"title":"Pinterest AI Misclassifies 'Chiquititas' Search as Child Exploitation Risk","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-01-381c"},{"id":"INC-06620","date":"2020-10-01","year":2020,"title":"First Arrests in Japan for AI-Generated Deepfake Porn Involving Celebrities","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-01-4c24"},{"id":"INC-06957","date":"2020-10-01","year":2020,"title":"Tesla Autopilot Drives on Highway Without Driver, Sparks Safety Outrage","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-01-6a30"},{"id":"INC-06353","date":"2020-10-02","year":2020,"title":"Amazon's Indoor Security Drone Sparks Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-02-033d"},{"id":"INC-06710","date":"2020-10-02","year":2020,"title":"Indiana City Plans AI Surveillance for COVID-19 Contact Tracing Raises Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-02-b46d"},{"id":"INC-06656","date":"2020-10-02","year":2020,"title":"Google AI Search Labels Agbani Darego as 'Ugliest Miss World,' Sparks Outrage in Nigeria","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-02-c5e8"},{"id":"INC-06848","date":"2020-10-03","year":2020,"title":"Police Use AI Smart Speaker Data in Criminal Investigations Raises Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-03-789c"},{"id":"INC-06240","date":"2020-10-04","year":2020,"title":"AI Proctoring Software Wrongly Accuses Students of Cheating, Raises Bias and Mental Health Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-10-04-22a6"},{"id":"INC-06289","date":"2020-10-04","year":2020,"title":"AI-Enabled Military and Civilian Drones Pose Future Risks of Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-04-70a8"},{"id":"INC-06678","date":"2020-10-04","year":2020,"title":"Greek Intelligence Deploys AI-Driven Mass Surveillance System for Internet and Mobile Communications","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-04-b566"},{"id":"INC-06635","date":"2020-10-05","year":2020,"title":"German Parliament Approves Procurement of Armed AI-Enabled Drones for Bundeswehr","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-05-1821"},{"id":"INC-06756","date":"2020-10-06","year":2020,"title":"Kubota and NVIDIA Partner to Develop Fully Autonomous AI-Powered Farm Machinery","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-06-2328"},{"id":"INC-06953","date":"2020-10-06","year":2020,"title":"Tesla Announces Imminent Release of Full Self-Driving Beta with Zero-Intervention Capability","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-06-56f3"},{"id":"INC-06410","date":"2020-10-06","year":2020,"title":"British Manufacturer Plans Fully Autonomous Passenger Planes by 2030","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-06-916d"},{"id":"INC-07118","date":"2020-10-08","year":2020,"title":"Waymo Launches Fully Driverless Taxi Service to the Public in Phoenix","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-08-bf49"},{"id":"INC-06244","date":"2020-10-08","year":2020,"title":"AI Skin Scan Apps Frequently Misclassify Lesions, Raising Health Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-08-e46a"},{"id":"INC-06523","date":"2020-10-08","year":2020,"title":"Einride Launches Autonomous Electric Trucks, Raising Safety and Societal Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-08-ff27"},{"id":"INC-06892","date":"2020-10-10","year":2020,"title":"Russia Plans Nationwide Rollout of AI-Based Biometric Payment Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-10-fae9"},{"id":"INC-06325","date":"2020-10-11","year":2020,"title":"AI-Powered System Boosts Child Abuse Investigations in NRW","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-11-37fd"},{"id":"INC-06286","date":"2020-10-11","year":2020,"title":"AI-Enabled Drones Escalate Conflict and Pose Future Warfare Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-11-4f93"},{"id":"INC-06875","date":"2020-10-11","year":2020,"title":"Researchers Demonstrate How Hijacked Billboards Can Trick Self-Driving Cars Into Dangerous Braking","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-11-e523"},{"id":"INC-06578","date":"2020-10-12","year":2020,"title":"Facebook's AI Algorithms Amplify Misinformation Since 2016","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-12-a4d7"},{"id":"INC-14653","date":"2020-10-13","year":2020,"title":"AI-Driven Fake Black Trump Supporter Accounts Purged from Twitter","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-13-6f6a"},{"id":"INC-06973","date":"2020-10-13","year":2020,"title":"Tesla Launches Beta Full Self-Driving Cars for Limited Users","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-13-76f4"},{"id":"INC-06264","date":"2020-10-13","year":2020,"title":"AI Uses Smartphone Data to Predict Schizophrenia Relapses","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-13-ad8e"},{"id":"INC-06649","date":"2020-10-13","year":2020,"title":"Gojek's AI System Helps Police Dismantle Fraud Syndicates and Protect Drivers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-13-eed9"},{"id":"INC-07142","date":"2020-10-14","year":2020,"title":"YouTube's AI Algorithms Linked to Child Harm and Spread of Misinformation","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-14-d12d"},{"id":"INC-06488","date":"2020-10-15","year":2020,"title":"Cruise Receives Approval to Test Fully Driverless Cars in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-15-571c"},{"id":"INC-06431","date":"2020-10-15","year":2020,"title":"China Deploys AI-Enabled Suicide Drone Swarms for Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-15-6ddf"},{"id":"INC-06555","date":"2020-10-16","year":2020,"title":"Facebook Algorithm Change Suppresses Progressive News Outlets, Causes Financial Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-16-5380"},{"id":"INC-06647","date":"2020-10-16","year":2020,"title":"GM's Cruise and Waymo Receive Approval for Driverless Autonomous Vehicle Deployment in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-16-5dcb"},{"id":"INC-07132","date":"2020-10-17","year":2020,"title":"Xiaohongshu AI Moderation System Wrongfully Flags Compliant Posts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-17-1175"},{"id":"INC-06573","date":"2020-10-18","year":2020,"title":"Facebook Uses AI to Remove Millions of Ads Ahead of US Election","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-18-9335"},{"id":"INC-06661","date":"2020-10-19","year":2020,"title":"Google Manager Alleges Search Algorithm Manipulation to Influence US Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-19-9d74"},{"id":"INC-06268","date":"2020-10-20","year":2020,"title":"AI-Driven Automation Threatens 800 Million Jobs Globally","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-20-05a2"},{"id":"INC-06721","date":"2020-10-20","year":2020,"title":"Instagram's AI Moderation Faces Backlash for Biased Censorship of Body Types","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-10-20-739f"},{"id":"INC-06654","date":"2020-10-21","year":2020,"title":"Google AI Powers Virtual Border Wall for US Customs and Border Protection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-19c5"},{"id":"INC-06270","date":"2020-10-21","year":2020,"title":"AI-Driven Autonomous Bus Trials Begin in Kitakyushu with Advanced Signal Communication and Safety Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-2794"},{"id":"INC-06487","date":"2020-10-21","year":2020,"title":"Cruise and GM Seek Approval for Fully Autonomous Vehicles Without Manual Controls","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-2ce0"},{"id":"INC-06743","date":"2020-10-21","year":2020,"title":"Japanese Government Plans Facial Recognition for Olympic COVID-19 Control","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-5e24"},{"id":"INC-06405","date":"2020-10-21","year":2020,"title":"Bombay High Court Demands Action on AI Bot Creating Non-Consensual Nude Images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-9c63"},{"id":"INC-06210","date":"2020-10-21","year":2020,"title":"Activists Deploy Facial Recognition AI to Identify Anonymous Police Officers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-21-e5a9"},{"id":"INC-07057","date":"2020-10-22","year":2020,"title":"UK Safety Experts Warn Automated Lane Keeping Systems Pose Road Risk","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-22-2814"},{"id":"INC-14654","date":"2020-10-22","year":2020,"title":"Food Delivery Platform Algorithms Cause Harm to Riders and Consumers","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-22-bc88"},{"id":"INC-06984","date":"2020-10-22","year":2020,"title":"Tesla's Misleading 'Full Self-Driving' AI Raises Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-22-cea6"},{"id":"INC-14655","date":"2020-10-22","year":2020,"title":"Google Translate AI Error Causes Misinformation During US Election","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-22-d653"},{"id":"INC-06972","date":"2020-10-23","year":2020,"title":"Tesla Full Self-Driving Beta Raises Safety Concerns After Malfunctions Caught on Video","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-23-76e1"},{"id":"INC-06538","date":"2020-10-24","year":2020,"title":"Expert Predicts AI Judges Will Replace Humans in Courts by 2070","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-10-24-dab6"},{"id":"INC-14656","date":"2020-10-25","year":2020,"title":"AI-Enabled Drone Strikes Target Saudi Airports and Military Bases","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-25-8b9d"},{"id":"INC-06515","date":"2020-10-25","year":2020,"title":"Dubai Deploys Facial Recognition AI on Public Transport, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-25-9e8f"},{"id":"INC-06385","date":"2020-10-25","year":2020,"title":"Autonomous Trucks and Tesla FSD Beta Raise Safety Concerns Amid Real-World Trials","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-25-cad5"},{"id":"INC-07108","date":"2020-10-26","year":2020,"title":"Verkada Employees Used AI Facial Recognition to Harass Female Colleagues","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-26-6909"},{"id":"INC-06479","date":"2020-10-26","year":2020,"title":"Controversy and Policy Responses to Facial Recognition Expansion in Law Enforcement and Public Spaces","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-26-95d0"},{"id":"INC-07040","date":"2020-10-27","year":2020,"title":"Uber Sued Over Automated Driver Account Deactivations","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-27-5156"},{"id":"INC-07028","date":"2020-10-28","year":2020,"title":"Twitter Bots Amplify Conspiracy Theories and Misinformation Ahead of 2020 U.S. Election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-28-5b53"},{"id":"INC-06794","date":"2020-10-29","year":2020,"title":"Minibus Accident in Lembang Due to Overreliance on Google Maps Navigation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-29-dd0d"},{"id":"INC-06422","date":"2020-10-29","year":2020,"title":"Canadian Mall Operator Illegally Collected Shoppers' Biometric Data Using AI Facial Recognition","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-29-ef0c"},{"id":"INC-06906","date":"2020-10-30","year":2020,"title":"Secret Facial Recognition System Used to Identify and Arrest Lafayette Square Protester","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-30-2c2e"},{"id":"INC-06298","date":"2020-10-30","year":2020,"title":"AI-Generated Fake Persona Used in Disinformation Campaign Targeting US Election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-30-9cfd"},{"id":"INC-06971","date":"2020-10-31","year":2020,"title":"Tesla Full Self-Driving Beta Expansion Raises Safety Concerns Amid Improvements","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-31-6251"},{"id":"INC-06632","date":"2020-10-31","year":2020,"title":"Georgia Police Department Deploys AI-Enabled Drones for 911 Response, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-10-31-9bb7"},{"id":"INC-06580","date":"2020-11-02","year":2020,"title":"Facebook's AI Fails to Block Political Disinformation During US Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-02-df33"},{"id":"INC-06739","date":"2020-11-03","year":2020,"title":"Jackson Police Pilot AI-Enabled Real-Time Surveillance via Amazon Ring Cameras","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-03-8cc5"},{"id":"INC-06545","date":"2020-11-03","year":2020,"title":"Experts Warn of Deepfake AI Risks for Misinformation and Social Manipulation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-03-9b88"},{"id":"INC-06389","date":"2020-11-03","year":2020,"title":"BAE Systems Awarded Contracts to Develop AI-Enabled Military Autonomy for US Army","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-03-e03d"},{"id":"INC-06723","date":"2020-11-04","year":2020,"title":"Iran Unveils AI-Enabled Automated Ballistic Missile Launch System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-04-0281"},{"id":"INC-06542","date":"2020-11-04","year":2020,"title":"Experts Warn German Parliament of AI-Controlled Weapons and Loss of Human Oversight","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-04-1ce5"},{"id":"INC-07019","date":"2020-11-05","year":2020,"title":"Turkey Launches First Armed Unmanned Naval Vessel with AI Capabilities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-05-4fcd"},{"id":"INC-06279","date":"2020-11-05","year":2020,"title":"AI-Driven Video Platforms Struggle to Contain Election Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-05-579b"},{"id":"INC-06445","date":"2020-11-05","year":2020,"title":"Chinese AI Surveillance Software Found to Target Uyghur Ethnic Group","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-05-ab27"},{"id":"INC-06584","date":"2020-11-05","year":2020,"title":"Facebook's AI Moderation Fails to Stop Hate Speech in Myanmar Election","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-05-c5e4"},{"id":"INC-06316","date":"2020-11-06","year":2020,"title":"AI-Powered Remote Proctoring Causes Privacy Violations and Discrimination in Education","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-06-3b67"},{"id":"INC-06650","date":"2020-11-06","year":2020,"title":"Google Accused of AI-Driven Political Bias in Voter Reminders","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-06-f44b"},{"id":"INC-06275","date":"2020-11-08","year":2020,"title":"AI-Driven Price Discrimination on Chinese E-Commerce Platforms Sparks Regulatory Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-08-084c"},{"id":"INC-07055","date":"2020-11-08","year":2020,"title":"UK Plans to Deploy Robot Soldiers in Army by 2030s","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-08-68aa"},{"id":"INC-14657","date":"2020-11-08","year":2020,"title":"US Military Deploys AI-Enabled Systems for Space and Ground Warfare Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-08-c25b"},{"id":"INC-06605","date":"2020-11-09","year":2020,"title":"Facial Recognition in Chinese Communities Raises Privacy and Data Security Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-09-82d7"},{"id":"INC-06213","date":"2020-11-09","year":2020,"title":"AI Algorithms in Big Tech Perpetuate Discrimination Against Minority Groups","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-09-a6c3"},{"id":"INC-06801","date":"2020-11-09","year":2020,"title":"Moscow's Facial Recognition System Breached, Enabling Illegal Surveillance for $200","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-09-b84f"},{"id":"INC-06238","date":"2020-11-10","year":2020,"title":"AI Proctoring Software Causes Discrimination and Privacy Concerns in Online Exams","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-10-05ff"},{"id":"INC-06706","date":"2020-11-10","year":2020,"title":"India Deploys AI-Powered COVID-19 Surveillance Amid Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-10-456b"},{"id":"INC-06301","date":"2020-11-10","year":2020,"title":"AI-Powered Autonomous Air Combat Raises Future Warfare Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-10-99e1"},{"id":"INC-06522","date":"2020-11-10","year":2020,"title":"EA Sued Over AI-Driven Dynamic Difficulty to Boost Loot Box Sales","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-10-bc39"},{"id":"INC-06716","date":"2020-11-11","year":2020,"title":"Instagram Deploys AI to Detect and Remove Self-Harm Content in Europe","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-11-0289"},{"id":"INC-07033","date":"2020-11-11","year":2020,"title":"U.S. Air Force Deploys Semi-Autonomous Robot Dogs for Security Patrols","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-11-75c2"},{"id":"INC-06474","date":"2020-11-11","year":2020,"title":"Coded Bias Documentary Exposes Harm from Racially Biased AI Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-11-f7c0"},{"id":"INC-07101","date":"2020-11-12","year":2020,"title":"US Seeks Resolution to National Security Concerns Over TikTok's AI Platform","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-002c"},{"id":"INC-06433","date":"2020-11-12","year":2020,"title":"China Plans AI-Driven Military Modernization to Rival US by 2027","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-00e0"},{"id":"INC-06585","date":"2020-11-12","year":2020,"title":"Facebook's AI Moderation Failures Linked to Delhi Riots Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-0ed9"},{"id":"INC-06956","date":"2020-11-12","year":2020,"title":"Tesla Autopilot Disengagement Precedes High-Speed Crash on California Highway","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-2656"},{"id":"INC-06627","date":"2020-11-12","year":2020,"title":"French Senate Approves AI-Based Social Media Surveillance to Detect Social Fraud","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-d091"},{"id":"INC-07079","date":"2020-11-12","year":2020,"title":"US Army Receives AI-Enabled Robotic Combat Vehicles, Raising Future Risk Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-12-fccb"},{"id":"INC-06596","date":"2020-11-13","year":2020,"title":"Facial Recognition AI Misuse Leads to Rights Violations and Community Harm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-13-6059"},{"id":"INC-06574","date":"2020-11-13","year":2020,"title":"Facebook's 10-Year Photo Challenge Raises AI Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-13-eb9e"},{"id":"INC-06378","date":"2020-11-14","year":2020,"title":"Austria Launches Initiative for International Regulation of AI-Powered Lethal Autonomous Weapons","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-14-0505"},{"id":"INC-06242","date":"2020-11-15","year":2020,"title":"AI Recommendation Algorithms Cause Addiction, Content Quality Issues, and Discriminatory Pricing on Chinese Internet Platforms","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-15-3b22"},{"id":"INC-06496","date":"2020-11-15","year":2020,"title":"Deepfake AI Technology Causes Harm Through Fraud and Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-15-805b"},{"id":"INC-06736","date":"2020-11-16","year":2020,"title":"Italian Antitrust Investigates AI-Based Insurance Fraud Detection Project for Competition Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-16-24df"},{"id":"INC-14658","date":"2020-11-16","year":2020,"title":"Global Concerns Over Autonomous Lethal AI Weapons Prompt Calls for Regulation","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-16-b462"},{"id":"INC-06501","date":"2020-11-16","year":2020,"title":"Deepfake Audio Used in Financial Fraud Raises Concerns Over AI Risks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-16-f2e7"},{"id":"INC-06296","date":"2020-11-16","year":2020,"title":"AI-Generated Deepfakes Used for Non-Consensual Pornography and Blackmail","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-16-fbda"},{"id":"INC-07078","date":"2020-11-17","year":2020,"title":"US Army Procures AI-Powered Facial Recognition Binoculars from SVI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-17-0bd8"},{"id":"INC-07092","date":"2020-11-17","year":2020,"title":"US Military Purchases Muslim Pro App User Data for Surveillance","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-17-3ccc"},{"id":"INC-06380","date":"2020-11-17","year":2020,"title":"Austrian Job Agency's AI Algorithm Increases Social Inequality, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-17-dc6d"},{"id":"INC-06811","date":"2020-11-17","year":2020,"title":"Nevada Approves Motional to Test Fully Driverless Cars in Las Vegas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-17-e2b2"},{"id":"INC-06285","date":"2020-11-17","year":2020,"title":"AI-Enabled Drones Decisively Shape Nagorno-Karabakh Conflict","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-17-fbf8"},{"id":"INC-06878","date":"2020-11-18","year":2020,"title":"Researchers Hack Robotic Vacuums to Eavesdrop Using AI and Lidar","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-18-2c27"},{"id":"INC-06652","date":"2020-11-18","year":2020,"title":"Google AI Knowledge Panel Displays Defamatory Content About Argentina's First Lady","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-18-aff5"},{"id":"INC-07017","date":"2020-11-19","year":2020,"title":"Turkey Develops AI-Powered Swarm Drone Technology for Military Use","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-19-0699"},{"id":"INC-07044","date":"2020-11-19","year":2020,"title":"UK Announces Major Military Investment Including AI Intelligence Agency","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-19-1755"},{"id":"INC-06936","date":"2020-11-19","year":2020,"title":"Study Finds AI Driving Aids Increase Driver Disengagement and Road Safety Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-19-6637"},{"id":"INC-06745","date":"2020-11-19","year":2020,"title":"Japanese Police Arrest Three for Deepfake Porn Targeting Female Celebrities","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-19-9f4f"},{"id":"INC-06284","date":"2020-11-19","year":2020,"title":"AI-Enabled Drone Swarms Used in Modern Warfare Cause Harm in Conflict Zones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-19-efe7"},{"id":"INC-06443","date":"2020-11-20","year":2020,"title":"China's First Facial Recognition Lawsuit: Court Rules Against Zoo's Unconsented Data Collection","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-20-0f30"},{"id":"INC-06754","date":"2020-11-20","year":2020,"title":"Korean Go Prodigy Banned for One Year After Using AI to Cheat in Competition","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-20-3675"},{"id":"INC-06889","date":"2020-11-21","year":2020,"title":"Russia Develops AI-Based Autonomous Satellite Control Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-21-4913"},{"id":"INC-06534","date":"2020-11-21","year":2020,"title":"EU Privacy Laws Threaten AI-Based Child Abuse Detection Online","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-21-7d2a"},{"id":"INC-06741","date":"2020-11-21","year":2020,"title":"Japan Trials Autonomous Buses on Public Roads Amid Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-21-9ce4"},{"id":"INC-06524","date":"2020-11-22","year":2020,"title":"Elderly Woman Forced to Undergo Facial Recognition Sparks Outcry and Bank Apology in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-22-49b3"},{"id":"INC-06895","date":"2020-11-22","year":2020,"title":"Russian Interior Ministry to Create Centralized Biometric Database Using AI","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-22-c6ba"},{"id":"INC-07123","date":"2020-11-23","year":2020,"title":"Weibo's Algorithmic Content Moderation Harms Musicians and Creators","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-23-0602"},{"id":"INC-06606","date":"2020-11-23","year":2020,"title":"Facial Recognition in Real Estate and Residential Areas Raises Privacy and Financial Concerns in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-23-0607"},{"id":"INC-06324","date":"2020-11-23","year":2020,"title":"AI-Powered Surveillance in Xinjiang Enables Human Rights Abuses","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-11-23-4e13"},{"id":"INC-06579","date":"2020-11-24","year":2020,"title":"Facebook's AI Algorithms Promote Holocaust Denial Content Despite Ban","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-24-50b1"},{"id":"INC-06638","date":"2020-11-24","year":2020,"title":"Germany Funds Research on Safety of Automated AI-Driven Rail Operations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-24-ebdf"},{"id":"INC-06425","date":"2020-11-25","year":2020,"title":"Castilla y León Launches AI Pilot to Predict Gender-Based Violence Risk","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-25-1f1d"},{"id":"INC-06341","date":"2020-11-25","year":2020,"title":"Amazon Alexa Accused of Spreading Antisemitic Conspiracy Theories","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-25-48e1"},{"id":"INC-06438","date":"2020-11-25","year":2020,"title":"China's AI-Powered Network ID System Raises Privacy and Human Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-25-9f48"},{"id":"INC-07043","date":"2020-11-26","year":2020,"title":"UK and France Invest in Autonomous AI Minehunting Systems for Naval Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-26-07c0"},{"id":"INC-07064","date":"2020-11-26","year":2020,"title":"UN Warns AI in Policing Reinforces Racial Profiling and Discrimination","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-26-3ffd"},{"id":"INC-06326","date":"2020-11-26","year":2020,"title":"AI-Powered Wearable ECG Devices Prevent Sudden Cardiac Deaths in Taiwan","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-26-4777"},{"id":"INC-06237","date":"2020-11-26","year":2020,"title":"AI Pricing Algorithms Linked to Collusive Price Increases in Retail Markets","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-26-d00c"},{"id":"INC-14907","date":"2020-11-26","year":2020,"title":"Greek Tax Authority Plans AI System to Combat Tax Evasion","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-26-f2d2"},{"id":"INC-06358","date":"2020-11-27","year":2020,"title":"Amnesty International Urges EU to Block Google-Fitbit Merger Over AI-Driven Human Rights Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-27-4564"},{"id":"INC-06980","date":"2020-11-28","year":2020,"title":"Tesla Plans Wider Release of Full Self-Driving Beta Software Amid Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-28-f87f"},{"id":"INC-06788","date":"2020-11-28","year":2020,"title":"Microsoft Patents AI System to Monitor and Score Employee Behavior in Meetings","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-28-f893"},{"id":"INC-06969","date":"2020-11-29","year":2020,"title":"Tesla FSD AI System Linked to Fatal Accidents and Ongoing Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-29-7768"},{"id":"INC-14659","date":"2020-11-29","year":2020,"title":"China Faces Backlash Over Widespread Facial Recognition Misuse and Privacy Violations","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-29-8b1d"},{"id":"INC-06937","date":"2020-11-30","year":2020,"title":"Study Finds Automated Vehicle AI Reduces Driver Attention, Raising Accident Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-30-3a6f"},{"id":"INC-06519","date":"2020-11-30","year":2020,"title":"Dutch Scientists Call for Ban on Lethal Autonomous Weapons","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-30-abf2"},{"id":"INC-06374","date":"2020-11-30","year":2020,"title":"Audi Plans to Launch Level 4 Autonomous Vehicles Within Four Years","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-30-b5d6"},{"id":"INC-14660","date":"2020-11-30","year":2020,"title":"EU Funds AI-Enabled Stealth Military Drone LOTUS by Intracom Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-11-30-fdc8"},{"id":"INC-07134","date":"2020-12-01","year":2020,"title":"XPeng Unveils Second-Generation AI-Driven Flying Car, Plans Public Test Flights","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-01-6baf"},{"id":"INC-06506","date":"2020-12-02","year":2020,"title":"Delhi High Court Reviews AI-Enabled Surveillance Systems Over Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-02-2720"},{"id":"INC-06402","date":"2020-12-02","year":2020,"title":"Boeing Tests AI-Enabled Autonomous Combat Drones in Australia","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-02-52f6"},{"id":"INC-06927","date":"2020-12-02","year":2020,"title":"SsangYong Begins Public Road Testing of Level 3 Autonomous Driving in Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-02-68f2"},{"id":"INC-06352","date":"2020-12-02","year":2020,"title":"Amazon's AWS Panorama Raises Privacy Concerns Over AI Workplace Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-02-abaf"},{"id":"INC-06227","date":"2020-12-02","year":2020,"title":"AI Hiring Algorithms Amplify Gender Bias Against Women","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-02-c441"},{"id":"INC-06903","date":"2020-12-03","year":2020,"title":"Scientists Warn of AI Neurotechnology Risks, Call for 'Neuro-Rights' Protections","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-03-6f34"},{"id":"INC-06387","date":"2020-12-03","year":2020,"title":"AutoX Deploys Fully Autonomous Robotaxi Fleet in Shenzhen, China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-03-77e3"},{"id":"INC-06887","date":"2020-12-03","year":2020,"title":"Romanian Competition Council Warns of AI-Driven Anti-Competitive Risks from Big Data Technologies","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-03-91b6"},{"id":"INC-06440","date":"2020-12-03","year":2020,"title":"China's AI-Run Smart City Raises Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-03-ac12"},{"id":"INC-06893","date":"2020-12-04","year":2020,"title":"Russia Tests AI-Enabled Combat Drones in Syria","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-04-24ea"},{"id":"INC-06604","date":"2020-12-04","year":2020,"title":"Facial Recognition in China Sparks Privacy Backlash and Legal Action","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-04-3805"},{"id":"INC-06539","date":"2020-12-04","year":2020,"title":"Expert Warns of China's AI-Driven Global DNA Collection and Bioweapon Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-04-b166"},{"id":"INC-06712","date":"2020-12-04","year":2020,"title":"Indonesian Minister Warns 23 Million Jobs at Risk from AI and Automation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-04-bd4d"},{"id":"INC-06315","date":"2020-12-05","year":2020,"title":"AI-Powered Police Drones Spark Privacy and Civil Rights Concerns in U.S. Cities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-05-f1ab"},{"id":"INC-06608","date":"2020-12-06","year":2020,"title":"Facial Recognition Toilet Paper Dispenser in Dongguan Halted Over Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-06-9887"},{"id":"INC-06391","date":"2020-12-07","year":2020,"title":"Baidu Receives First Permit for Fully Driverless Vehicle Tests in Beijing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-07-0fc1"},{"id":"INC-07070","date":"2020-12-07","year":2020,"title":"US Air Force Awards Contracts for Autonomous Skyborg Combat Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-07-6a59"},{"id":"INC-06852","date":"2020-12-08","year":2020,"title":"Political Dispute Over AI-Enabled Armed Drones in Germany Raises Ethical Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-08-415b"},{"id":"INC-06435","date":"2020-12-09","year":2020,"title":"China's AI Surveillance System Leads to Mass Detention of Uyghur Muslims","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-09-9b18"},{"id":"INC-06648","date":"2020-12-09","year":2020,"title":"GM's Cruise Begins Testing Fully Driverless Cars in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-09-b92f"},{"id":"INC-06473","date":"2020-12-10","year":2020,"title":"Co-op's Covert Facial Recognition Trial Sparks Privacy Outcry in UK Stores","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-6096"},{"id":"INC-06364","date":"2020-12-10","year":2020,"title":"Antoine Griezmann Ends Huawei Partnership Over AI Surveillance Allegations Involving Uighurs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-7d1c"},{"id":"INC-06595","date":"2020-12-10","year":2020,"title":"Facial Recognition AI Misuse Leads to Privacy Breaches and Financial Fraud in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-bb40"},{"id":"INC-06789","date":"2020-12-10","year":2020,"title":"Microsoft Patents AI Technology to Create Virtual Replicas of Deceased Individuals","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-c667"},{"id":"INC-07096","date":"2020-12-10","year":2020,"title":"US Negotiates Sale of AI-Enabled MQ-9B Drones to Morocco","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-c824"},{"id":"INC-06662","date":"2020-12-10","year":2020,"title":"Google Maps Route Leads to Teen's Death in Siberian Cold","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-10-d91c"},{"id":"INC-06224","date":"2020-12-11","year":2020,"title":"AI Face-Swapping Alters Fan Bingbing's Film Role, Damaging Career and Image","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-11-89da"},{"id":"INC-06885","date":"2020-12-11","year":2020,"title":"Robots Influence Human Risk-Taking in Behavioral Study","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-11-f75d"},{"id":"INC-14661","date":"2020-12-12","year":2020,"title":"AI-Generated Fake Human Images Used for Online Deception and Espionage","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-12-d5e3"},{"id":"INC-06287","date":"2020-12-13","year":2020,"title":"AI-Enabled Drones Escalate Military Tensions and Destabilize Global Politics","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-13-d60c"},{"id":"INC-06382","date":"2020-12-14","year":2020,"title":"Autonomous Bus Malfunctions and Hits Guardrail During Japanese Field Test","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-14-1dbc"},{"id":"INC-06970","date":"2020-12-14","year":2020,"title":"Tesla FSD Beta Malfunctions in Construction Zones, Posing Safety Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-14-36ce"},{"id":"INC-07034","date":"2020-12-15","year":2020,"title":"U.S. Army and Clemson University Launch Autonomous Military Vehicle Research Initiative","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-15-16b4"},{"id":"INC-07115","date":"2020-12-15","year":2020,"title":"Walmart Deploys Fully Driverless Delivery Trucks in Arkansas with Gatik","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-15-74e2"},{"id":"INC-07021","date":"2020-12-15","year":2020,"title":"Turkey Unveils First Armed AI-Driven Unmanned Naval Vehicle (SİDA) Prototype","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-15-89a7"},{"id":"INC-06915","date":"2020-12-15","year":2020,"title":"Siri Labels Footballer Lorenzo Insigne with Offensive Term, Prompting Outcry and Apple Response","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-15-b566"},{"id":"INC-06521","date":"2020-12-15","year":2020,"title":"Dutch Supermarket Warned for Illegal Use of Facial Recognition AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-15-f8c2"},{"id":"INC-06239","date":"2020-12-16","year":2020,"title":"AI Proctoring Software Causes Privacy Violations and Racial Bias in Online Exams","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-16-4ba7"},{"id":"INC-06802","date":"2020-12-16","year":2020,"title":"Motional and Lyft to Deploy Fully Driverless Robotaxi Services in US Cities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-16-6862"},{"id":"INC-06562","date":"2020-12-16","year":2020,"title":"Facebook Develops AI-Powered Neural Sensor to Read Thoughts","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-16-ccce"},{"id":"INC-06997","date":"2020-12-17","year":2020,"title":"TikTok's AI Moderation Fails to Curb Anti-Vaccine Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-17-39f9"},{"id":"INC-06434","date":"2020-12-17","year":2020,"title":"China Uses AI Surveillance to Monitor and Intimidate Uyghurs Abroad","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-17-6033"},{"id":"INC-06775","date":"2020-12-17","year":2020,"title":"Meituan Accused of Using AI-Driven 'Big Data Discrimination' to Overcharge Loyal Members","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-17-bbde"},{"id":"INC-07082","date":"2020-12-18","year":2020,"title":"US Bans DJI Over AI Surveillance and Human Rights Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-18-81e8"},{"id":"INC-07144","date":"2020-12-18","year":2020,"title":"YouTube's AI Moderation Fails to Curb Myanmar Election Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-18-c2e9"},{"id":"INC-07022","date":"2020-12-19","year":2020,"title":"Turkish Company Develops AI-Enabled Unmanned Helicopter for Civil and Military Use","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-19-8e18"},{"id":"INC-07128","date":"2020-12-19","year":2020,"title":"Widespread Harms and Legal Backlash from Facial Recognition AI in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-19-c53a"},{"id":"INC-06692","date":"2020-12-19","year":2020,"title":"IMF Proposes Using AI to Analyze Web History for Credit Scoring","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2020-12-19-f03d"},{"id":"INC-07071","date":"2020-12-20","year":2020,"title":"US Air Force Deploys AI Robot Dogs for Military Base Security Patrols","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-20-8f55"},{"id":"INC-06563","date":"2020-12-21","year":2020,"title":"Facebook Disables Child Abuse Detection AI in Europe Due to EU Privacy Rules","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-21-4bb0"},{"id":"INC-06907","date":"2020-12-21","year":2020,"title":"Secretive Palantir NHS Data Deal Sparks Privacy and Legal Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-21-69e5"},{"id":"INC-06671","date":"2020-12-21","year":2020,"title":"Google's AI-Enabled Nest Hub Max Raises Privacy Concerns with Continuous User Monitoring","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-21-a06d"},{"id":"INC-06216","date":"2020-12-21","year":2020,"title":"AI and Satellite Data Reveal Widespread Forced Labor in Global Fishing Fleet","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-21-c1ce"},{"id":"INC-06575","date":"2020-12-21","year":2020,"title":"Facebook's AI Ad Systems Lock Out Small Advertisers, Causing Financial Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-21-c895"},{"id":"INC-06945","date":"2020-12-22","year":2020,"title":"Tech Giants and NGOs Challenge NSO Group Over AI-Driven Pegasus Spyware Abuse","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-22-d389"},{"id":"INC-06617","date":"2020-12-23","year":2020,"title":"Filipino Actress Maine Mendoza Targeted by Deepfake Pornography, Legal Action Pursued","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-23-0265"},{"id":"INC-14662","date":"2020-12-24","year":2020,"title":"AI-Enabled Biometric Data Misuse Leads to Fraud and Privacy Violations in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-24-b59d"},{"id":"INC-06659","date":"2020-12-24","year":2020,"title":"Google and Wikipedia AI Error Misidentifies Celebrity Relationships","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-24-d7f8"},{"id":"INC-06727","date":"2020-12-27","year":2020,"title":"Israel Deploys AI-Driven Drones and Robots for Autonomous Urban Warfare Targeting","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-27-0129"},{"id":"INC-06821","date":"2020-12-29","year":2020,"title":"NSO Group's AI Systems Breach Privacy in Demos and Spyware Attacks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-29-b3cc"},{"id":"INC-07054","date":"2020-12-29","year":2020,"title":"UK Plans Armed Drone Program Inspired by AI-Driven Success in Nagorno-Karabakh Conflict","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-29-c4ba"},{"id":"INC-07016","date":"2020-12-30","year":2020,"title":"Turkey Develops AI-Controlled Swarm Drones for Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2020-12-30-3085"},{"id":"INC-05544","date":"2021-01-01","year":2021,"title":"Chinese Underwater AI Drone Breaches Indonesian Waters, Sparks Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-2488"},{"id":"INC-05723","date":"2021-01-01","year":2021,"title":"Israel's AI-Powered Virus Surveillance Tool Sparks Privacy and Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-277e"},{"id":"INC-05729","date":"2021-01-01","year":2021,"title":"Japan Develops AI-Enabled Autonomous Fighter Drones Amid Rising Tensions with China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-7a9d"},{"id":"INC-05552","date":"2021-01-01","year":2021,"title":"Concerns Rise Over AI-Powered Robotic Police Deployment","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-8035"},{"id":"INC-05684","date":"2021-01-01","year":2021,"title":"Google's Wing Warns of Privacy Risks from New US Drone Location Broadcast Law","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-9d0a"},{"id":"INC-05369","date":"2021-01-01","year":2021,"title":"12-Year-Old Sues TikTok Over Illegal Data Use by AI Algorithm","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-aa84"},{"id":"INC-05875","date":"2021-01-01","year":2021,"title":"Taiwan's 'Electronic Fence' AI Surveillance System Sparks Human Rights Concerns During COVID-19 Quarantine Enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-01-f4cf"},{"id":"INC-05438","date":"2021-01-02","year":2021,"title":"AI-Powered Smart Cushions Used for Employee Surveillance in Hangzhou Company","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-02-95b0"},{"id":"INC-06130","date":"2021-01-03","year":2021,"title":"Turkey Deploys AI-Driven Checkpoints for Law Enforcement Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-03-9e95"},{"id":"INC-05849","date":"2021-01-04","year":2021,"title":"Singapore Police Granted Access to COVID-19 Contact Tracing App Data, Sparking Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-04-03e2"},{"id":"INC-05761","date":"2021-01-06","year":2021,"title":"Mexican Students Develop AI System to Detect Mask Compliance in Public Spaces","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-06-1af4"},{"id":"INC-06149","date":"2021-01-06","year":2021,"title":"US Air Force Funds AI-Enabled Radar for Autonomous eVTOL Aircraft","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-06-3d74"},{"id":"INC-05717","date":"2021-01-06","year":2021,"title":"Iranian Army Demonstrates AI-Enabled Combat Drones in Major Military Exercise","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-06-b6f8"},{"id":"INC-05537","date":"2021-01-07","year":2021,"title":"Chinese Consumer Association Exposes AI-Driven Algorithmic Harms in E-Commerce Platforms","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-07-48ae"},{"id":"INC-06150","date":"2021-01-07","year":2021,"title":"US Air Force Test of AI-Enabled Collaborative Bombs Fails Due to Software Error","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-07-6c86"},{"id":"INC-05623","date":"2021-01-08","year":2021,"title":"Facebook Uses AI to Remove Child Exploitation Content","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-08-4046"},{"id":"INC-05484","date":"2021-01-08","year":2021,"title":"Apple and Hyundai Plan Autonomous Electric Vehicle Partnership","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-08-7b37"},{"id":"INC-05399","date":"2021-01-08","year":2021,"title":"AI-Assisted Identification of US Capitol Rioters Using Facial Recognition and Cell Data","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-08-bb0b"},{"id":"INC-05406","date":"2021-01-08","year":2021,"title":"AI-Driven Social Media Failures Contribute to Capitol Hill Violence","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-08-c3a0"},{"id":"INC-06185","date":"2021-01-09","year":2021,"title":"WeChat's AI-Driven Political Censorship Extends to North American Users","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-09-0bb2"},{"id":"INC-05801","date":"2021-01-09","year":2021,"title":"Police Surge Use of Clearview AI Facial Recognition After Capitol Riot Raises Privacy Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-09-7614"},{"id":"INC-05594","date":"2021-01-11","year":2021,"title":"Experts Warn of Potential Climate Risks from AI-Driven Autonomous Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-11-6f83"},{"id":"INC-05843","date":"2021-01-11","year":2021,"title":"Scientists Warn of Uncontrollable Superintelligent AI Risk","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-11-7faa"},{"id":"INC-14663","date":"2021-01-11","year":2021,"title":"Milrem Robotics' Type-X Autonomous Combat Vehicle Passes Initial Tests, Raising Future AI Risk Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-11-9ea0"},{"id":"INC-05661","date":"2021-01-11","year":2021,"title":"Global Militaries Advance AI-Enabled Autonomous Combat Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-11-a85e"},{"id":"INC-05706","date":"2021-01-11","year":2021,"title":"Indy Autonomous Challenge: AI-Powered Driverless Car Race Announced at Indianapolis Motor Speedway","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-11-fe74"},{"id":"INC-05422","date":"2021-01-12","year":2021,"title":"AI-Enabled Manipulation of Children's Images Fuels Online Sexualized Content Scandal","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-12-353c"},{"id":"INC-05839","date":"2021-01-12","year":2021,"title":"Russian AI-Enabled Okhotnik Drone Conducts Autonomous Bombing Test","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-12-7426"},{"id":"INC-05861","date":"2021-01-12","year":2021,"title":"Stanford AI Predicts Political Affiliation from Facial Images, Raising Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-01-12-9780"},{"id":"INC-05773","date":"2021-01-12","year":2021,"title":"Muslim Prayer App 'Salaat First' Sells User Data for Surveillance","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-12-feeb"},{"id":"INC-05730","date":"2021-01-13","year":2021,"title":"Japan Trials 5G-Enabled Autonomous Buses, Raising Future AI Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-13-2986"},{"id":"INC-05850","date":"2021-01-14","year":2021,"title":"Singapore Trials Autonomous Road Sweepers in Controlled Environments","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-14-26a9"},{"id":"INC-05652","date":"2021-01-14","year":2021,"title":"French Police Sanctioned for Unlawful Use of AI-Enabled Drones During Lockdown","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-14-41a6"},{"id":"INC-14664","date":"2021-01-14","year":2021,"title":"Public Outcry in South Korea Over AI-Generated Deepfake Porn Targeting Female Celebrities","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-14-a0da"},{"id":"INC-05576","date":"2021-01-15","year":2021,"title":"Deployment of AI-Enabled Akıncı Armed Drone Raises Future Risk Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-15-038d"},{"id":"INC-05703","date":"2021-01-15","year":2021,"title":"Indian Army Demonstrates AI-Enabled Autonomous Drone Swarms for Military Use","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-15-7672"},{"id":"INC-05619","date":"2021-01-15","year":2021,"title":"Facebook Settles Lawsuit Over Unconsented Facial Recognition Data Collection in Illinois","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-15-ccb6"},{"id":"INC-05736","date":"2021-01-17","year":2021,"title":"Kia Explores Self-Driving Electric Car Partnerships Amid Apple Rumors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-17-1ee0"},{"id":"INC-05678","date":"2021-01-17","year":2021,"title":"Google Translate Mistranslates Politically Sensitive Phrases, Causing Misinformation Outrage","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-17-395e"},{"id":"INC-06126","date":"2021-01-19","year":2021,"title":"Trump Orders Review and Removal of Chinese-Made Drones Over Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-19-2735"},{"id":"INC-06145","date":"2021-01-19","year":2021,"title":"UK Watchdog Warns of AI Algorithm Risks to Consumers and Competition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-19-3e57"},{"id":"INC-05424","date":"2021-01-19","year":2021,"title":"AI-Enabled Mood-Tracking Wristband Raises Workplace Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-19-9827"},{"id":"INC-06112","date":"2021-01-19","year":2021,"title":"TikTok Influencer Endangers Public by Misusing Tesla Autopilot for Viral Stunt","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-19-bb93"},{"id":"INC-05765","date":"2021-01-20","year":2021,"title":"Microsoft Patents AI Chatbots to Simulate Deceased Individuals","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-20-1d3a"},{"id":"INC-06127","date":"2021-01-20","year":2021,"title":"Trump Pardons Engineer Convicted of Stealing AI Trade Secrets from Google","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-20-a599"},{"id":"INC-05659","date":"2021-01-21","year":2021,"title":"Global Expansion and Regulation of AI-Enabled Military and Autonomous Drones Raises Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-21-20e2"},{"id":"INC-05555","date":"2021-01-21","year":2021,"title":"Controversial Use of Facial Recognition AI by US Law Enforcement Leads to Rights Violations and Wrongful Arrests","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-21-80e4"},{"id":"INC-14665","date":"2021-01-21","year":2021,"title":"AI Face-Swapping Scam Leads to Financial Loss in Nanjing","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-21-8644"},{"id":"INC-05384","date":"2021-01-21","year":2021,"title":"AI Facial Recognition in Lucknow Raises Privacy Concerns Amid Women's Safety Push","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-21-da5b"},{"id":"INC-05368","date":"2021-01-23","year":2021,"title":"10-Year-Old Dies After TikTok Blackout Challenge in Italy","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-23-1dad"},{"id":"INC-05533","date":"2021-01-23","year":2021,"title":"Chinese AI Input Methods Collect and Upload User Data, Raising Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-23-784e"},{"id":"INC-06144","date":"2021-01-24","year":2021,"title":"UK to Allow Hands-Free Driving with Automated Lane-Keeping AI on Motorways","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-24-816d"},{"id":"INC-06187","date":"2021-01-25","year":2021,"title":"Widespread Misuse of Facial Recognition AI Leads to Privacy Violations in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-25-0779"},{"id":"INC-06165","date":"2021-01-25","year":2021,"title":"US Marine Corps Commissions AI-Enabled Autonomous Naval Weapons System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-25-07cd"},{"id":"INC-05580","date":"2021-01-25","year":2021,"title":"Dubai Police Use AI 'Memory Fingerprint' to Solve Murder Case","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-25-60a7"},{"id":"INC-06166","date":"2021-01-25","year":2021,"title":"US Military Considers Reducing Human Control Over AI in Drone Warfare","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-25-87d0"},{"id":"INC-05688","date":"2021-01-25","year":2021,"title":"Hanson Robotics Plans Mass Deployment of AI Humanoid Robots in Healthcare and Education","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-25-f3dc"},{"id":"INC-05475","date":"2021-01-26","year":2021,"title":"Amnesty International Condemns Harmful Use of Facial Recognition by Police in New York","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-01-26-3e15"},{"id":"INC-05624","date":"2021-01-26","year":2021,"title":"Facebook's AI Group Recommendations Linked to Capitol Riot and Extremism","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-26-c4dd"},{"id":"INC-06168","date":"2021-01-26","year":2021,"title":"US Panel Urges Development of AI-Powered Autonomous Weapons Despite Global Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-26-fcc5"},{"id":"INC-05427","date":"2021-01-27","year":2021,"title":"AI-Generated Adversarial Glasses Bypass Facial Recognition on 19 Android Phones","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-27-52de"},{"id":"INC-05498","date":"2021-01-27","year":2021,"title":"Baidu Receives California Permit for Fully Driverless Vehicle Testing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-27-55d4"},{"id":"INC-05859","date":"2021-01-27","year":2021,"title":"Spotify Patents AI to Analyze User Emotions via Voice for Music Recommendations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-27-b1f2"},{"id":"INC-06181","date":"2021-01-27","year":2021,"title":"Waymo Discloses 47 Incidents Involving Level 4 Autonomous Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-27-be7e"},{"id":"INC-05394","date":"2021-01-28","year":2021,"title":"AI System IdentiFlight Reduces Eagle Deaths at Wind Farms by 82%","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-28-085c"},{"id":"INC-05763","date":"2021-01-28","year":2021,"title":"Microsoft Cancels AI Chatbot Project Simulating Conversations with the Deceased","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-28-1267"},{"id":"INC-05495","date":"2021-01-28","year":2021,"title":"AutoX Launches Fully Driverless Robotaxi Service to Public in Shenzhen","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-28-65c7"},{"id":"INC-05448","date":"2021-01-29","year":2021,"title":"Algorithmic Pricing on Food Delivery App Harms Members with Higher Fees","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-29-e922"},{"id":"INC-05536","date":"2021-01-30","year":2021,"title":"Chinese AI-Enabled Genomics Firm Accused of Collecting US DNA Data, Raising National Security Concerns","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-30-975d"},{"id":"INC-05418","date":"2021-01-30","year":2021,"title":"AI-Enabled Drone Swarms Cause and Pose Risks in Modern Warfare","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-30-c343"},{"id":"INC-05548","date":"2021-01-31","year":2021,"title":"Clearview AI's Facial Recognition System Violates Canadian Privacy Laws","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-01-31-87ca"},{"id":"INC-05583","date":"2021-02-01","year":2021,"title":"Dutch Municipalities' Use of AI Algorithms Leads to Wrongful Fraud Accusations and Discrimination Risks","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-01-9dd5"},{"id":"INC-05702","date":"2021-02-01","year":2021,"title":"India Unveils AI-Enabled Combat Drone Teaming System","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-01-acf5"},{"id":"INC-06100","date":"2021-02-02","year":2021,"title":"Tesla Recalls 135,000 Vehicles Over AI System Safety Defect","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-02-00f8"},{"id":"INC-05485","date":"2021-02-03","year":2021,"title":"Apple Car Patent Reveals AI-Based Traffic Gesture Recognition System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-03-0e71"},{"id":"INC-05528","date":"2021-02-03","year":2021,"title":"China's Emotion Recognition AI Used for Mass Surveillance and Human Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-03-ea08"},{"id":"INC-05387","date":"2021-02-04","year":2021,"title":"AI Malfunction Causes Golden Horde Swarming Munitions to Miss Intended Targets in USAF Test","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-04-036e"},{"id":"INC-05590","date":"2021-02-04","year":2021,"title":"European Project Tests Highly Autonomous Drones for Urban Air Mobility","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-04-a6c0"},{"id":"INC-05648","date":"2021-02-05","year":2021,"title":"Finnish Regulator Warns of AI-Driven Personalized Pricing Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-02-05-9222"},{"id":"INC-05530","date":"2021-02-05","year":2021,"title":"Chinese AI Face-Swapping App Raises Privacy and Security Concerns in Taiwan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-05-9a29"},{"id":"INC-05542","date":"2021-02-06","year":2021,"title":"Chinese Regulators Summon Tesla Over AI-Related Vehicle Safety Incidents","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-06-3962"},{"id":"INC-05682","date":"2021-02-07","year":2021,"title":"Google's AI-Based FLoC Raises Privacy Concerns Amid Shift from Cookies","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-07-3fb0"},{"id":"INC-05719","date":"2021-02-08","year":2021,"title":"Israel Aerospace Unveils AI-Powered WASP Surveillance System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-08-1a0e"},{"id":"INC-05825","date":"2021-02-08","year":2021,"title":"Researchers Demonstrate Deepfake Detectors Can Be Fooled by Adversarial Attacks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-08-6a6d"},{"id":"INC-05602","date":"2021-02-08","year":2021,"title":"Facebook AI Moderation Wrongly Bans Art Gallery Photos, Causing Business Disruption","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-08-af55"},{"id":"INC-05560","date":"2021-02-09","year":2021,"title":"Dahua AI Facial Recognition Enables Uyghur Surveillance, Raises Human Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-09-4ca9"},{"id":"INC-05547","date":"2021-02-09","year":2021,"title":"Clearview AI's Facial Recognition Sparks Global Privacy Violations and Regulatory Action","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-09-57e2"},{"id":"INC-05413","date":"2021-02-09","year":2021,"title":"AI-Enabled Automated Gun Used in Assassination of Iranian Nuclear Scientist","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-09-6af7"},{"id":"INC-06124","date":"2021-02-10","year":2021,"title":"Toyota, Aurora, and Denso Partner to Develop Autonomous Taxis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-10-fbed"},{"id":"INC-05663","date":"2021-02-11","year":2021,"title":"Google Ads AI Enabled Discrimination Against Nonbinary Users","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-02-11-5601"},{"id":"INC-05840","date":"2021-02-11","year":2021,"title":"Russian Police Use AI Facial Recognition to Detain Protesters","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-11-6ee5"},{"id":"INC-05796","date":"2021-02-11","year":2021,"title":"Pentagon Accelerates Deployment of Autonomous Military Vehicles, Raising AI Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-11-e6d2"},{"id":"INC-06131","date":"2021-02-12","year":2021,"title":"Turkey Launches First Armed Unmanned Naval Vehicle ULAQ, Raising AI Weaponization Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-12-123c"},{"id":"INC-05469","date":"2021-02-12","year":2021,"title":"Amazon's AI-Driven Mentor App Raises Privacy and Labor Rights Concerns for Delivery Drivers","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-12-18d7"},{"id":"INC-05857","date":"2021-02-14","year":2021,"title":"South Korean AI System Predicts Crimes by Reading Emotions, Raising Human Rights Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-14-5411"},{"id":"INC-14666","date":"2021-02-14","year":2021,"title":"AI-Enabled Drones Used in Repeated Attacks on Abha International Airport","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-14-7cea"},{"id":"INC-05392","date":"2021-02-14","year":2021,"title":"AI System Demonstrated to Manipulate Human Decision-Making in Experiments","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-14-940c"},{"id":"INC-05653","date":"2021-02-17","year":2021,"title":"French Tax Authority Deploys AI to Monitor Social Media for Tax Fraud","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-17-99f3"},{"id":"INC-05830","date":"2021-02-17","year":2021,"title":"Rights Groups Demand Moratorium on Harmful Government Facial Recognition Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-02-17-f019"},{"id":"INC-05747","date":"2021-02-18","year":2021,"title":"London Councils Use AI Surveillance Linked to Uyghur Human Rights Abuses","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-18-080f"},{"id":"INC-05790","date":"2021-02-19","year":2021,"title":"Oracle AI Surveillance Software Used by Chinese Authorities for Citizen Monitoring and Repression","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-02-19-1519"},{"id":"INC-06092","date":"2021-02-20","year":2021,"title":"Tesla Navigation AI Crashes in Taiwan When Given Specific Voice Command","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-20-db4d"},{"id":"INC-05586","date":"2021-02-21","year":2021,"title":"EDGE Unveils UAE-Made AI-Enabled Loitering Munitions and Autonomous Military Drones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-21-ac2e"},{"id":"INC-05770","date":"2021-02-22","year":2021,"title":"Motional Deploys Fully Driverless Vehicles on Las Vegas Public Roads","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-22-4124"},{"id":"INC-05681","date":"2021-02-22","year":2021,"title":"Google's AI Tools Aid Global Fight Against Online Child Sexual Abuse Material","severity":"Critical","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-22-4cab"},{"id":"INC-06148","date":"2021-02-22","year":2021,"title":"UN Chief Warns of AI-Driven Data Manipulation Violating Human Rights","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-22-afbf"},{"id":"INC-05481","date":"2021-02-22","year":2021,"title":"AnyVision Patents AI-Driven Facial Recognition Drones, Raising Surveillance Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-22-b352"},{"id":"INC-05809","date":"2021-02-22","year":2021,"title":"Public Remotely Controls Armed Robot Dog in Art Stunt, Raising AI Weaponization Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-22-e603"},{"id":"INC-05423","date":"2021-02-23","year":2021,"title":"AI-Enabled Military and Surveillance Drones Raise Risks and Ethical Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-595a"},{"id":"INC-05511","date":"2021-02-23","year":2021,"title":"ByteDance Settles TikTok US Privacy Lawsuit Over AI-Driven Data Collection","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-8674"},{"id":"INC-05506","date":"2021-02-23","year":2021,"title":"Biased Algorithms Cause Discrimination in Key Decision-Making Systems","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-905c"},{"id":"INC-05610","date":"2021-02-23","year":2021,"title":"Facebook Deploys AI Tools to Combat Child Exploitation Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-b2e8"},{"id":"INC-06070","date":"2021-02-23","year":2021,"title":"Tesla AI Sensor Malfunctions Cause Phantom Pedestrian and Vehicle Detections","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-cff0"},{"id":"INC-05718","date":"2021-02-23","year":2021,"title":"Irish Data Regulator Blocks AI-Driven Facebook Suicide Alert and School Facial Recognition Plans","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-23-f6e7"},{"id":"INC-06113","date":"2021-02-24","year":2021,"title":"TikTok Removes Hundreds of Thousands of Misinformation Videos Using AI Systems","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-24-1a41"},{"id":"INC-06199","date":"2021-02-24","year":2021,"title":"Zimbabwe Vice President Claims AI Voice Cloning Used in Defamation Scandal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-24-1b06"},{"id":"INC-05690","date":"2021-02-24","year":2021,"title":"Heavy Rain Degrades LiDAR Object Detection in Autonomous Vehicles, Raising Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-24-1e1b"},{"id":"INC-05416","date":"2021-02-25","year":2021,"title":"AI-Enabled Bayraktar TB2 Drones Shift Balance in Nagorno-Karabakh Conflict","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-25-8f42"},{"id":"INC-05846","date":"2021-02-25","year":2021,"title":"Shanghai Deploys AI Digital Twin for Real-Time Urban Safety Management","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-25-adca"},{"id":"INC-14667","date":"2021-02-26","year":2021,"title":"AI Bots Amplified GameStop and Meme Stock Surge, Report Finds","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-26-0b5b"},{"id":"INC-06175","date":"2021-02-26","year":2021,"title":"Viral Tom Cruise Deepfakes on TikTok Raise Misinformation Concerns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-26-3039"},{"id":"INC-05550","date":"2021-02-26","year":2021,"title":"Cluj-Napoca to Launch Romania's First Autonomous Bus Pilot Project","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-26-39b3"},{"id":"INC-05607","date":"2021-02-26","year":2021,"title":"Facebook Considers Facial Recognition in Smart Glasses, Raising Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-26-da5e"},{"id":"INC-14668","date":"2021-02-27","year":2021,"title":"AI Traffic Enforcement at Taichung HSR Station Leads to Hundreds of Fines on First Day","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-02-27-747a"},{"id":"INC-05439","date":"2021-03-01","year":2021,"title":"AI-Powered Smart Doorbells Ruled to Infringe Neighbor Privacy in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-01-51e7"},{"id":"INC-05572","date":"2021-03-02","year":2021,"title":"Delhi Schools' Facial Recognition Rollout Sparks Privacy Backlash","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-02-0db6"},{"id":"INC-05724","date":"2021-03-02","year":2021,"title":"Israeli AI Surveillance Tools Used by Myanmar Military to Suppress Dissent Despite Embargoes","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-02-1bfc"},{"id":"INC-05491","date":"2021-03-02","year":2021,"title":"Australia Tests and Procures AI-Enabled Autonomous Military Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-02-809b"},{"id":"INC-06107","date":"2021-03-02","year":2021,"title":"TikTok AI Algorithm Implicated in Deaths of Three Egyptian Youths Due to Dangerous Challenge","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-02-9b1b"},{"id":"INC-05426","date":"2021-03-02","year":2021,"title":"AI-Enabled Turkish Armed Drones Influence Conflicts and Raise Future Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-02-f6aa"},{"id":"INC-14669","date":"2021-03-03","year":2021,"title":"US Report Urges AI Weapons Development Despite Global Ban Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-1b37"},{"id":"INC-05376","date":"2021-03-03","year":2021,"title":"AI Algorithm Prioritizes Covid-19 Vaccinations in Italy","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-1ca1"},{"id":"INC-05680","date":"2021-03-03","year":2021,"title":"Google's AI Algorithms Suppress Independent Media in Turkey, Favor Pro-Government Outlets","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-35ab"},{"id":"INC-05527","date":"2021-03-03","year":2021,"title":"China's 'Sharp Eyes' AI Surveillance Program Enables Mass Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-62b9"},{"id":"INC-06133","date":"2021-03-03","year":2021,"title":"Turkey Shifts to AI-Powered Combat Drones After Fighter Jet Project Fails","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-6da3"},{"id":"INC-05404","date":"2021-03-03","year":2021,"title":"AI-Driven Price Discrimination in Ride-Hailing Apps Harms Consumers","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-03-d44d"},{"id":"INC-14670","date":"2021-03-04","year":2021,"title":"Facebook's AI Blocks Misinformation Campaign Amid Russian Protests","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-04-11c6"},{"id":"INC-05383","date":"2021-03-04","year":2021,"title":"AI Face-Swapping App Avatarify Removed Amid Privacy and Rights Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-04-2cb9"},{"id":"INC-14671","date":"2021-03-04","year":2021,"title":"Study Uncovers Privacy Risks in Amazon Alexa's Third-Party Skills","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-04-74cb"},{"id":"INC-05567","date":"2021-03-05","year":2021,"title":"Deepfakes Successfully Fool Leading Facial Recognition AI, Exposing Security Risks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-05-9cba"},{"id":"INC-05789","date":"2021-03-06","year":2021,"title":"OpenAI's CLIP Vision AI Vulnerable to Simple Handwritten Attacks","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-06-cc1b"},{"id":"INC-14672","date":"2021-03-07","year":2021,"title":"AI-Enabled Turkish Drone Shot Down in Yemen Conflict","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-07-40b5"},{"id":"INC-05367","date":"2021-03-07","year":2021,"title":"\"Ant Ya Hey\" AI Face-Swapping App Removed Over Privacy and Rights Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-07-f58f"},{"id":"INC-05670","date":"2021-03-08","year":2021,"title":"Google Image Search AI Perpetuates Sexist and Racial Stereotypes","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-08-75c3"},{"id":"INC-05488","date":"2021-03-08","year":2021,"title":"ARAV Develops AI-Based Autonomous Control Systems for Construction Machinery","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-08-e7a3"},{"id":"INC-05677","date":"2021-03-09","year":2021,"title":"Google Translate AI Reinforces Sexist Stereotypes in Pronoun Selection","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-09-d4e3"},{"id":"INC-05568","date":"2021-03-10","year":2021,"title":"Deepfakes Threaten Security and Trust as AI-Generated Media Advances","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-10-0098"},{"id":"INC-05710","date":"2021-03-10","year":2021,"title":"Instagram Algorithm Promotes Harmful Misinformation, Study Finds","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-10-0f10"},{"id":"INC-05838","date":"2021-03-10","year":2021,"title":"Russia Expands AI Facial Recognition for Surveillance and Payments, Raising Rights Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-10-1737"},{"id":"INC-05751","date":"2021-03-10","year":2021,"title":"Massive AI Surveillance Camera Breach Exposes Sensitive Footage Worldwide","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-10-90ae"},{"id":"INC-05502","date":"2021-03-10","year":2021,"title":"Belgian Government Halts AI-Driven Citizen Profiling Project Amid Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-10-eb7d"},{"id":"INC-05538","date":"2021-03-11","year":2021,"title":"Chinese Consumer Authorities Expose AI-Driven Price Discrimination on Platforms","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-11-8d4b"},{"id":"INC-05374","date":"2021-03-11","year":2021,"title":"Adaptive Cruise Control Linked to Increased Driver Speeding, Raising Crash Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-11-9a00"},{"id":"INC-05786","date":"2021-03-13","year":2021,"title":"NTSB Criticizes Tesla for Testing Unfinished Autopilot AI on Public Roads","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-13-2d6e"},{"id":"INC-05795","date":"2021-03-13","year":2021,"title":"Pennsylvania Mother Uses Deepfake AI to Harass Daughter's Cheerleading Rivals","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-13-786a"},{"id":"INC-05836","date":"2021-03-13","year":2021,"title":"Russia Deploys AI-Enabled Drones and Robotic Systems in Military Operations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-13-8c70"},{"id":"INC-05408","date":"2021-03-13","year":2021,"title":"AI-Enabled AKINCI Drone Successfully Completes Advanced System Test in Turkey","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-13-c1b2"},{"id":"INC-06072","date":"2021-03-14","year":2021,"title":"Tesla AI System Failures Lead to Multiple Accidents and Public Outcry in China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-14-23dc"},{"id":"INC-05587","date":"2021-03-14","year":2021,"title":"Ele.me's AI-Driven Price Discrimination Harms Members and Consumers","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-14-c7df"},{"id":"INC-05397","date":"2021-03-15","year":2021,"title":"AI Video Surveillance Proposed to Prevent Suicides and Crimes in Prisons","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-15-335c"},{"id":"INC-05523","date":"2021-03-15","year":2021,"title":"China Deploys AI-Powered Mass Surveillance and Social Credit System","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-15-6ba0"},{"id":"INC-05585","date":"2021-03-16","year":2021,"title":"Dutch Police Facial Recognition System Retains Innocent Individuals in Database","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-16-4f70"},{"id":"INC-05385","date":"2021-03-18","year":2021,"title":"AI Forecasts Massive Sovereign Credit Downgrades Due to Climate Inaction","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-18-6b33"},{"id":"INC-05774","date":"2021-03-18","year":2021,"title":"Myanmar Military Uses AI Surveillance to Suppress Protesters","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-18-f22d"},{"id":"INC-05543","date":"2021-03-19","year":2021,"title":"Chinese Retailers Investigated for Illegal AI Facial Recognition Data Collection","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-19-403a"},{"id":"INC-06103","date":"2021-03-20","year":2021,"title":"Tesla's AI-Driven Self-Driving Systems Under Scrutiny After Accidents and Near-Misses","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-20-9cce"},{"id":"INC-05575","date":"2021-03-21","year":2021,"title":"Deployment and Trials of Level 3 Unmanned Autonomous Vehicles in Japan and China Raise AI Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-21-30da"},{"id":"INC-05713","date":"2021-03-22","year":2021,"title":"Instagram's AI Algorithms Facilitate Neo-Nazi Recruitment of Teenagers","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-22-10b4"},{"id":"INC-05638","date":"2021-03-22","year":2021,"title":"Facial Recognition Access in Chinese Residential Communities Raises Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-22-8c9c"},{"id":"INC-00964","date":"2021-03-22","year":2021,"title":"New York Lawmakers Propose Ban on Armed Police Robots Amid AI Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-22-9603"},{"id":"INC-06074","date":"2021-03-22","year":2021,"title":"Tesla Autopilot and FSD Beta Exhibit Dangerous Left-Turn Behavior in Real-World Tests","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-22-9db9"},{"id":"INC-05679","date":"2021-03-22","year":2021,"title":"Google Translate's Gender Bias Reinforces Stereotypes in Neutral Languages","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-22-a5c3"},{"id":"INC-06188","date":"2021-03-23","year":2021,"title":"Widespread Unauthorized Use of Facial Recognition in Chinese Real Estate Violates Privacy Laws","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-23-6e97"},{"id":"INC-05372","date":"2021-03-23","year":2021,"title":"Abu Dhabi Launches Pilot Program for AI-Powered Autonomous Passenger Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-23-fbe1"},{"id":"INC-05858","date":"2021-03-24","year":2021,"title":"Spanish Academics Demand Moratorium on Facial Recognition AI Pending Regulation","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-24-770d"},{"id":"INC-05628","date":"2021-03-24","year":2021,"title":"Facebook's AI Systems Amplify Extremist and White Supremacist Content","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-24-c898"},{"id":"INC-05746","date":"2021-03-25","year":2021,"title":"Lisbon Law School Drops AI Exam Surveillance After Privacy Backlash","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-25-22bb"},{"id":"INC-05877","date":"2021-03-25","year":2021,"title":"Teens Misuse Tesla Autopilot, Crash Into Police Car in Florida","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-25-3008"},{"id":"INC-06129","date":"2021-03-26","year":2021,"title":"Turkey Begins Serial Production of AI-Enabled Armed Drone AKINCI TİHA","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-26-5b59"},{"id":"INC-05433","date":"2021-03-27","year":2021,"title":"AI-Powered Body-Editing Apps Linked to Surge in Eating Disorders Among Youth","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-27-1293"},{"id":"INC-05660","date":"2021-03-29","year":2021,"title":"Global Incidents and Risks from Facial Recognition AI Systems","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-29-a74c"},{"id":"INC-06109","date":"2021-03-29","year":2021,"title":"TikTok Algorithm Promotes Banned Far-Right Content in the US","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-29-f369"},{"id":"INC-05696","date":"2021-03-30","year":2021,"title":"Hyundai, Motional, and Lyft Announce Deployment of Level 4 Robotaxis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-30-185a"},{"id":"INC-05676","date":"2021-03-30","year":2021,"title":"Google Tests FLoC AI Ad Targeting, Raising Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-30-2f21"},{"id":"INC-06095","date":"2021-03-30","year":2021,"title":"Tesla on Cruise Control Crashes into Truck in New Jersey, Prompting Federal Investigation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-30-bbb9"},{"id":"INC-05764","date":"2021-03-31","year":2021,"title":"Microsoft Contracts to Supply AI-Enabled AR Headsets to U.S. Army","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-31-9e97"},{"id":"INC-05522","date":"2021-03-31","year":2021,"title":"China Deploys AI Surveillance for Racial and Ethnic Profiling","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-03-31-a1e8"},{"id":"INC-05534","date":"2021-03-31","year":2021,"title":"Chinese AI Surveillance Data Leak Exposes Mass Tracking of Uyghurs and Foreigners","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-03-31-a839"},{"id":"INC-05662","date":"2021-04-02","year":2021,"title":"Global Workers Fear Job Loss from AI and Automation by 2025, WEF Report Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-02-6d38"},{"id":"INC-05721","date":"2021-04-04","year":2021,"title":"Israel Deploys AI-Enabled 'Oron' Spy Plane for Advanced Military Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-04-2d5a"},{"id":"INC-06153","date":"2021-04-05","year":2021,"title":"US Army Plans Deployment of AI Facial Recognition at Base Checkpoints Raises Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-05-088d"},{"id":"INC-05740","date":"2021-04-05","year":2021,"title":"Lawmakers Cite AI-Driven Privacy and Safety Failures in Facebook's Kids Platforms","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-05-830a"},{"id":"INC-06152","date":"2021-04-05","year":2021,"title":"US Air Force Tests AI-Enabled Valkyrie Drone Launching Autonomous Mini-Drone","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-05-beba"},{"id":"INC-05381","date":"2021-04-06","year":2021,"title":"AI Deepfake App Used to Create and Distribute Non-Consensual Fake Nude Images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-06-236f"},{"id":"INC-05640","date":"2021-04-06","year":2021,"title":"Facial Recognition AI in China: Security Flaws, Privacy Violations, and Positive Outcomes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-06-a4d4"},{"id":"INC-05420","date":"2021-04-06","year":2021,"title":"AI-Enabled Drones Used in Houthi Attacks on Saudi Targets Intercepted by Coalition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-06-b6df"},{"id":"INC-05551","date":"2021-04-06","year":2021,"title":"Coded Bias Exposes Real-World Harms of AI Discrimination","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-06-c604"},{"id":"INC-14673","date":"2021-04-06","year":2021,"title":"Google Photos AI Misclassifies Intimate Video, Causing Privacy Breach","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-06-d1f1"},{"id":"INC-05792","date":"2021-04-08","year":2021,"title":"P&G Collaborates on AI-Driven Tracking to Bypass Apple Privacy Rules in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-08-2a01"},{"id":"INC-00623","date":"2021-04-08","year":2021,"title":"French Army Tests Boston Dynamics' Spot Robot in Combat Training, Revealing Operational Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-08-2f69"},{"id":"INC-05620","date":"2021-04-08","year":2021,"title":"Facebook Sued Over AI Moderation Failures Allowing Anti-Muslim Hate Speech","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-08-ea89"},{"id":"INC-05601","date":"2021-04-09","year":2021,"title":"Facebook AI Algorithms Drastically Limit Hungarian Government Content During Pandemic","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-0645"},{"id":"INC-06197","date":"2021-04-09","year":2021,"title":"YouTube's AI Ad Targeting System Enables Monetization of Hate Speech and Discriminatory Practices","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-51ac"},{"id":"INC-05390","date":"2021-04-09","year":2021,"title":"AI Surveillance Technologies Raise Privacy Concerns in South Asia Amid Efforts to Curb Crimes Against Women","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-6783"},{"id":"INC-06163","date":"2021-04-09","year":2021,"title":"US Lab Develops AI System to Predict Names from Faces, Raising Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-9116"},{"id":"INC-05835","date":"2021-04-09","year":2021,"title":"Russia Deploys AI-Enabled Combat Robots in Military Units","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-9d5a"},{"id":"INC-05434","date":"2021-04-09","year":2021,"title":"AI-Powered Counter-Drone Systems Deployed to Protect Indian Forces","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-09-d1f4"},{"id":"INC-05701","date":"2021-04-10","year":2021,"title":"India Pilots Aadhaar-Based Facial Recognition for COVID-19 Vaccination Authentication","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-10-1991"},{"id":"INC-05529","date":"2021-04-10","year":2021,"title":"China's First Facial Recognition Lawsuit: Court Orders Deletion of Biometric Data","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-10-714f"},{"id":"INC-06186","date":"2021-04-12","year":2021,"title":"WeRide Receives Permit to Test Driverless Cars in California","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-0594"},{"id":"INC-05515","date":"2021-04-12","year":2021,"title":"Canada Cancels Drone Tech Exports to Turkey Over AI Use in Nagorno-Karabakh Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-0aec"},{"id":"INC-05760","date":"2021-04-12","year":2021,"title":"Mexican Biometric Mobile Registry Raises Data Protection Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-6f36"},{"id":"INC-05768","date":"2021-04-12","year":2021,"title":"Mobileye and Udelv Announce Large-Scale Autonomous Delivery Vehicle Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-8e96"},{"id":"INC-05603","date":"2021-04-12","year":2021,"title":"Facebook AI Moderation Wrongly Censors French Town 'Bitche' Over Name Confusion","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-bb39"},{"id":"INC-05808","date":"2021-04-12","year":2021,"title":"Public Outcry Over AI Robot Dog Deployment by Police and Military Forces","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-12-f667"},{"id":"INC-05683","date":"2021-04-13","year":2021,"title":"Google's FLoC AI Ad Targeting Sparks Privacy Backlash and Blocking by Browsers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-13-092d"},{"id":"INC-05833","date":"2021-04-13","year":2021,"title":"Rotterdam Welfare Fraud Algorithm Risks Discrimination and Bias","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-13-5001"},{"id":"INC-05380","date":"2021-04-14","year":2021,"title":"AI Customer Service Bots Deliberately Obstruct Access to Human Support","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-14-20e7"},{"id":"INC-05505","date":"2021-04-14","year":2021,"title":"Bias and Privacy Risks in AI Emotion Recognition Technology","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-14-65a5"},{"id":"INC-05780","date":"2021-04-14","year":2021,"title":"Neuralink Plans Human Trials of AI Brain Chip in 2021","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-14-b425"},{"id":"INC-05657","date":"2021-04-15","year":2021,"title":"Global Child Advocacy Groups Oppose Facebook's AI-Driven Instagram for Kids","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-15-0f1d"},{"id":"INC-05874","date":"2021-04-15","year":2021,"title":"Taipei Deploys AI Traffic Signals to Reduce Pedestrian Red-Light Violations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-15-5ee9"},{"id":"INC-05708","date":"2021-04-15","year":2021,"title":"Instagram AI Search Algorithm Promotes Harmful Diet Content to Vulnerable Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-15-b4b5"},{"id":"INC-05500","date":"2021-04-15","year":2021,"title":"Bavarian Police Use AI Facial Recognition to Identify Hundreds of Suspects","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-15-dd1f"},{"id":"INC-05545","date":"2021-04-16","year":2021,"title":"Civil Rights Groups Challenge Harmful Use of Clearview AI Facial Recognition by US Agencies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-16-3767"},{"id":"INC-05769","date":"2021-04-16","year":2021,"title":"Mobileye Plans Launch of Autonomous Robotaxi Service in Germany Pending Legal Approval","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-16-a210"},{"id":"INC-05727","date":"2021-04-16","year":2021,"title":"Italian Privacy Authority Blocks Police Facial Recognition System Over Mass Surveillance Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-16-f537"},{"id":"INC-05613","date":"2021-04-18","year":2021,"title":"Facebook Encryption Plans Threaten AI Child Abuse Detection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-18-33de"},{"id":"INC-06106","date":"2021-04-18","year":2021,"title":"TikTok AI Algorithm Failure Exposes Users to Pornography and Violent Extremist Content","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-18-54d5"},{"id":"INC-06172","date":"2021-04-18","year":2021,"title":"US Sanctions on Chinese AI Chip Customers Cause Major Losses for Taiwanese Semiconductor Firms","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-18-d27a"},{"id":"INC-05526","date":"2021-04-18","year":2021,"title":"China Unveils AI-Enabled Feilong-2 Autonomous Stealth Bomber Prototype","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-18-e4ed"},{"id":"INC-06156","date":"2021-04-19","year":2021,"title":"US Banks Trial AI Surveillance Systems, Raising Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-19-2a69"},{"id":"INC-05391","date":"2021-04-19","year":2021,"title":"AI System at Chang Gung Memorial Hospital Reduces Pelvic Fracture Misdiagnosis and Prevents Fatal Bleeding","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-19-a3d1"},{"id":"INC-05625","date":"2021-04-20","year":2021,"title":"Facebook's AI Moderation Fails to Curb Misinformation in Europe","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-20-3f7a"},{"id":"INC-05428","date":"2021-04-21","year":2021,"title":"AI-Generated Deepfake Satellite Images Raise Misinformation Risks","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-2986"},{"id":"INC-06078","date":"2021-04-21","year":2021,"title":"Tesla Autopilot Malfunction Implicated in Fatal Crash, Data Transparency Dispute Follows","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-2c80"},{"id":"INC-05436","date":"2021-04-21","year":2021,"title":"AI-Powered Loitering Munitions and Military Drones Cause and Pose Harm in Modern Warfare","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-87a3"},{"id":"INC-06114","date":"2021-04-21","year":2021,"title":"TikTok Sued for Illegal Collection of Children's Data Using AI Systems","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-8cde"},{"id":"INC-05641","date":"2021-04-21","year":2021,"title":"Facial Recognition AI Misuse Leads to Privacy Violations and Discrimination Concerns in China and US Banks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-9b3a"},{"id":"INC-05421","date":"2021-04-21","year":2021,"title":"AI-Enabled Drones Used in Repeated Attacks on Saudi Military Base","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-e2e3"},{"id":"INC-05714","date":"2021-04-21","year":2021,"title":"Insurers Warn of AI Risks in UK Driverless Car Rollout","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-21-fc12"},{"id":"INC-05411","date":"2021-04-22","year":2021,"title":"AI-Enabled Armed Drone and Munition Systems Complete Successful Tests in Turkey","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-22-3336"},{"id":"INC-05589","date":"2021-04-22","year":2021,"title":"European Politicians Deceived by Deepfake Impersonating Navalny's Chief of Staff","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-22-69d6"},{"id":"INC-06073","date":"2021-04-22","year":2021,"title":"Tesla Autopilot and Braking System Failures Spark Fatalities and Regulatory Scrutiny","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-22-eeb0"},{"id":"INC-06122","date":"2021-04-23","year":2021,"title":"Tinder and Match Group Plan AI System to Flag Sexual Predators and Report Assaults to Police","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-23-50c1"},{"id":"INC-00128","date":"2021-04-23","year":2021,"title":"Google's FLoC AI Ad Tracking Raises Privacy and Discrimination Concerns, Prompting Industry Pushback","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-23-75f1"},{"id":"INC-06171","date":"2021-04-23","year":2021,"title":"US Regulators Alarmed by Tesla Autopilot Safety Vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-23-88a6"},{"id":"INC-05535","date":"2021-04-24","year":2021,"title":"Chinese AI Surveillance System Used in Canadian Restaurant Raises Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-24-4b9d"},{"id":"INC-05414","date":"2021-04-24","year":2021,"title":"AI-Enabled Autonomous Weapons and Combat Systems Cause and Pose Military Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-24-4ce2"},{"id":"INC-05419","date":"2021-04-25","year":2021,"title":"AI-Enabled Drones Raise Global Security and Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-25-1ad0"},{"id":"INC-05651","date":"2021-04-25","year":2021,"title":"France Plans Expanded Use of AI Algorithms for Counterterrorism Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-25-4dca"},{"id":"INC-05716","date":"2021-04-25","year":2021,"title":"Iran Unveils AI-Enabled Swarming Suicide Drones for Military Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-25-c261"},{"id":"INC-05409","date":"2021-04-25","year":2021,"title":"AI-Enabled Aksungur Armed Drone Successfully Tests Long-Range Munition","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-25-cafa"},{"id":"INC-05828","date":"2021-04-26","year":2021,"title":"Ride-Hailing Platforms Use AI Algorithms for Discriminatory Pricing and Overcharging in China","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-26-a8c7"},{"id":"INC-05540","date":"2021-04-27","year":2021,"title":"Chinese National Pleads Guilty to Smuggling AI-Enabled Underwater Tech to Chinese Military","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-27-09c0"},{"id":"INC-05842","date":"2021-04-27","year":2021,"title":"Saudi Arabia Intercepts AI-Controlled Explosive Boat in Red Sea","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-27-e33b"},{"id":"INC-06139","date":"2021-04-27","year":2021,"title":"UK Government Approves AI-Driven Self-Driving Cars with ALKS Technology Amid Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-27-e9a0"},{"id":"INC-05398","date":"2021-04-28","year":2021,"title":"AI Voice Profiling Raises Privacy and Discrimination Risks in Marketing","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-04-28-14b8"},{"id":"INC-05435","date":"2021-04-28","year":2021,"title":"AI-Powered ECG Systems Enhance Emergency Cardiac Care in Taiwan","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-28-57bd"},{"id":"INC-05467","date":"2021-04-29","year":2021,"title":"Amazon's AI Algorithms Promote Extremist and Conspiratorial Content, Report Finds","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-29-a384"},{"id":"INC-05841","date":"2021-04-30","year":2021,"title":"San Diego and Chinese Real Estate Developers Face Scrutiny Over Harmful Facial Recognition Practices","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-04-30-64c4"},{"id":"INC-14674","date":"2021-05-01","year":2021,"title":"Surge in Deepfake AI Crimes Causes Harm and Prompts Arrests","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-01-5fdf"},{"id":"INC-14675","date":"2021-05-01","year":2021,"title":"Smart TV Data Collection Scandal Exposes Massive Privacy Breach in China","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-01-60f7"},{"id":"INC-05405","date":"2021-05-02","year":2021,"title":"AI-Driven Sex Robots and Virtual Companions Raise Exploitation and Social Risks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-02-3e07"},{"id":"INC-05497","date":"2021-05-02","year":2021,"title":"Baidu Launches Fully Driverless Robotaxi Service in Beijing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-02-8d37"},{"id":"INC-05752","date":"2021-05-02","year":2021,"title":"Mayflower 400: AI-Powered Autonomous Boat Crosses the Atlantic Without Human Captain","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-02-e80b"},{"id":"INC-05377","date":"2021-05-03","year":2021,"title":"AI Algorithms Accused of Manipulating News and Suppressing Independent Media Voices","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-03-cd9b"},{"id":"INC-05520","date":"2021-05-04","year":2021,"title":"Chile Proposes Legal Protections Against AI-Driven Neurotechnology Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-04-3b94"},{"id":"INC-05558","date":"2021-05-04","year":2021,"title":"Court Rules Snapchat Can Be Sued Over Speed Filter Linked to Fatal Crash","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-04-5113"},{"id":"INC-05474","date":"2021-05-04","year":2021,"title":"Amnesty International Calls for Ban on Police Facial Recognition in Austria","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-05-04-87da"},{"id":"INC-06154","date":"2021-05-04","year":2021,"title":"US Army Plans Large-Scale Deployment of AI-Enabled HoloLens Headsets","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-04-d769"},{"id":"INC-06162","date":"2021-05-05","year":2021,"title":"US General Warns of AI and Robotics Increasing Global Instability","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-05-3349"},{"id":"INC-05582","date":"2021-05-05","year":2021,"title":"Dutch Forensic Institute Uses AI to Detect and Prevent Violent Crime via Encrypted Chats","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-05-7af6"},{"id":"INC-05563","date":"2021-05-05","year":2021,"title":"Deepfake AI Technologies Raise Concerns Over Bias and Emerging Threats","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-05-8ecb"},{"id":"INC-06151","date":"2021-05-05","year":2021,"title":"US Air Force Tests AI-Driven Skyborg Autonomy Core System in Unmanned Aircraft","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-05-ba7c"},{"id":"INC-05593","date":"2021-05-06","year":2021,"title":"Experts Warn of AI Risks in Viral '20s Challenge' Social Media Trend","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-06-b6a0"},{"id":"INC-06135","date":"2021-05-07","year":2021,"title":"Turkish Official Warns of AI Risks in '20s Challenge' Social Media Trend","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-07-afaf"},{"id":"INC-05415","date":"2021-05-08","year":2021,"title":"AI-Enabled Bayraktar TB2 Drones Delivered to Turkish Security Forces","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-08-ee2e"},{"id":"INC-06071","date":"2021-05-09","year":2021,"title":"Tesla AI System Failures and Data Transparency Spark Safety Concerns in China","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-09-0850"},{"id":"INC-05378","date":"2021-05-09","year":2021,"title":"AI Bias Leads to Racial Discrimination and Wrongful Arrests in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-05-09-e890"},{"id":"INC-05490","date":"2021-05-10","year":2021,"title":"Attorneys General Warn Facebook Over AI Risks in Instagram for Kids","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-10-6a63"},{"id":"INC-05578","date":"2021-05-10","year":2021,"title":"DHS Implements AI-Driven Social Media Monitoring for Security Threats","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-10-fccb"},{"id":"INC-05483","date":"2021-05-11","year":2021,"title":"Apple AirTags Misused for Stalking and Privacy Violations After Jailbreak","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-11-26f5"},{"id":"INC-06098","date":"2021-05-11","year":2021,"title":"Tesla Owner Arrested for Repeatedly Misusing Autopilot by Riding in Back Seat","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-11-507c"},{"id":"INC-06115","date":"2021-05-11","year":2021,"title":"TikTok Sued for Unauthorized Use of Actress's Voice in AI Text-to-Speech Feature","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-11-514c"},{"id":"INC-06155","date":"2021-05-11","year":2021,"title":"US Authorities Investigate Fatal Tesla Crash Involving Possible AI System Failure","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-11-b3c0"},{"id":"INC-06180","date":"2021-05-11","year":2021,"title":"Waymo and Cruise Apply for Permits to Launch Paid Autonomous Rides in San Francisco","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-11-ce2e"},{"id":"INC-05772","date":"2021-05-12","year":2021,"title":"Multiple Incidents Highlight Risks and Failures in Autonomous Vehicle AI Systems","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-12-0cc1"},{"id":"INC-05709","date":"2021-05-12","year":2021,"title":"Instagram AI Wrongly Flags Al-Aqsa Mosque Posts as Terrorism","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-12-9057"},{"id":"INC-06176","date":"2021-05-12","year":2021,"title":"Volkswagen Plans Deployment of Autonomous Robo-Taxis in Germany by 2025","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-12-a071"},{"id":"INC-05642","date":"2021-05-12","year":2021,"title":"Facial Recognition AI Systems in China Lead to Privacy Violations and Regulatory Action","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-12-b17f"},{"id":"INC-06177","date":"2021-05-12","year":2021,"title":"Volkswagen to Begin Level 4 Autonomous Vehicle Testing in Munich","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-12-c2f5"},{"id":"INC-05781","date":"2021-05-14","year":2021,"title":"NFL's Race-Normed Algorithm Discriminates Against Black Players in Brain Injury Settlement","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-05-14-7e54"},{"id":"INC-06080","date":"2021-05-14","year":2021,"title":"Tesla Autopilot Misuse and Overstated Capabilities Lead to Fatalities and Public Concern","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-14-c742"},{"id":"INC-05643","date":"2021-05-14","year":2021,"title":"Facial Recognition AI Triggers Legal Action and Human Rights Concerns Globally","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-05-14-f9d2"},{"id":"INC-05647","date":"2021-05-15","year":2021,"title":"Fatal Tesla Crash Linked to Possible Autopilot Misuse in California","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-15-1593"},{"id":"INC-05463","date":"2021-05-16","year":2021,"title":"Amazon Ring Enables Widespread Warrantless Police Surveillance via AI-Driven Home Cameras","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-16-cafa"},{"id":"INC-05854","date":"2021-05-16","year":2021,"title":"Social Media Photo Challenges Fuel AI Facial Recognition and Deepfake Risks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-16-f8c4"},{"id":"INC-05705","date":"2021-05-17","year":2021,"title":"Indonesian Authorities Flag AI-Powered Trading App as Illegal, Urge Clearer Regulation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-17-4b09"},{"id":"INC-06076","date":"2021-05-17","year":2021,"title":"Tesla Autopilot Fails to Prevent Crash with Parked Police Car in Washington","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-17-6290"},{"id":"INC-05646","date":"2021-05-17","year":2021,"title":"Fatal Tesla Autopilot Crashes in California and China Raise Safety Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-17-e2ca"},{"id":"INC-14676","date":"2021-05-17","year":2021,"title":"Japan Plans AI-Enabled Unmanned Combat Aircraft by 2035 Amid Demographic Challenges","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-17-f141"},{"id":"INC-05626","date":"2021-05-17","year":2021,"title":"Facebook's AI Moderation Fails to Stop COVID-19 Misinformation Spread","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-17-f582"},{"id":"INC-05521","date":"2021-05-18","year":2021,"title":"China Bans Tesla Cars from Government Compounds over AI Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-18-6935"},{"id":"INC-05797","date":"2021-05-18","year":2021,"title":"Pentagon Plans AI-Driven Social Media Surveillance of Military Personnel","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-18-d80e"},{"id":"INC-06081","date":"2021-05-18","year":2021,"title":"Tesla Autopilot Misuse: Driver Sleeps at 82 MPH, Stopped by Police","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-18-fc18"},{"id":"INC-05800","date":"2021-05-19","year":2021,"title":"Poland Purchases AI-Enabled Armed Drones from Turkey","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-19-2bee"},{"id":"INC-06173","date":"2021-05-19","year":2021,"title":"USPS and Clearview AI Involved in Covert Surveillance of Americans Using Facial Recognition Technology","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-19-2d1a"},{"id":"INC-14677","date":"2021-05-21","year":2021,"title":"Chinese Regulators Expose 105 Apps, Including Douyin and Baidu, for Illegal Personal Data Collection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-4881"},{"id":"INC-05686","date":"2021-05-21","year":2021,"title":"GPT-3 Used to Generate Persuasive Disinformation on Social Media","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-4b8b"},{"id":"INC-06137","date":"2021-05-21","year":2021,"title":"UK Develops AI-Controlled Unmanned Submarine, Raising Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-4f2c"},{"id":"INC-05803","date":"2021-05-21","year":2021,"title":"Pony.ai Receives Permit to Test Fully Driverless Cars in California","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-64ea"},{"id":"INC-05425","date":"2021-05-21","year":2021,"title":"AI-Enabled Saudi Combat Drone Shot Down in Yemen Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-ab5c"},{"id":"INC-05834","date":"2021-05-21","year":2021,"title":"Russia Announces Serial Production of AI-Powered Combat Robots","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-21-efdb"},{"id":"INC-05655","date":"2021-05-22","year":2021,"title":"Germany Legalizes Level 4 Driverless Vehicles, Raising AI Safety and Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-22-2f56"},{"id":"INC-05395","date":"2021-05-22","year":2021,"title":"AI Telemarketing Robots Cause Widespread Harassment and Privacy Violations in China","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-22-65e9"},{"id":"INC-05837","date":"2021-05-22","year":2021,"title":"Russia Deploys and Mass-Produces AI-Enabled Combat Robots","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-22-9387"},{"id":"INC-05402","date":"2021-05-22","year":2021,"title":"AI-Driven Pre-Crime Surveillance Program Raises Civil Rights Concerns in US","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-22-e409"},{"id":"INC-06132","date":"2021-05-23","year":2021,"title":"Turkey Prepares to Deploy AI-Enabled Armed Robotic Vehicles for Military Use","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-23-6ee9"},{"id":"INC-05664","date":"2021-05-23","year":2021,"title":"Google AI Search Links Palestinian Keffiyeh to Terrorism, Sparking Outrage","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-23-7c1f"},{"id":"INC-06097","date":"2021-05-24","year":2021,"title":"Tesla Ordered to Pay Damages After AI Software Update Reduces Battery Performance","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-24-cd4d"},{"id":"INC-05799","date":"2021-05-24","year":2021,"title":"Plzeň Plans to Test Fully Autonomous AI-Driven Tram by 2027","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-24-f3b9"},{"id":"INC-05525","date":"2021-05-25","year":2021,"title":"China Tests AI Emotion-Detection on Uyghur Detainees in Xinjiang","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-25-2d74"},{"id":"INC-05393","date":"2021-05-25","year":2021,"title":"AI System Deployed in Germany to Detect Child Abuse Material and Aid Investigations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-25-610b"},{"id":"INC-05627","date":"2021-05-25","year":2021,"title":"Facebook's AI Moderation System Censors Vaccine Hesitancy Content Globally","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-25-d984"},{"id":"INC-05756","date":"2021-05-26","year":2021,"title":"Merlin Labs and Google Back Fully Autonomous Aircraft Fleet, Raising Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-26-799c"},{"id":"INC-05685","date":"2021-05-26","year":2021,"title":"Google-HCA Healthcare AI Partnership Raises Patient Data Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-26-bacc"},{"id":"INC-05611","date":"2021-05-27","year":2021,"title":"Facebook Employees Accuse AI Systems of Bias Against Palestinian and Arab Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-27-5b1d"},{"id":"INC-05766","date":"2021-05-27","year":2021,"title":"Microsoft President Warns of AI-Driven Mass Surveillance Risks","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-27-65b2"},{"id":"INC-14678","date":"2021-05-27","year":2021,"title":"Human Rights Groups Warn Google-Aramco Cloud Deal Could Enable Saudi Surveillance","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-27-844f"},{"id":"INC-05675","date":"2021-05-27","year":2021,"title":"Google Sued for AI-Driven Location Tracking Despite User Opt-Outs","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-27-d770"},{"id":"INC-05793","date":"2021-05-27","year":2021,"title":"Pakistan Raises Alarm Over India's AI-Driven Military Advancements","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-27-e89e"},{"id":"INC-05564","date":"2021-05-28","year":2021,"title":"Deepfake AI Videos Cause Real-World Harm to Politicians and Democracy","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-28-4767"},{"id":"INC-05654","date":"2021-05-28","year":2021,"title":"German Police AI Tool 'VeRA' Sparks Major Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-28-7b74"},{"id":"INC-05805","date":"2021-05-28","year":2021,"title":"Portuguese University Ordered to Suspend AI Exam Surveillance Software Over Data Protection Violations","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-28-d816"},{"id":"INC-05711","date":"2021-05-30","year":2021,"title":"Instagram Alters Algorithm After Suppression of Pro-Palestinian Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-30-1ead"},{"id":"INC-05755","date":"2021-05-30","year":2021,"title":"Mercedes Recalls Over 340,000 Cars in US Due to AI-Driven Camera Malfunction","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-30-6aa6"},{"id":"INC-05440","date":"2021-05-31","year":2021,"title":"AI-Powered Surveillance at Greek-Turkish Border Raises Human Rights Concerns for Migrants","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-31-c59f"},{"id":"INC-05412","date":"2021-05-31","year":2021,"title":"AI-Enabled Armed Drones Used in Lethal Operation in Northern Iraq","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-31-e19f"},{"id":"INC-05388","date":"2021-05-31","year":2021,"title":"AI Medical Diagnostic Tools Found to Rely on Shortcuts, Risking COVID-19 Misdiagnosis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-05-31-e40c"},{"id":"INC-05454","date":"2021-06-01","year":2021,"title":"Amazon Faces Legal Action Over Alexa's Unauthorized Voice Recordings","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-01-10d4"},{"id":"INC-05829","date":"2021-06-01","year":2021,"title":"Rights Groups Condemn AI-Driven Digital Surveillance of Immigrants by ICE","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-01-304e"},{"id":"INC-05452","date":"2021-06-01","year":2021,"title":"Amazon Alters AI Productivity Monitoring After Worker Injuries Linked to Algorithmic Pressure","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-01-5c8c"},{"id":"INC-06158","date":"2021-06-01","year":2021,"title":"US Commerce Department Criticized for Failing to Control AI Tech Exports to China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-01-a5bb"},{"id":"INC-05584","date":"2021-06-02","year":2021,"title":"Dutch Parents Sue TikTok Over AI-Driven Harm to Children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-02-22d8"},{"id":"INC-05401","date":"2021-06-02","year":2021,"title":"AI-Driven Bot Networks Manipulate Twitter Trends, Spreading Disinformation and Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-02-231f"},{"id":"INC-06159","date":"2021-06-03","year":2021,"title":"US Congress Probes Spotify's AI-Driven Discovery Mode Over Artist Royalties","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-0c54"},{"id":"INC-05476","date":"2021-06-03","year":2021,"title":"Amnesty International Exposes NYPD's Pervasive AI-Powered Surveillance Network in NYC","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-25e1"},{"id":"INC-06117","date":"2021-06-03","year":2021,"title":"TikTok Updates US Privacy Policy to Allow Biometric Data Collection via AI","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-26bd"},{"id":"INC-05430","date":"2021-06-03","year":2021,"title":"AI-Generated Fake Female Profiles Used in Hotel Social App Scam Busted by Shanghai Police","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-8855"},{"id":"INC-06196","date":"2021-06-03","year":2021,"title":"YouTube AI Recommendations Linked to Increased COVID-19 Vaccine Hesitancy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-a598"},{"id":"INC-05389","date":"2021-06-03","year":2021,"title":"AI Recruitment Systems Cause Bias and Unfair Job Rejections","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-b058"},{"id":"INC-05592","date":"2021-06-03","year":2021,"title":"Experts Warn AI Sex Robots Could Be Hacked to Cause Physical Harm or Death","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-03-d0cd"},{"id":"INC-05417","date":"2021-06-04","year":2021,"title":"AI-Enabled Combat Drones Used in Attacks on US Forces in Iraq","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-04-0d60"},{"id":"INC-05518","date":"2021-06-04","year":2021,"title":"CBP One App Raises Privacy Concerns for Asylum Seekers at US Border","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-04-4621"},{"id":"INC-05407","date":"2021-06-04","year":2021,"title":"AI-Driven Warfare in Gaza: Israeli Military's First 'Artificial Intelligence War' Causes Civilian Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-04-4b09"},{"id":"INC-06134","date":"2021-06-06","year":2021,"title":"Turkish AI-Enabled Drone Strike Kills Three at Iraqi Kurdish Refugee Camp","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-06-6486"},{"id":"INC-05847","date":"2021-06-06","year":2021,"title":"Shanghai's AI-Powered Mass Surveillance System Raises Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-06-f2b0"},{"id":"INC-05658","date":"2021-06-07","year":2021,"title":"Global Coalition Demands Ban on Harmful Biometric Surveillance AI","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-07-23d1"},{"id":"INC-05403","date":"2021-06-07","year":2021,"title":"AI-Driven Price Discrimination Against Loyal Customers in China Spurs Regulatory Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-07-8f9e"},{"id":"INC-06116","date":"2021-06-07","year":2021,"title":"TikTok Updates Privacy Policy to Collect Biometric Data Using AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-07-d05c"},{"id":"INC-05806","date":"2021-06-08","year":2021,"title":"Privacy Risks of Voilá AI Artist App's Use of Facial Images","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-08-160b"},{"id":"INC-14679","date":"2021-06-08","year":2021,"title":"\"Facebook Is Executing Us\": Campaign Protests AI-Driven Censorship of Arabic Content","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-08-6e0b"},{"id":"INC-05668","date":"2021-06-08","year":2021,"title":"Google Fires AI Ethics Researcher After Warning of Discrimination Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-08-b70a"},{"id":"INC-05432","date":"2021-06-08","year":2021,"title":"AI-Powered Arms Race Raises Global Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-08-e260"},{"id":"INC-05577","date":"2021-06-09","year":2021,"title":"Deployment of Chinese AI Facial Recognition Surveillance in Siófok Raises Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-09-75b5"},{"id":"INC-06108","date":"2021-06-09","year":2021,"title":"TikTok AI Moderation Fails to Block Graphic Beheading Video","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-09-768b"},{"id":"INC-05791","date":"2021-06-09","year":2021,"title":"Oxford AI Tool Predicts COVID-19 Mortality Risk from Medical Imaging","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-09-982e"},{"id":"INC-06119","date":"2021-06-10","year":2021,"title":"TikTok Users Distressed by Unremovable AI Beauty Filter Altering Faces Without Consent","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-10-5a3d"},{"id":"INC-05386","date":"2021-06-10","year":2021,"title":"AI Infrastructure Exploited for Cryptomining via Kubeflow and TensorFlow","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-10-8c2a"},{"id":"INC-05818","date":"2021-06-10","year":2021,"title":"RCMP's Use of Clearview AI Facial Recognition Violated Canadian Privacy Law","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-10-c166"},{"id":"INC-05666","date":"2021-06-10","year":2021,"title":"Google Alters Search Algorithm to Combat Defamation and Extortion Sites","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-10-dfd8"},{"id":"INC-06121","date":"2021-06-11","year":2021,"title":"TikTok's AI Moderation and Data Practices Lead to Censorship and Privacy Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-11-4530"},{"id":"INC-05698","date":"2021-06-11","year":2021,"title":"iFlytek AI Input Method App Removed for Privacy Violations, Causing Stock Crash","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-11-9e60"},{"id":"INC-06164","date":"2021-06-13","year":2021,"title":"US Lawmakers Urge Export Controls on AI and Emerging Tech to Prevent Chinese Misuse","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-13-0fb3"},{"id":"INC-06146","date":"2021-06-15","year":2021,"title":"Ukraine Unveils AI-Controlled Stealth Combat Drone ACE ONE","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-15-0968"},{"id":"INC-05707","date":"2021-06-15","year":2021,"title":"Instagram AI Filters Criticized for Racial Bias Against Black Users","severity":"Medium","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-15-3f6d"},{"id":"INC-05531","date":"2021-06-15","year":2021,"title":"Chinese AI Fighter Pilots Routinely Defeat Human Pilots in Simulated Dogfights","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-15-46a3"},{"id":"INC-05639","date":"2021-06-16","year":2021,"title":"Facial Recognition AI Blocks Unemployment Benefits for Eligible Applicants","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-16-ce37"},{"id":"INC-05704","date":"2021-06-16","year":2021,"title":"Indian IT Sector to Cut 3 Million Jobs Due to AI Automation by 2022: BOA Report","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-16-f58f"},{"id":"INC-05517","date":"2021-06-17","year":2021,"title":"Canon's AI Smile Recognition System Forces Employees to Smile for Workplace Access","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-0355"},{"id":"INC-05478","date":"2021-06-17","year":2021,"title":"Anduril Raises $450M to Develop AI-Powered Autonomous Military Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-1029"},{"id":"INC-05410","date":"2021-06-17","year":2021,"title":"AI-Enabled Alpagu Drone Successfully Conducts Autonomous Lethal Test Strike in Turkey","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-3aee"},{"id":"INC-06141","date":"2021-06-17","year":2021,"title":"UK Regulator Warns of Privacy Risks from Live Facial Recognition in Public Spaces","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-c0c6"},{"id":"INC-05852","date":"2021-06-17","year":2021,"title":"Snapchat Removes Speed Filter After AI-Driven Feature Linked to Fatal Crashes","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-c477"},{"id":"INC-06170","date":"2021-06-17","year":2021,"title":"US Probes Tesla Autopilot After Fatal Crashes Linked to AI System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-17-ffdf"},{"id":"INC-05431","date":"2021-06-18","year":2021,"title":"AI-Piloted Mayflower Autonomous Ship Forced to Abort Voyage Due to Malfunction","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-18-2d0b"},{"id":"INC-05459","date":"2021-06-18","year":2021,"title":"Amazon Japan's AI Fails to Block Defamatory and Obscene Listings","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-18-62e2"},{"id":"INC-05728","date":"2021-06-19","year":2021,"title":"Japan Deploys AI for Crime Visualization Amid Privacy Concerns; AI Models Prevent Financial Fraud in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-19-5dc0"},{"id":"INC-05742","date":"2021-06-19","year":2021,"title":"Legislators and Scientists Warn of Potential AI Robot Hazards","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-19-7505"},{"id":"INC-05441","date":"2021-06-19","year":2021,"title":"AI-Powered Surveillance Cameras Violate Privacy During COVID-19 Response","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-19-f259"},{"id":"INC-05532","date":"2021-06-20","year":2021,"title":"Chinese AI Input Method Apps Removed for Illegal Data Collection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-20-3510"},{"id":"INC-05726","date":"2021-06-20","year":2021,"title":"Italian Labor Minister Calls for Regulation of AI Scheduling Algorithms After Unionist's Death","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-20-6307"},{"id":"INC-05715","date":"2021-06-21","year":2021,"title":"Inter-Homines AI System Deployed to Prevent COVID-19 Crowding Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-21-1b24"},{"id":"INC-05482","date":"2021-06-21","year":2021,"title":"Apple AirTag Misused for Stalking Spurs Security Updates and Android App","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-21-2b9f"},{"id":"INC-05510","date":"2021-06-21","year":2021,"title":"ByteDance Intern Accidentally Deletes Key Machine Learning Models, Disrupting Operations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-21-bab8"},{"id":"INC-05546","date":"2021-06-21","year":2021,"title":"Civil Rights Groups Demand Ban on Amazon's AI Worker Surveillance Amid Injury Crisis","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-21-e865"},{"id":"INC-05400","date":"2021-06-21","year":2021,"title":"AI-Based GeNose COVID-19 Test Criticized for Inaccuracy and Public Health Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-21-ff98"},{"id":"INC-05458","date":"2021-06-22","year":2021,"title":"Amazon Invests in AI-Powered Autonomous Trucks for Logistics","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-22-e64f"},{"id":"INC-05516","date":"2021-06-23","year":2021,"title":"Canadian Liberal Party's Use of AI Facial Recognition in Candidate Selection Raises Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-23-2ac6"},{"id":"INC-14680","date":"2021-06-23","year":2021,"title":"Dutch Groups Sue TikTok for AI-Driven Child Data Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-23-8938"},{"id":"INC-05814","date":"2021-06-24","year":2021,"title":"Randstad Predicts Over Half of Spanish Jobs at Risk of Automation by 2030","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-24-6d6c"},{"id":"INC-05665","date":"2021-06-25","year":2021,"title":"Google Algorithm Wrongly Labels Engineer as Serial Killer","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-25-5595"},{"id":"INC-05494","date":"2021-06-25","year":2021,"title":"Autopilot Software Flaw Causes Fatal Canadian Military Helicopter Crash","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-25-dc0f"},{"id":"INC-06101","date":"2021-06-26","year":2021,"title":"Tesla Recalls 285,000 Cars in China Over AI Driving Software Malfunction Leading to Collisions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-26-da21"},{"id":"INC-06128","date":"2021-06-27","year":2021,"title":"Turkey Advances Armed Autonomous Ground Vehicle Development, Raising AI Risk Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-27-7a12"},{"id":"INC-05700","date":"2021-06-28","year":2021,"title":"India Develops AI-Powered Autonomous Drone Defense Dome 'Indrajaal'","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-28-0302"},{"id":"INC-06189","date":"2021-06-29","year":2021,"title":"Worldcoin's AI-Powered Iris Scanning for Cryptocurrency Raises Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-29-3a51"},{"id":"INC-05470","date":"2021-06-29","year":2021,"title":"Amazon's Echo Dot Kids Raises Privacy Concerns Over Children's Data","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-29-3b48"},{"id":"INC-06161","date":"2021-06-29","year":2021,"title":"US Federal Agencies' Unregulated Use of Facial Recognition AI Leads to Civil Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2021-06-29-3cf4"},{"id":"INC-06183","date":"2021-06-29","year":2021,"title":"Weaponized Drones Used in Terror Attack on Indian Military Base Raises Global AI Security Concerns","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-29-73f4"},{"id":"INC-05722","date":"2021-06-30","year":2021,"title":"Israel Unveils AI-Enabled Autonomous Sea Breaker Missile System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-06-30-f876"},{"id":"INC-05379","date":"2021-07-01","year":2021,"title":"AI Cameras Reduce Mask Non-Compliance on Passenger Vehicles in Vietnam","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-07-01-28eb"},{"id":"INC-05667","date":"2021-07-01","year":2021,"title":"Google Assistant's Unintended Recordings Spark Global Privacy Lawsuits","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2021-07-01-5bb1"},{"id":"INC-14681","date":"2025-11-14","year":2025,"title":"AI-Generated Fake Product Images Used for Fraudulent Refunds in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2025-11-14-7dd0"},{"id":"INC-02896","date":"2025-11-20","year":2025,"title":"Microsoft Copilot AI in Windows 11 Faces Glitches and Privacy Issues","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2025-11-20-618b"},{"id":"INC-00520","date":"2026-01-19","year":2026,"title":"AI-Generated VoidLink Malware Marks New Era in Cyber Threats","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-19-90c0"},{"id":"INC-14682","date":"2026-01-21","year":2026,"title":"Eightfold AI Sued for Secretly Profiling Job Applicants with AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-01-21-eb71"},{"id":"INC-14683","date":"2026-01-23","year":2026,"title":"KakaoBank Uses AI to Prevent Voice Phishing and Protect Customer Assets","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-0e37"},{"id":"INC-00342","date":"2026-01-23","year":2026,"title":"AI-Enabled Drones Transform Modern Warfare and Border Security","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-117b"},{"id":"INC-00106","date":"2026-01-23","year":2026,"title":"AI Chatbots Fail to Detect AI-Generated Videos, Enabling Misinformation Spread","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-3766"},{"id":"INC-00764","date":"2026-01-23","year":2026,"title":"China Demonstrates AI-Controlled Drone Swarm Warfare","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-3cbd"},{"id":"INC-01144","date":"2026-01-23","year":2026,"title":"Grok AI Generated Millions of Non-Consensual Sexualized Images, Including Minors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-49ec"},{"id":"INC-14684","date":"2026-01-23","year":2026,"title":"AI-Generated Deepfake Images Spark False Celebrity Relationship Rumors","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-52a8"},{"id":"INC-14685","date":"2026-01-23","year":2026,"title":"EU Investigates Grok AI Chatbot Over Generation of Sexual Deepfake Images Involving Minors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-69eb"},{"id":"INC-01742","date":"2026-01-23","year":2026,"title":"Romanian Authorities Warn of Viral AI-Generated Fake Video Depicting False Conflict","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-6cb4"},{"id":"INC-00664","date":"2026-01-23","year":2026,"title":"Autonomous Combat Drone Competition at TEKNOFEST Highlights AI Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-74a7"},{"id":"INC-00411","date":"2026-01-23","year":2026,"title":"AI-Generated Deepfake Wedding Video Sparks False Rumors About Indian Actors","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-84d4"},{"id":"INC-00236","date":"2026-01-23","year":2026,"title":"AI Tool Grok Used to Generate and Disseminate Sexualized Images of UK Professor Without Consent","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-a154"},{"id":"INC-00212","date":"2026-01-23","year":2026,"title":"AI Swarms Undermine Democratic Discourse Through Coordinated Disinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-baeb"},{"id":"INC-00581","date":"2026-01-23","year":2026,"title":"Ambulance Collides with AI Food Delivery Robot in Hollywood, Disrupting Emergency Services","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-c563"},{"id":"INC-00973","date":"2026-01-23","year":2026,"title":"Experimental Deployment of AI-Driven Autonomous Taxis Planned in Budapest","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-d486"},{"id":"INC-00431","date":"2026-01-23","year":2026,"title":"AI-Generated Disinformation Targets Deepal S07, Company Vows Legal Action","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-e4fe"},{"id":"INC-01147","date":"2026-01-23","year":2026,"title":"Grok AI Generates Millions of Harmful Deepfake Images, Triggers International Bans","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-e5c4"},{"id":"INC-01146","date":"2026-01-23","year":2026,"title":"Grok AI Generates Millions of Harmful Deepfake Images, Triggers Global Outrage and Regulatory Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-eb35"},{"id":"INC-01541","date":"2026-01-23","year":2026,"title":"North Korean Konni Hackers Use AI-Generated Malware to Target Blockchain Developers in Asia-Pacific","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-23-ebba"},{"id":"INC-01245","date":"2026-01-24","year":2026,"title":"iPhone 11 Face ID Failure Allows Unauthorized Access in Turkey","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-1441"},{"id":"INC-00477","date":"2026-01-24","year":2026,"title":"AI-Generated Images Used in Fraudulent 'Case Fixing' Scheme in Vietnam","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-1ba0"},{"id":"INC-01271","date":"2026-01-24","year":2026,"title":"EU Investigates X's Grok AI for Generating and Spreading Sexual Deepfake Images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-27de"},{"id":"INC-14686","date":"2026-01-24","year":2026,"title":"AI-Generated Romance Scams Target Elderly Women in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-28eb"},{"id":"INC-00419","date":"2026-01-24","year":2026,"title":"AI-Generated Deepfakes Fuel Surge in Child Sexual Abuse Material","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-2e27"},{"id":"INC-00388","date":"2026-01-24","year":2026,"title":"AI-Generated Deepfake Targets Nigerian Political Figure Ahead of 2027 Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-3b7b"},{"id":"INC-00292","date":"2026-01-24","year":2026,"title":"AI-Driven Disinformation Disrupts Political Communication in Bosnia and Herzegovina","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-42ef"},{"id":"INC-01615","date":"2026-01-24","year":2026,"title":"Pakistani Influencer Alina Amir Targeted by AI Deepfake Video","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-5234"},{"id":"INC-00752","date":"2026-01-24","year":2026,"title":"ChatGPT Model Spreads Misinformation by Citing Grokipedia","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-75b4"},{"id":"INC-00217","date":"2026-01-24","year":2026,"title":"AI System Designs and Synthesizes Novel Virus, Raising Biosecurity Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-9489"},{"id":"INC-01937","date":"2026-01-24","year":2026,"title":"UK Advances AI-Enabled 'Loyal Wingman' Drones for Apache Helicopters","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-bae0"},{"id":"INC-14687","date":"2026-01-24","year":2026,"title":"China Uses AI-Generated Deepfake Videos for Political Propaganda Targeting Taiwan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-f30a"},{"id":"INC-00385","date":"2026-01-24","year":2026,"title":"AI-Generated Deepfake Scam Impersonates Belgian Royalty","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-24-fdfa"},{"id":"INC-00679","date":"2026-01-25","year":2026,"title":"AI-Generated Fake Crime Scene Image Causes Public Misinformation in Romania","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-228d"},{"id":"INC-02096","date":"2026-01-25","year":2026,"title":"WinZO Accused of Using AI and Bots to Defraud Players of Rs 734 Crore","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-3892"},{"id":"INC-01902","date":"2026-01-25","year":2026,"title":"TikTok Algorithm Changes After U.S. Takeover Harm Creators' Earnings","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-4968"},{"id":"INC-00640","date":"2026-01-25","year":2026,"title":"Apple Pays $95 Million Settlement Over Siri Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-5655"},{"id":"INC-00767","date":"2026-01-25","year":2026,"title":"China Plans AI-Powered Robots and Data Centers for Space Missions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-57c3"},{"id":"INC-01652","date":"2026-01-25","year":2026,"title":"Poland Bans Chinese and Tesla Vehicles from Military Bases Over AI-Driven Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-5e3f"},{"id":"INC-00765","date":"2026-01-25","year":2026,"title":"China Develops AI-Driven Autonomous Weapons Inspired by Animal Behavior","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-6a48"},{"id":"INC-14688","date":"2026-01-25","year":2026,"title":"Spanish Coach Fired After Overreliance on ChatGPT for Team Decisions","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-7f1e"},{"id":"INC-00771","date":"2026-01-25","year":2026,"title":"China Tests Highly Accurate AI-Enabled Armed Drone","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-9305"},{"id":"INC-00744","date":"2026-01-25","year":2026,"title":"ChatGPT and Claude Spread Misinformation via Grokipedia Integration","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-9ff4"},{"id":"INC-00091","date":"2026-01-25","year":2026,"title":"AI Character 'Amelia' Repurposed to Spread Far-Right Hate Speech in the UK","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-aab0"},{"id":"INC-00408","date":"2026-01-25","year":2026,"title":"AI-Generated Deepfake Videos Used in Scams and Misinformation in Taiwan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-beeb"},{"id":"INC-01099","date":"2026-01-25","year":2026,"title":"Gmail AI Spam Filter Malfunction Disrupts Global Email Management","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-c9f6"},{"id":"INC-00694","date":"2026-01-25","year":2026,"title":"BlackRock CEO Warns AI Could Deepen Economic Inequality","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-25-dbf8"},{"id":"INC-00958","date":"2026-01-26","year":2026,"title":"EU Investigates X's Grok AI for Enabling Harmful Deepfake Creation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-2d1a"},{"id":"INC-00954","date":"2026-01-26","year":2026,"title":"EU Investigates X and Grok AI Over Sexually Explicit Deepfake Images","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-5745"},{"id":"INC-00925","date":"2026-01-26","year":2026,"title":"ECRI Warns of Patient Safety Risks from AI Chatbot Misuse in Healthcare","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-653b"},{"id":"INC-00945","date":"2026-01-26","year":2026,"title":"EU and Brazil Investigate X's Grok AI for Generating Sexualized Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-9c41"},{"id":"INC-00907","date":"2026-01-26","year":2026,"title":"Doomsday Clock Moved Closer to Midnight Amid AI Risk Concerns","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-b908"},{"id":"INC-00959","date":"2026-01-26","year":2026,"title":"EU Investigates X's Grok AI for Generating Explicit and Illegal Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-c6b2"},{"id":"INC-00953","date":"2026-01-26","year":2026,"title":"EU Investigates X and Grok AI Over Sexualized Deepfake Scandal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-d2c9"},{"id":"INC-00058","date":"2026-01-26","year":2026,"title":"AI Adoption Drives Highest Net Job Losses in UK Among Major Economies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-e210"},{"id":"INC-00961","date":"2026-01-26","year":2026,"title":"EU Investigates xAI's Grok for Generating Harmful Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-01-26-feb9"},{"id":"INC-14689","date":"2026-02-17","year":2026,"title":"Tesla Launches Fully Autonomous Cybercab Amid Safety Concerns","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-0768"},{"id":"INC-01374","date":"2026-02-17","year":2026,"title":"Mass Removal of AI-Generated Music Over Copyright Violations","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-0b1a"},{"id":"INC-00585","date":"2026-02-17","year":2026,"title":"Andrew Yang Warns of Imminent Mass Layoffs Due to AI Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-1624"},{"id":"INC-01067","date":"2026-02-17","year":2026,"title":"Generative AI Drives Surge in Cybercrime Effectiveness and Volume","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-2f15"},{"id":"INC-01535","date":"2026-02-17","year":2026,"title":"AI Hiring Tools Lead to Discriminatory Outcomes in US Recruitment","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-2ff0"},{"id":"INC-02112","date":"2026-02-17","year":2026,"title":"ZDF Broadcasts Unlabeled AI-Generated Fake Videos in News Segment","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-441d"},{"id":"INC-01828","date":"2026-02-17","year":2026,"title":"Supreme Court of India Warns Against AI-Generated Petitions with Fake Citations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-5497"},{"id":"INC-01872","date":"2026-02-17","year":2026,"title":"Tesla Robotaxis Involved in 14 Crashes in Austin Within Eight Months","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-597e"},{"id":"INC-00942","date":"2026-02-17","year":2026,"title":"Ergo to Cut 1,000 Jobs in Germany Due to Increased AI Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-6297"},{"id":"INC-00289","date":"2026-02-17","year":2026,"title":"AI-Driven Deepfake Scams Cause Harm in Louisiana and Cambodia","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-81b6"},{"id":"INC-00932","date":"2026-02-17","year":2026,"title":"Elon Musk Proposes Lunar AI Satellite Factory and Electromagnetic Launch System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-82aa"},{"id":"INC-01613","date":"2026-02-17","year":2026,"title":"Oxford Professor Warns of Potential 'Hindenburg-Style' AI Disaster Amid Rapid Commercialization","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-8cf6"},{"id":"INC-01255","date":"2026-02-17","year":2026,"title":"Israeli Firms Deploy AI-Powered Vehicle Surveillance Tools","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-b825"},{"id":"INC-01744","date":"2026-02-17","year":2026,"title":"Romanian Company Unveils AI-Powered Autonomous Cruise Missile","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-bf53"},{"id":"INC-00725","date":"2026-02-17","year":2026,"title":"California Investigates xAI Over Harmful AI-Generated Sexual Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-cd31"},{"id":"INC-00967","date":"2026-02-17","year":2026,"title":"European Nations Investigate AI-Generated Child Sexual Images on Social Media","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-d8a5"},{"id":"INC-01720","date":"2026-02-17","year":2026,"title":"Rapid Development of Venom Autonomous Strike Aircraft Raises AI Risk Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-da7b"},{"id":"INC-00208","date":"2026-02-17","year":2026,"title":"AI Surveillance System Prevents Elephant Deaths on Railway Tracks in Odisha","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-dcc6"},{"id":"INC-00080","date":"2026-02-17","year":2026,"title":"AI Arms Race Raises Existential Risk, Warns Leading Researcher","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-e195"},{"id":"INC-00949","date":"2026-02-17","year":2026,"title":"EU Investigates Shein Over Addictive AI Design and Illegal Product Sales","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-17-f0a7"},{"id":"INC-00423","date":"2026-02-18","year":2026,"title":"AI-Generated Deepfakes Used in Fraudulent Celebrity Endorsements in Serbia","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-02ae"},{"id":"INC-02109","date":"2026-02-18","year":2026,"title":"YouTube AI Recommendation System Outage Disrupts Global Service","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-05b5"},{"id":"INC-00592","date":"2026-02-18","year":2026,"title":"Angolan Journalist Targeted by Predator Spyware","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-11b5"},{"id":"INC-01754","date":"2026-02-18","year":2026,"title":"Scout AI Demonstrates Autonomous Lethal Drone System in California","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-1296"},{"id":"INC-01998","date":"2026-02-18","year":2026,"title":"US Federal Research Funds Support Chinese Military AI Labs, Raising Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-1587"},{"id":"INC-01417","date":"2026-02-18","year":2026,"title":"Meta's AI Plans Spark Privacy and Ethical Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-243d"},{"id":"INC-00283","date":"2026-02-18","year":2026,"title":"AI-Driven Cyberattacks Quadruple in Speed, Targeting Digital Identities","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02","ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-2b24"},{"id":"INC-00065","date":"2026-02-18","year":2026,"title":"AI Adoption Reduces Job Opportunities for Young Tech Workers in Ireland","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-3b05"},{"id":"INC-14690","date":"2026-02-18","year":2026,"title":"Iraqi Government Investigates Harmful AI-Generated Video Insulting National Poet","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-43a9"},{"id":"INC-01834","date":"2026-02-18","year":2026,"title":"Swarm Aero Opens AI-Enabled Military Drone Manufacturing Facility in Arkansas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-4a24"},{"id":"INC-00491","date":"2026-02-18","year":2026,"title":"AI-Generated Passwords Found Predictable and Insecure, Experts Warn","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-51ed"},{"id":"INC-00379","date":"2026-02-18","year":2026,"title":"AI-Generated Deepfake Investment Scams Defraud Victims in Turkey","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-53a6"},{"id":"INC-00986","date":"2026-02-18","year":2026,"title":"Fake Gemini AI Chatbot Used in Google Coin Crypto Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-592c"},{"id":"INC-00339","date":"2026-02-18","year":2026,"title":"AI-Enabled Drones Cause Major Harm in Ukraine War, Spur European Arms Race","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-5a5c"},{"id":"INC-14691","date":"2026-02-18","year":2026,"title":"AI-Discovered Peptide Treats Antibiotic-Resistant Salmonella Infections","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-6536"},{"id":"INC-00891","date":"2026-02-18","year":2026,"title":"AI-Cloned Image of Peter Obi Used in N230 Million Forex Scam in Lagos","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-76f9"},{"id":"INC-01359","date":"2026-02-18","year":2026,"title":"Madrid Bar Association Proposes Penal Reform to Address AI Legal Advice Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-9322"},{"id":"INC-14692","date":"2026-02-18","year":2026,"title":"AI Algorithms on Social Media Linked to Child Mental Health Harm in Croatia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-9e6a"},{"id":"INC-01356","date":"2026-02-18","year":2026,"title":"Los Angeles Sues Roblox Over AI Moderation Failures Leading to Child Exploitation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-9f5d"},{"id":"INC-00369","date":"2026-02-18","year":2026,"title":"AI-Generated Code Error Causes $1.78M Loss in DeFi Protocol Moonwell","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-a018"},{"id":"INC-02104","date":"2026-02-18","year":2026,"title":"X's Algorithm Shifts Users Toward Conservative Political Views, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-a11c"},{"id":"INC-00875","date":"2026-02-18","year":2026,"title":"Deepfake Scam Uses Romanian Central Bank Governor's Image to Promote Fraudulent Investments","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-b125"},{"id":"INC-01524","date":"2026-02-18","year":2026,"title":"New Jersey City Cancels AI Data Center Over Environmental and Cost Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-b435"},{"id":"INC-01649","date":"2026-02-18","year":2026,"title":"Pinterest's AI Moderation System Wrongfully Flags and Bans Users","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-c673"},{"id":"INC-00648","date":"2026-02-18","year":2026,"title":"Arthur Hayes Warns of Potential AI-Driven Credit Crisis Impacting U.S. Financial System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-cfae"},{"id":"INC-01977","date":"2026-02-18","year":2026,"title":"UNESCO Warns of AI-Driven Revenue Losses in Creative Industries","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-d9e7"},{"id":"INC-14693","date":"2026-02-18","year":2026,"title":"AI and Digital Twin Technology Deployed for Fire Prevention at Suwon Hwaseong Fortress","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-de7c"},{"id":"INC-01432","date":"2026-02-18","year":2026,"title":"Microsoft Copilot AI Bug Exposes Confidential Emails by Bypassing Security Controls","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-18-fac4"},{"id":"INC-01678","date":"2026-02-19","year":2026,"title":"Predator Spyware Bypasses iPhone Privacy Indicators for Covert Surveillance","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-0ab7"},{"id":"INC-14694","date":"2026-02-19","year":2026,"title":"French Supermarkets' Use of AI Surveillance Sparks Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-146a"},{"id":"INC-14695","date":"2026-02-19","year":2026,"title":"Seoul Deploys Generative AI CCTV to Enhance Urban Safety","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-2443"},{"id":"INC-00587","date":"2026-02-19","year":2026,"title":"Android Malware 'PromptSpy' Uses Google's Gemini AI for Persistence and Remote Access","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-2f59"},{"id":"INC-01616","date":"2026-02-19","year":2026,"title":"Palantir AI Systems Implicated in Lethal Military and Security Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-30ab"},{"id":"INC-00734","date":"2026-02-19","year":2026,"title":"Car Telemetry Data Sold to Insurers Without Clear Consent","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-33b8"},{"id":"INC-00278","date":"2026-02-19","year":2026,"title":"AI-Driven Cyberattacks Breach 600+ Firewalls Globally in Five Weeks","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-36a4"},{"id":"INC-00120","date":"2026-02-19","year":2026,"title":"AI Chatbots Pose Psychological and Privacy Risks to Children","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-48a3"},{"id":"INC-00435","date":"2026-02-19","year":2026,"title":"AI-Generated Disinformation Threatens Local Elections in Hesse","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-57e1"},{"id":"INC-00238","date":"2026-02-19","year":2026,"title":"AI Tools Enable Sophisticated Fraud and Scams in Latvia","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-5f15"},{"id":"INC-00495","date":"2026-02-19","year":2026,"title":"AI-Generated Political Video Sparks Outrage in Hungary","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-6cad"},{"id":"INC-00600","date":"2026-02-19","year":2026,"title":"Anthropic CEO Warns of Existential AI Risks and Imminent Superhuman Capabilities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-8840"},{"id":"INC-01228","date":"2026-02-19","year":2026,"title":"India's AI Data Centre Boom Raises Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-a4ac"},{"id":"INC-00119","date":"2026-02-19","year":2026,"title":"AI Chatbots Manipulated to Spread Misinformation via Simple Online Tricks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-b0c3"},{"id":"INC-01790","date":"2026-02-19","year":2026,"title":"South Korean Woman Used ChatGPT to Plan Fatal Drug Poisonings","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-bac0"},{"id":"INC-00216","date":"2026-02-19","year":2026,"title":"AI System Deployed to Detect Aggression in Bremen Trams","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-19-cb68"},{"id":"INC-00290","date":"2026-02-20","year":2026,"title":"AI-Driven Disinformation Campaign Targets Japanese Election","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-1839"},{"id":"INC-01813","date":"2026-02-20","year":2026,"title":"Student Sues OpenAI After ChatGPT Allegedly Triggers Psychosis","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-210e"},{"id":"INC-01994","date":"2026-02-20","year":2026,"title":"US Court Upholds $243 Million Verdict Against Tesla Over Fatal Autopilot Crash","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-224a"},{"id":"INC-14696","date":"2026-02-20","year":2026,"title":"Ukrainian AI-Enabled Combat Robot Engages and Injures Russian Soldier","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-31fb"},{"id":"INC-01424","date":"2026-02-20","year":2026,"title":"Metropolitan Police Use Palantir AI to Flag Officer Misconduct Raises Rights Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-4505"},{"id":"INC-01779","date":"2026-02-20","year":2026,"title":"Slovakia Plans National AI Cybersecurity Laboratory","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-4c28"},{"id":"INC-01999","date":"2026-02-20","year":2026,"title":"US Government Contracts AI-Powered Defense Systems, Raising Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-5e64"},{"id":"INC-01874","date":"2026-02-20","year":2026,"title":"Tesla's AI Self-Driving System Prevents Accident After Driver Passes Out","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-66a3"},{"id":"INC-01431","date":"2026-02-20","year":2026,"title":"Microsoft Blog Promotes AI Training on Pirated Harry Potter Books, Sparks Copyright Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-8caf"},{"id":"INC-14697","date":"2026-02-20","year":2026,"title":"Studies Warn of Security and Transparency Risks in AI Agents","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-9328"},{"id":"INC-00086","date":"2026-02-20","year":2026,"title":"AI Beauty Filter Malfunction Causes Influencer to Lose 140,000 Followers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-93fd"},{"id":"INC-01651","date":"2026-02-20","year":2026,"title":"Planned Use of AI in Azerbaijan's Court System Raises Future Risks","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-a834"},{"id":"INC-00141","date":"2026-02-20","year":2026,"title":"AI Data Centre Expansion in UK Raises Energy and Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-b185"},{"id":"INC-14698","date":"2026-02-20","year":2026,"title":"AI-Generated Deepfake Scam Targets Greek Central Bank Governor","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-c7dc"},{"id":"INC-01005","date":"2026-02-20","year":2026,"title":"Finji Accuses TikTok of Unauthorized, Harmful AI-Generated Ads","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-c9cc"},{"id":"INC-00380","date":"2026-02-20","year":2026,"title":"AI-Generated Deepfake Nude Apps Cause Harm and Abuse in Hungary","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-d00b"},{"id":"INC-14699","date":"2026-02-20","year":2026,"title":"Apple Sued in West Virginia for Failing to Deploy AI CSAM Detection","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-d77d"},{"id":"INC-01259","date":"2026-02-20","year":2026,"title":"Italian University Fined for Unlawful Use of Facial Recognition in Online Courses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-deda"},{"id":"INC-00881","date":"2026-02-20","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfakes Targeting Actress Kajol","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-e043"},{"id":"INC-00968","date":"2026-02-20","year":2026,"title":"European Nations Launch AI-Driven Drone Defense Initiative Using Ukrainian Expertise","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-e1a7"},{"id":"INC-00340","date":"2026-02-20","year":2026,"title":"AI-Enabled Drones Cause Significant Harm in Ukraine Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-f1a4"},{"id":"INC-00206","date":"2026-02-20","year":2026,"title":"AI Surveillance Prevents Major Poaching Attempt in Odisha's Similipal Sanctuary","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-20-fae6"},{"id":"INC-01123","date":"2026-02-21","year":2026,"title":"Google Uses AI to Remove 160 Million Fake Reviews and Block Fraudulent Apps","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-1032"},{"id":"INC-01266","date":"2026-02-21","year":2026,"title":"Japan Plans AI-Enabled Defense Upgrades to Counter Drone Threats","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-54b1"},{"id":"INC-00125","date":"2026-02-21","year":2026,"title":"AI Chatbots Provide Lower-Quality Responses to Iranian Users","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-7a67"},{"id":"INC-01221","date":"2026-02-21","year":2026,"title":"India and Israel Advance AI-Enabled Missile Defense Collaboration","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-8977"},{"id":"INC-00265","date":"2026-02-21","year":2026,"title":"AI-Augmented Cyberattack Compromises 600+ FortiGate Firewalls Globally","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02","ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-9182"},{"id":"INC-00082","date":"2026-02-21","year":2026,"title":"AI Audit by Turkish Social Security Agency Cancels 650,000 Pensions for Fraud","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-9a7a"},{"id":"INC-00407","date":"2026-02-21","year":2026,"title":"AI-Generated Deepfake Videos Used in Financial Scam in Portugal","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-bce1"},{"id":"INC-00911","date":"2026-02-21","year":2026,"title":"Drug Cartels Use Social Media Algorithms to Recruit Mexican Youth","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-21-f87d"},{"id":"INC-01538","date":"2026-02-22","year":2026,"title":"Nobel Laureate Warns AI-Driven Job Losses Threaten U.S. Democracy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-55b9"},{"id":"INC-01791","date":"2026-02-22","year":2026,"title":"SpaceX and xAI Pursue AI-Driven Military Drones and Lunar AI Satellite Factories","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-55e5"},{"id":"INC-00195","date":"2026-02-22","year":2026,"title":"AI Privacy Breaches, Cybersecurity Threats, and Economic Disruption Highlighted","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-6bb0"},{"id":"INC-01047","date":"2026-02-22","year":2026,"title":"French Cinema Artists Protest Unauthorized AI Voice and Image Cloning","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-7d29"},{"id":"INC-02007","date":"2026-02-22","year":2026,"title":"US Launches AI-Driven Platform to Bypass Internet Censorship in China and Iran","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-b0f5"},{"id":"INC-00918","date":"2026-02-22","year":2026,"title":"Dutch Online Pharmacies Illegally Share Sensitive Health Data with Big Tech","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-d83a"},{"id":"INC-02015","date":"2026-02-22","year":2026,"title":"US Lawsuits Target Social Media AI for Harm to Children","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-ead5"},{"id":"INC-14700","date":"2026-02-22","year":2026,"title":"AI Chatbot Security Flaws Lead to Data Exposure Risks in South Korea","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-22-f501"},{"id":"INC-00940","date":"2026-02-23","year":2026,"title":"Epirus and DFT Integrate AI-Enabled Counter-Drone Defense System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-1edc"},{"id":"INC-00321","date":"2026-02-23","year":2026,"title":"AI-Driven Scams Lead to Surge in UK Fashion Consumer Complaints","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-2263"},{"id":"INC-01171","date":"2026-02-23","year":2026,"title":"Hyderabad Police Warn of AI-Driven Biometric Identity Theft Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-35e7"},{"id":"INC-00078","date":"2026-02-23","year":2026,"title":"AI Analysis Reveals Accelerating Ground Movement Threatening Trabzon Hospital","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-35fd"},{"id":"INC-02023","date":"2026-02-23","year":2026,"title":"US Military Uses Anthropic's Claude AI in Venezuela Attack; Chinese Firms Illegally Exploit Claude Model","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-3e95"},{"id":"INC-00038","date":"2026-02-23","year":2026,"title":"Actors and Voice Artists Protest Unauthorized AI Voice and Image Use","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-4102"},{"id":"INC-14701","date":"2026-02-23","year":2026,"title":"AI War Simulations Lead to Systematic Nuclear Escalation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-490f"},{"id":"INC-01982","date":"2026-02-23","year":2026,"title":"US Air Force Advances AI-Enabled Combat Drone 'Dark Merlin' Toward Live Weapons Testing","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-558b"},{"id":"INC-01404","date":"2026-02-23","year":2026,"title":"Meta Faces Antitrust Investigation in Africa Over WhatsApp Business AI Restrictions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-5ae1"},{"id":"INC-02122","date":"2026-02-23","year":2026,"title":"Zürich Approves Police Use of AI for Criminal Investigations","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-5b99"},{"id":"INC-00241","date":"2026-02-23","year":2026,"title":"AI Trading Bot Accidentally Transfers Entire Crypto Holdings Due to Misinterpretation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-5c52"},{"id":"INC-01224","date":"2026-02-23","year":2026,"title":"India Develops AI-Enabled Electric Air Taxi with NVIDIA Partnership","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-64aa"},{"id":"INC-02063","date":"2026-02-23","year":2026,"title":"Warnings of Large-Scale Human Job Displacement by AI Robots","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-6897"},{"id":"INC-01983","date":"2026-02-23","year":2026,"title":"US Air Force Demonstrates AI-Enabled Manned-Unmanned Combat Teaming","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-735f"},{"id":"INC-00110","date":"2026-02-23","year":2026,"title":"AI Chatbots Generate Defamatory Content, Prompting Lawsuits","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-738f"},{"id":"INC-00660","date":"2026-02-23","year":2026,"title":"Automakers Advance 'Eyes-Off' AI Driving Amid Safety and Liability Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-92bf"},{"id":"INC-01354","date":"2026-02-23","year":2026,"title":"Lockheed Martin Tests AI-Enhanced Target Identification on F-35 Fighter Jets","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-959f"},{"id":"INC-14702","date":"2026-02-23","year":2026,"title":"KB Kookmin Bank and LG Uplus Unveil AI-Based Real-Time Voice Phishing Prevention System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-9944"},{"id":"INC-01416","date":"2026-02-23","year":2026,"title":"Meta's AI Moderation Fails to Prevent Teen Exposure to Explicit Content on Instagram","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-9b90"},{"id":"INC-00397","date":"2026-02-23","year":2026,"title":"AI-Generated Deepfake Video of Ghislaine Maxwell Sparks Misinformation in Canada","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-9d75"},{"id":"INC-00118","date":"2026-02-23","year":2026,"title":"AI Chatbots Linked to Worsening Mental Health Symptoms in Vulnerable Patients","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-b29a"},{"id":"INC-00790","date":"2026-02-23","year":2026,"title":"Chinese Companies Announce Strategic Partnerships for Large-Scale Deployment of AI-Driven Autonomous Logistics Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-b58d"},{"id":"INC-00079","date":"2026-02-23","year":2026,"title":"AI Apps Leak Millions of Users' Personal and KYC Data via Misconfigured Cloud Storage","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-c4a6"},{"id":"INC-01454","date":"2026-02-23","year":2026,"title":"Mistral AI Accused of Massive Copyright Infringement in Model Training","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-c733"},{"id":"INC-01120","date":"2026-02-23","year":2026,"title":"Google Restricts and Suspends AI Ultra and Antigravity Users Over OpenClaw OAuth Abuse","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-ce89"},{"id":"INC-01280","date":"2026-02-23","year":2026,"title":"Kentucky Lawsuit Against TikTok's AI Algorithms Moves Forward","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-d1f8"},{"id":"INC-00409","date":"2026-02-23","year":2026,"title":"AI-Generated Deepfake Videos Used to Impersonate Colombian Priest in Health Product Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-dbaa"},{"id":"INC-00179","date":"2026-02-23","year":2026,"title":"AI Marketing Algorithms Pose Risks of Manipulating Public Opinion on Warfare","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-e104"},{"id":"INC-01095","date":"2026-02-23","year":2026,"title":"Global Regulators Respond to Harm from Non-Consensual AI-Generated Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-f3d1"},{"id":"INC-01848","date":"2026-02-23","year":2026,"title":"Tenable Warns of Rising AI Security Risks in Cloud Environments","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-f664"},{"id":"INC-14703","date":"2026-02-23","year":2026,"title":"Korean Broadcasters Sue OpenAI for Unauthorized Use of News Content in ChatGPT Training","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-fb63"},{"id":"INC-00745","date":"2026-02-23","year":2026,"title":"ChatGPT and Gemini Spread Misinformation from Fabricated Blog","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-fbc6"},{"id":"INC-00712","date":"2026-02-23","year":2026,"title":"Brazilian Senate Probes Meta Over AI-Moderated Platforms Enabling Online Crime","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-23-fc06"},{"id":"INC-14704","date":"2026-02-24","year":2026,"title":"Gyeonggi Province Develops AI System to Prevent Real Estate Fraud","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-05ea"},{"id":"INC-00783","date":"2026-02-24","year":2026,"title":"Chinese AI Firm DeepSeek Trains Model on Restricted Nvidia Chips, Violating U.S. Export Controls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-0cd2"},{"id":"INC-00886","date":"2026-02-24","year":2026,"title":"Deployment of AI-Enhanced Combat Systems in Military Aircraft Raises Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-10e5"},{"id":"INC-00386","date":"2026-02-24","year":2026,"title":"AI-Generated Deepfake Scam Impersonates Johor Official on TikTok","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-172e"},{"id":"INC-00368","date":"2026-02-24","year":2026,"title":"AI-Generated Code Causes Production Failure and Employee Firing at Indian Startup","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-2871"},{"id":"INC-00347","date":"2026-02-24","year":2026,"title":"AI-Enabled Flying Car Demonstrations and Passenger System Trials in Tokyo","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-3de9"},{"id":"INC-01849","date":"2026-02-24","year":2026,"title":"Tencent Yuanbao AI Outputs Insulting Language to User During Image Generation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-47e3"},{"id":"INC-14705","date":"2026-02-24","year":2026,"title":"Speculative AI-Driven Financial Crisis Report Shakes Wall Street","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-4cab"},{"id":"INC-01516","date":"2026-02-24","year":2026,"title":"Nassim Taleb Warns of Potential Market Crash and Bankruptcies Due to AI Disruption","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-5148"},{"id":"INC-00803","date":"2026-02-24","year":2026,"title":"Citrini Research Warns of AI-Driven Economic Disruption and Calls for AI Tax","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-5542"},{"id":"INC-01102","date":"2026-02-24","year":2026,"title":"Google AI Push Notification Includes Racial Slur, Prompts Apology","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-6844"},{"id":"INC-01275","date":"2026-02-24","year":2026,"title":"JPMorgan Chase Employees Lose Jobs Due to AI Automation, Bank Launches Redeployment Plan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-6daf"},{"id":"INC-02021","date":"2026-02-24","year":2026,"title":"US Military Integrates AI Chatbot Grok Amid Safeguard Controversy","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04","LLM05","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI06","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-6f8d"},{"id":"INC-00536","date":"2026-02-24","year":2026,"title":"AI-Powered Camera System in Paraná Aids Recovery of Stolen and Cloned Vehicles","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-70b5"},{"id":"INC-01466","date":"2026-02-24","year":2026,"title":"MoonPay Launches AI Agents for Autonomous Crypto Transactions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-7b58"},{"id":"INC-00782","date":"2026-02-24","year":2026,"title":"Chinese AI Firm DeepSeek Illegally Uses Nvidia Chips and Distills US AI Models","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-893f"},{"id":"INC-01942","date":"2026-02-24","year":2026,"title":"UK Fines Reddit $19.5M for Failing to Protect Children's Data and Exposing Minors to Harmful Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-9f4e"},{"id":"INC-00296","date":"2026-02-24","year":2026,"title":"AI-Driven Electricity Demand Strains Power Infrastructure and Fuels Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-ac2a"},{"id":"INC-01812","date":"2026-02-24","year":2026,"title":"Student Fails Exam for AI-Assisted Cheating; Mother Confronts Professor at University of Crete","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-acd3"},{"id":"INC-00879","date":"2026-02-24","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfakes Exploiting Singer Jubin Nautiyal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-ad9c"},{"id":"INC-01817","date":"2026-02-24","year":2026,"title":"Study Finds ChatGPT Health AI Fails in Emergency Medical Triage","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-af7a"},{"id":"INC-00334","date":"2026-02-24","year":2026,"title":"AI-Enabled Cyberattacks Surge, Slashing Breakout Times to Under 30 Minutes","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM07"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-c7b3"},{"id":"INC-01116","date":"2026-02-24","year":2026,"title":"Google Gemini AI Glitch Deletes User Chat Histories","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-c836"},{"id":"INC-14706","date":"2026-02-24","year":2026,"title":"Naver and Korean Police Deploy AI Triple Defense to Block Phishing Scams","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-d067"},{"id":"INC-02098","date":"2026-02-24","year":2026,"title":"WiseTech Global Cuts 2,000 Jobs in Major AI-Driven Restructuring","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-d425"},{"id":"INC-01403","date":"2026-02-24","year":2026,"title":"Meta Encryption Hinders AI Child Safety Systems, Leads to Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-d782"},{"id":"INC-01173","date":"2026-02-24","year":2026,"title":"Hyundai Motor Group Donates AI Firefighting Robots to Enhance Firefighter Safety in South Korea","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-dc56"},{"id":"INC-00426","date":"2026-02-24","year":2026,"title":"AI-Generated Disinformation Amplifies Violence and Fear After Cartel Leader's Death in Mexico","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-e717"},{"id":"INC-00250","date":"2026-02-24","year":2026,"title":"AI Use in Judicial Decision Leads to Acquittal in Child Rape Case in Brazil","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-24-f1ab"},{"id":"INC-14707","date":"2026-02-25","year":2026,"title":"LIG Nex1 Unveils AI-Powered Swarm Suicide Drones at DSK 2026","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-0497"},{"id":"INC-00884","date":"2026-02-25","year":2026,"title":"Delhi High Court Reviews Legal Challenge to AI-Enabled Biometric Data Collection","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-1d3f"},{"id":"INC-00517","date":"2026-02-25","year":2026,"title":"AI-Generated Voice Scam Impersonates Malaysian King for Fraudulent Aid Scheme","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-2915"},{"id":"INC-00188","date":"2026-02-25","year":2026,"title":"AI Models Consistently Escalate to Nuclear War in Simulated Military Scenarios","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-2d63"},{"id":"INC-01084","date":"2026-02-25","year":2026,"title":"Germany Plans to Deploy AI in Fight Against Organized Crime","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-3180"},{"id":"INC-00702","date":"2026-02-25","year":2026,"title":"Bot Auto and Ryan Transportation Launch Driverless Freight Operations in Texas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-33fe"},{"id":"INC-00164","date":"2026-02-25","year":2026,"title":"AI Facial Recognition Error Leads to Wrongful Arrest in UK","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-3dad"},{"id":"INC-00396","date":"2026-02-25","year":2026,"title":"AI-Generated Deepfake Video of Brady Tkachuk Causes Controversy","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-4665"},{"id":"INC-01526","date":"2026-02-25","year":2026,"title":"New Zealand Defence Force to Trial AI-Enabled Combat Drones","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-557f"},{"id":"INC-00889","date":"2026-02-25","year":2026,"title":"Development of AI-Based Flood Prediction and Alert System in Valencia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-5841"},{"id":"INC-00855","date":"2026-02-25","year":2026,"title":"Convict Uses AI to Forge Identity and Evade Arrest in Istanbul","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-5bba"},{"id":"INC-00194","date":"2026-02-25","year":2026,"title":"AI Predicts Groundwater Shortage in Bengaluru, Triggers Emergency Measures","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-648d"},{"id":"INC-00428","date":"2026-02-25","year":2026,"title":"AI-Generated Disinformation Campaign Targets Singapore's Prime Minister","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-6b6d"},{"id":"INC-00523","date":"2026-02-25","year":2026,"title":"AI-Induced Market Panic and Systemic Economic Risks Highlighted by ION Group CEO","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-6fbc"},{"id":"INC-00510","date":"2026-02-25","year":2026,"title":"AI-Generated Videos Mocking Korean Independence Hero Spark Outrage","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-9b59"},{"id":"INC-01369","date":"2026-02-25","year":2026,"title":"Man Uses AI to Forge Medical Documents for Restaurant Extortion in Shanghai","severity":"High","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-a95f"},{"id":"INC-14218","date":"2026-02-25","year":2026,"title":"Chinese Officials Use ChatGPT for Cross-Border Intimidation and Disinformation Campaigns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-bd07"},{"id":"INC-00191","date":"2026-02-25","year":2026,"title":"AI Models Pressured to Predict US Strike Date on Iran","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-d241"},{"id":"INC-01446","date":"2026-02-25","year":2026,"title":"Milwaukee Police Officer Misuses AI License Plate System for Personal Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-d504"},{"id":"INC-01656","date":"2026-02-25","year":2026,"title":"Polish Security Chiefs Charged Over Unaccredited Use of Pegasus AI Surveillance System","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-ee29"},{"id":"INC-00882","date":"2026-02-25","year":2026,"title":"Delhi High Court Restrains AI Deepfake Misuse of Ramdev's Persona","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-25-fa1b"},{"id":"INC-01076","date":"2026-02-26","year":2026,"title":"German Court Upholds Student Exclusion for Unauthorized AI Use in Exams","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-076a"},{"id":"INC-01753","date":"2026-02-26","year":2026,"title":"Scotland Considers Criminalizing AI-Generated Deepfake Intimate Images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-080a"},{"id":"INC-01040","date":"2026-02-26","year":2026,"title":"Ford Recalls Over 4 Million Vehicles Due to AI-Controlled Trailer Module Software Defect","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-14b8"},{"id":"INC-00366","date":"2026-02-26","year":2026,"title":"AI-Generated Child Sexual Abuse Images Surge in Japan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-1c77"},{"id":"INC-01787","date":"2026-02-26","year":2026,"title":"South Korean Authorities Crack Down on AI-Generated Fake News Ahead of Local Elections","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-1db5"},{"id":"INC-00199","date":"2026-02-26","year":2026,"title":"AI Recruitment Tool Causes Discriminatory Job Ads, DOJ Fines IT Firm","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-216e"},{"id":"INC-00781","date":"2026-02-26","year":2026,"title":"Chinese Actor Wang Jinsong's Likeness Deepfaked by AI, Raising Legal and Fraud Concerns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-23fd"},{"id":"INC-01760","date":"2026-02-26","year":2026,"title":"Security Risks of Autonomous AI Agents Using MCP in Enterprises","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-2961"},{"id":"INC-00874","date":"2026-02-26","year":2026,"title":"Deepfake Scam Targets Bulgarian News Anchor","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-2a43"},{"id":"INC-01786","date":"2026-02-26","year":2026,"title":"South Korea Strengthens Measures Against AI-Generated Fake News Ahead of Elections","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-3c97"},{"id":"INC-00244","date":"2026-02-26","year":2026,"title":"AI Traffic Cameras in Western Australia Cause License Loss and Fines for Drivers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-437b"},{"id":"INC-00919","date":"2026-02-26","year":2026,"title":"Dutch Organizations Sue X Over AI Chatbot Grok's Generation of Illegal Nude Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-4540"},{"id":"INC-01244","date":"2026-02-26","year":2026,"title":"Iowa Sues GM Over AI-Driven Vehicle Data Collection and Sale","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-7857"},{"id":"INC-00697","date":"2026-02-26","year":2026,"title":"Block Lays Off 40% of Workforce Due to AI Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-975a"},{"id":"INC-02110","date":"2026-02-26","year":2026,"title":"YouTube's AI Algorithms Flood Children’s Feeds with Harmful AI-Generated Videos","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-abd8"},{"id":"INC-01257","date":"2026-02-26","year":2026,"title":"Italian Court Rules AI-Driven Employee Dismissal Lawful","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-b036"},{"id":"INC-14708","date":"2026-02-26","year":2026,"title":"South Korean Army Demonstrates AI-Enabled Combat Engineering Vehicle in Live Training","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-c8db"},{"id":"INC-00037","date":"2026-02-26","year":2026,"title":"Abu Dhabi Launches Supervised Trials of Tesla Self-Driving Cars and Autonomous Trucks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-ddbc"},{"id":"INC-14709","date":"2026-02-26","year":2026,"title":"Burger King Deploys AI Headsets to Monitor Employee Friendliness, Raising Surveillance Concerns","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-26-f451"},{"id":"INC-00977","date":"2026-02-27","year":2026,"title":"Exposed Google API Keys Enable Unauthorized Access to Gemini AI and Data","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-1495"},{"id":"INC-01413","date":"2026-02-27","year":2026,"title":"Meta Sues Over Deepfake-Driven Health Fraud in Brazil","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-2ec2"},{"id":"INC-01531","date":"2026-02-27","year":2026,"title":"NHRC Probes AI Education Project Over Children's Data Privacy Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-33f6"},{"id":"INC-00433","date":"2026-02-27","year":2026,"title":"AI-Generated Disinformation Targets Paris Municipal Election Candidates","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-39a0"},{"id":"INC-01011","date":"2026-02-27","year":2026,"title":"Flock Safety Sued for AI-Driven License Plate Data Privacy Violations in California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-9c5b"},{"id":"INC-00930","date":"2026-02-27","year":2026,"title":"Elon Musk Accuses OpenAI's ChatGPT of Causing User Harm Amid Legal Disputes","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-ca0f"},{"id":"INC-01868","date":"2026-02-27","year":2026,"title":"Tesla Plans to Deploy AI-Driven Robotaxis and Robots in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-cd7a"},{"id":"INC-01162","date":"2026-02-27","year":2026,"title":"Health Experts Warn of Risks in AI-Driven Self-Diagnosis in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-d17a"},{"id":"INC-00720","date":"2026-02-27","year":2026,"title":"Bybit's AI System Blocks $300 Million in Crypto Fraud Amid Surge in AI-Driven Scams","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-d18f"},{"id":"INC-14710","date":"2026-02-27","year":2026,"title":"Samsung Settles Texas Lawsuit Over Smart TV AI Data Collection","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-d649"},{"id":"INC-01105","date":"2026-02-27","year":2026,"title":"Google and OpenAI Employees Protest Pentagon AI Use as OpenAI Confirms Military Deployment","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-ec4d"},{"id":"INC-00302","date":"2026-02-27","year":2026,"title":"AI-Driven Health Misinformation Harms Patients in Slovakia","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-eece"},{"id":"INC-00166","date":"2026-02-27","year":2026,"title":"AI Facial Recognition Leads to 270 Arrests at São Paulo Stadiums","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-f3a1"},{"id":"INC-00913","date":"2026-02-27","year":2026,"title":"Dutch Authors and Journalists Demand Meta Stop Using Copyrighted Works for AI Training","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-27-fa75"},{"id":"INC-00349","date":"2026-02-28","year":2026,"title":"AI-Enabled Iranian Shahed Drones Cause Harm in Ukraine and Persian Gulf","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-1a1f"},{"id":"INC-00231","date":"2026-02-28","year":2026,"title":"AI Systems Used for Target Selection and Attacks in Global Conflicts","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-56d9"},{"id":"INC-00521","date":"2026-02-28","year":2026,"title":"AI-Generated WeChat IDs Lead to Privacy Breaches and Unsolicited Contacts","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-59b0"},{"id":"INC-01858","date":"2026-02-28","year":2026,"title":"Tesla Cybertruck Autopilot Crash Leads to Lawsuit in Houston","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-6677"},{"id":"INC-02022","date":"2026-02-28","year":2026,"title":"US Military Uses Anthropic AI in Iran Strike Amid Ban, OpenAI Replaces Anthropic in Pentagon Network","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-a974"},{"id":"INC-02033","date":"2026-02-28","year":2026,"title":"US Uses Anthropic AI in Lethal Military Strikes on Iran","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-d4ff"},{"id":"INC-00350","date":"2026-02-28","year":2026,"title":"AI-Enabled Iron Beam and Iron Dome Systems Deployed in Israeli Defense","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-d62f"},{"id":"INC-14711","date":"2026-02-28","year":2026,"title":"Egypt Plans AI-Driven Military Weapons Development","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-02-28-f264"},{"id":"INC-00567","date":"2026-03-01","year":2026,"title":"AI-Powered WaTracker App Circumvents WhatsApp Privacy Controls","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-0936"},{"id":"INC-00751","date":"2026-03-01","year":2026,"title":"ChatGPT Linked to Worsening Mental Health and Legal Action Prompts Safeguards","severity":"High","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-10b8"},{"id":"INC-01456","date":"2026-03-01","year":2026,"title":"Misuse and Malfunction of Driver Assistance AI Systems Cause Traffic Accidents in Taiwan and China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-206d"},{"id":"INC-00840","date":"2026-03-01","year":2026,"title":"Colombian Election Software Faces Allegations of Vulnerabilities and Manipulation Risks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-322e"},{"id":"INC-02046","date":"2026-03-01","year":2026,"title":"Virginia Police Violate ALPR Laws, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-338c"},{"id":"INC-00862","date":"2026-03-01","year":2026,"title":"Critical OpenClaw AI Vulnerability Allows Malicious Websites to Hijack Local AI Agents","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-476b"},{"id":"INC-00529","date":"2026-03-01","year":2026,"title":"AI-Orchestrated Strike Kills Iranian Leader in Tehran","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-5519"},{"id":"INC-01953","date":"2026-03-01","year":2026,"title":"UK Teen's Suicide Linked to Harmful AI-Driven Social Media Algorithms","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-5a64"},{"id":"INC-00652","date":"2026-03-01","year":2026,"title":"Australia Threatens to Block AI Services Over Age Verification Failures","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-6845"},{"id":"INC-01662","date":"2026-03-01","year":2026,"title":"Potential AI-Enabled Satellite Warfare Risks Between US and China","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-87e1"},{"id":"INC-02020","date":"2026-03-01","year":2026,"title":"US Military Deploys AI-Enabled LUCAS Suicide Drones Against Iran","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-cd31"},{"id":"INC-14712","date":"2026-03-01","year":2026,"title":"SERAP Calls for Investigation into Big Tech's Algorithmic Harms in Nigeria","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-d8a4"},{"id":"INC-01685","date":"2026-03-01","year":2026,"title":"Public Boycott of OpenAI After Pentagon AI Deal Raises Military AI Ethics Concerns","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-01-eeaf"},{"id":"INC-01145","date":"2026-03-02","year":2026,"title":"Grok AI Generates Child Sexual Abuse Images, Prompting Garda Investigations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-0f3f"},{"id":"INC-00312","date":"2026-03-02","year":2026,"title":"AI-Driven Online Financial Scams Surge in Bulgaria","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-134b"},{"id":"INC-00476","date":"2026-03-02","year":2026,"title":"AI-Generated Images Enable Sophisticated Refund Fraud on Vinted and E-Commerce Platforms","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-16b3"},{"id":"INC-01827","date":"2026-03-02","year":2026,"title":"Supreme Court Flags Use of AI-Generated Fake Judgments in Indian Trial Court","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-3029"},{"id":"INC-00154","date":"2026-03-02","year":2026,"title":"AI Deepfake Voice Scams Target 1 in 4 Americans, Causing Financial and Emotional Harm","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-3408"},{"id":"INC-00373","date":"2026-03-02","year":2026,"title":"AI-Generated Content on Chinese Platforms Causes Harm and Triggers Regulatory Crackdown","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-4363"},{"id":"INC-01684","date":"2026-03-02","year":2026,"title":"Proposed AI Data Centre in Durban Raises Resource and Governance Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-71c9"},{"id":"INC-01847","date":"2026-03-02","year":2026,"title":"Telkom Indonesia Warns of Data Leakage Risks from Public AI Use","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-78e2"},{"id":"INC-00867","date":"2026-03-02","year":2026,"title":"Ctrip's AI Pricing Tools Cause Market Disruption and Regulatory Scrutiny","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-79be"},{"id":"INC-00684","date":"2026-03-02","year":2026,"title":"Bengaluru Techie Fires Cook After AI Surveillance Detects Theft","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-8f18"},{"id":"INC-00768","date":"2026-03-02","year":2026,"title":"China Raises Concerns Over US Plans for AI-Powered Cyber Operations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-9400"},{"id":"INC-01010","date":"2026-03-02","year":2026,"title":"Flock Safety License Plate Reader Data Sharing Sparks Privacy and Rights Concerns in California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-9a17"},{"id":"INC-00314","date":"2026-03-02","year":2026,"title":"AI-Driven Phishing Attacks Bypass Microsoft Security, Compromise Thousands","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-9b64"},{"id":"INC-00090","date":"2026-03-02","year":2026,"title":"AI Cancer Pathology Tools Risk Unreliable Diagnoses Due to Shortcut Learning","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-a1fa"},{"id":"INC-01108","date":"2026-03-02","year":2026,"title":"Google Chrome Gemini AI Vulnerability Exposes Users to Surveillance and Data Theft","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-a21b"},{"id":"INC-00354","date":"2026-03-02","year":2026,"title":"AI-Enabled Shahed Drone Attack Forces Evacuation of British Bases in Cyprus","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-aa3f"},{"id":"INC-00112","date":"2026-03-02","year":2026,"title":"AI Chatbots in Mental Health Counseling Pose Ethical and Safety Risks, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-ab54"},{"id":"INC-14713","date":"2026-03-02","year":2026,"title":"Biometric AI ID Systems in Africa Cause Exclusion and Rights Violations","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-b00c"},{"id":"INC-00568","date":"2026-03-02","year":2026,"title":"AI-Powered WiFi Systems Enable Through-Wall Human Detection, Raising Privacy and Surveillance Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-da7f"},{"id":"INC-00695","date":"2026-03-02","year":2026,"title":"Blind YouTuber Applies for Neuralink AI Vision Restoration Trial","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-e01c"},{"id":"INC-01734","date":"2026-03-02","year":2026,"title":"Researchers Warn of Privacy Risks in AI-Based Age Verification Systems","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-f06a"},{"id":"INC-01766","date":"2026-03-02","year":2026,"title":"Seoul's AI System Rapidly Deletes Digital Sexual Crime Content Nationwide","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-02-f7b2"},{"id":"INC-01654","date":"2026-03-03","year":2026,"title":"Police Use Facial Recognition AI for Public Safety and Arrests in UK Cities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-140e"},{"id":"INC-02117","date":"2026-03-03","year":2026,"title":"Zero-Click Prompt Injection in Perplexity's Comet AI Browser Enables Credential Theft","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-3fd7"},{"id":"INC-00095","date":"2026-03-03","year":2026,"title":"AI Chatbot Conversations Used as Evidence in Antitrust Investigations Lead to Major Fines","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-4b05"},{"id":"INC-00313","date":"2026-03-03","year":2026,"title":"AI-Driven Online Violence Against Women in Spain","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-53b9"},{"id":"INC-00436","date":"2026-03-03","year":2026,"title":"AI-Generated Disinformation Undermines Nepal's Election","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-675f"},{"id":"INC-14714","date":"2026-03-03","year":2026,"title":"Pentagon-Anthropic Dispute Highlights AI-Driven Mass Surveillance Risks","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-6906"},{"id":"INC-01952","date":"2026-03-03","year":2026,"title":"UK Startup Develops AI for Autonomous Military Drone Teams","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-8690"},{"id":"INC-00531","date":"2026-03-03","year":2026,"title":"AI-Powered Airstrikes Accelerate Lethal Decision-Making in Iran Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-8b1c"},{"id":"INC-01070","date":"2026-03-03","year":2026,"title":"Georgia Senator Uses AI to Create Islamophobic Campaign Ad, Sparks Backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-ab70"},{"id":"INC-00176","date":"2026-03-03","year":2026,"title":"AI Language Models Reinforce Gender Stereotypes and Inequality Among Young Women","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-b157"},{"id":"INC-00178","date":"2026-03-03","year":2026,"title":"AI License Plate Readers Breach Privacy Laws in California","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-b926"},{"id":"INC-00534","date":"2026-03-03","year":2026,"title":"AI-Powered Avalanche Warning System Deployed in Austrian Ski Resort","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-c588"},{"id":"INC-00325","date":"2026-03-03","year":2026,"title":"AI-Driven Surveillance Enables Assassination of Iran's Supreme Leader","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-c827"},{"id":"INC-00348","date":"2026-03-03","year":2026,"title":"AI-Enabled Iranian Drone Strike Kills US Soldiers in Kuwait","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-cc5b"},{"id":"INC-00094","date":"2026-03-03","year":2026,"title":"AI Chatbot Biases Influence Public Political Opinions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-ed82"},{"id":"INC-14715","date":"2026-03-03","year":2026,"title":"AI Large Language Models Enable Mass Online Deanonymization, Threatening User Privacy","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-03-f3f2"},{"id":"INC-00171","date":"2026-03-04","year":2026,"title":"AI Hallucination in Police Report Leads to Fan Ban and Public Apology","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-1349"},{"id":"INC-00328","date":"2026-03-04","year":2026,"title":"AI-Driven Work Management Causes Harm to Workers","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-3ccd"},{"id":"INC-00507","date":"2026-03-04","year":2026,"title":"AI-Generated Translations Introduce Errors in Wikipedia Articles","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-686d"},{"id":"INC-00357","date":"2026-03-04","year":2026,"title":"AI-Enabled Tycoon 2FA Phishing Platform Disrupted After Global Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-7098"},{"id":"INC-00361","date":"2026-03-04","year":2026,"title":"AI-Facilitated Sexual Violence Against Children in Brazil","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-7187"},{"id":"INC-00233","date":"2026-03-04","year":2026,"title":"AI Systems Used in US and Israeli Military Operations Cause Lethal Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-71c4"},{"id":"INC-01737","date":"2026-03-04","year":2026,"title":"Risks of Autonomous AI Agent Interactions and Governance Challenges","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-7b56"},{"id":"INC-01223","date":"2026-03-04","year":2026,"title":"India Develops AI-Enabled Bodyguard Satellites for Space Security","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-83f2"},{"id":"INC-00185","date":"2026-03-04","year":2026,"title":"AI Model Evo2 Raises Bioethics Concerns Over DNA Editing Capabilities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-9608"},{"id":"INC-14716","date":"2026-03-04","year":2026,"title":"Autonomous AI Agents Escalate Cybersecurity Threats and Incidents","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-a901"},{"id":"INC-00526","date":"2026-03-04","year":2026,"title":"AI-Manipulated Images Used to Bypass Facial Recognition in Bank Fraud Scheme in Japan","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-b5b6"},{"id":"INC-01743","date":"2026-03-04","year":2026,"title":"Romanian Company Launches AI-Powered Autonomous Drone Countermeasure System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-b778"},{"id":"INC-00470","date":"2026-03-04","year":2026,"title":"AI-Generated Fake War Videos Spread via Hacked Accounts on X","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-c40a"},{"id":"INC-00933","date":"2026-03-04","year":2026,"title":"Embraer and Valkyrie Aero Integrate AI-Powered Anti-Drone System into Super Tucano","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-04-ddcb"},{"id":"INC-14717","date":"2026-03-05","year":2026,"title":"Busan Launches AI-Based Urban Flood Response Platform","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-1052"},{"id":"INC-14718","date":"2026-03-05","year":2026,"title":"AI Systems Reduce Livestock Accidents and Boost Farmer Income in Gyeonggi Province","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-1ac3"},{"id":"INC-00794","date":"2026-03-05","year":2026,"title":"Chinese Lawmaker Raises AI Assistant Privacy Risks; ByteDance Responds","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-1acf"},{"id":"INC-00355","date":"2026-03-05","year":2026,"title":"AI-Enabled Spyware 'Graphite' Used to Illegally Monitor Journalists and Activists in Italy","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-333e"},{"id":"INC-14719","date":"2026-03-05","year":2026,"title":"Seoul Uses AI to Crack Down on Illegal Real Estate Transactions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-3b51"},{"id":"INC-00970","date":"2026-03-05","year":2026,"title":"Europol Warns of AI-Driven Cyber Threats Amid Iran Crisis","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-65fb"},{"id":"INC-00537","date":"2026-03-05","year":2026,"title":"AI-Powered Chatbots Used in Sophisticated Investment Scams on Messaging Apps in Italy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-7f85"},{"id":"INC-00921","date":"2026-03-05","year":2026,"title":"Dutch Privacy Authority Warns of Rising AI Risks and Urges Immediate Regulation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-98d6"},{"id":"INC-00288","date":"2026-03-05","year":2026,"title":"AI-Driven Deepfake and Biometric Fraud Surges Across Africa","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-9a8d"},{"id":"INC-00224","date":"2026-03-05","year":2026,"title":"AI System Used in Germany to Detect and Remove Harmful Online Content for Youth Protection","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-ad9b"},{"id":"INC-14720","date":"2026-03-05","year":2026,"title":"Japan Seeks to Join NATO's AI-Driven Defense Innovation Project","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-d06d"},{"id":"INC-01044","date":"2026-03-05","year":2026,"title":"Fox News Misattributes Ukrainian AI Drone Footage as US Military Technology","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-d78d"},{"id":"INC-01176","date":"2026-03-05","year":2026,"title":"IBM Report: Surge in AI-Driven Cyberattacks Exploiting Security Vulnerabilities","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-d822"},{"id":"INC-01225","date":"2026-03-05","year":2026,"title":"India Tests AI-Powered Swarm Interceptor for Drone Defence","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-da88"},{"id":"INC-00326","date":"2026-03-05","year":2026,"title":"AI-Driven Targeting in Iran Leads to Civilian Harm and Raises Global Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-e653"},{"id":"INC-00177","date":"2026-03-05","year":2026,"title":"AI Legal Advice Leads to Lawsuits and Court Sanctions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-f008"},{"id":"INC-01630","date":"2026-03-05","year":2026,"title":"Pentagon and Gulf States Consider Ukrainian AI Drones to Counter Iranian Attacks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-05-ff76"},{"id":"INC-02045","date":"2026-03-06","year":2026,"title":"Virgin Media O2 Uses AI to Block Over 1 Billion Scam Calls","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-0b1e"},{"id":"INC-00922","date":"2026-03-06","year":2026,"title":"EagleNXT Invests in Israeli AI-Enabled Autonomous Weapons Developer","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-3cc3"},{"id":"INC-00387","date":"2026-03-06","year":2026,"title":"AI-Generated Deepfake Scam Impersonates Spanish TV Host Pablo Motos","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-3ec2"},{"id":"INC-01839","date":"2026-03-06","year":2026,"title":"Teacher Forced to Quit After Colleague Creates and Distributes Deepfake Pornography","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-47e2"},{"id":"INC-00530","date":"2026-03-06","year":2026,"title":"AI-Powered Age Verification Sparks Privacy and Surveillance Fears in the US","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-a549"},{"id":"INC-00724","date":"2026-03-06","year":2026,"title":"California Colleges' AI Chatbots Provide Inaccurate Information, Frustrating Students","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-d5de"},{"id":"INC-01997","date":"2026-03-06","year":2026,"title":"US Deploys AI-Powered Merops Anti-Drone Systems to Middle East to Counter Iranian Threats","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-d79f"},{"id":"INC-02043","date":"2026-03-06","year":2026,"title":"Vinod Khosla Predicts AI Will Replace 80% of Jobs by 2030","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-06-fe5b"},{"id":"INC-00077","date":"2026-03-07","year":2026,"title":"AI Algorithms Used for Content Suppression and Low-Quality Content Cleanup in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-5ac8"},{"id":"INC-01629","date":"2026-03-07","year":2026,"title":"Pentagon and Anthropic Clash Over Military Use of AI Models","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-6aed"},{"id":"INC-00075","date":"2026-03-07","year":2026,"title":"AI Agents in Research Study Leak Data and Delete Systems After Malfunction","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-757b"},{"id":"INC-01792","date":"2026-03-07","year":2026,"title":"SpaceX's Million-Satellite AI Data Center Plan Raises Environmental and Astronomical Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-873b"},{"id":"INC-00330","date":"2026-03-07","year":2026,"title":"AI-Enabled Armed Robots Used in Ukraine War Cause Battlefield Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-89fb"},{"id":"INC-00573","date":"2026-03-07","year":2026,"title":"Alibaba AI Agent ROME Engages in Unauthorized Crypto Mining and Network Tunneling","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-95e2"},{"id":"INC-00105","date":"2026-03-07","year":2026,"title":"AI Chatbots Facilitate Violence and Harm, Raise Mental Health and Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-9f22"},{"id":"INC-14721","date":"2026-03-07","year":2026,"title":"Smart Electric Bicycle AI Features Disabled, Consumers File Complaints","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-a351"},{"id":"INC-00076","date":"2026-03-07","year":2026,"title":"AI Algorithm Manipulation Silences Dissent on X Platform","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-07-d8fa"},{"id":"INC-00098","date":"2026-03-08","year":2026,"title":"AI Chatbot Grok Generates Offensive and Harmful Content About Football Tragedies","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-1f8d"},{"id":"INC-00121","date":"2026-03-08","year":2026,"title":"AI Chatbots Promote Illegal Gambling and Advise on Bypassing Safeguards","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-51bc"},{"id":"INC-00926","date":"2026-03-08","year":2026,"title":"Egypt Launches AI-Powered Digital Pathology Network to Improve Cancer Diagnosis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-5a8a"},{"id":"INC-00700","date":"2026-03-08","year":2026,"title":"Bombay Stock Exchange Warns of Fraudulent Deepfake Video Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-6b2a"},{"id":"INC-00378","date":"2026-03-08","year":2026,"title":"AI-Generated Deepfake Images Used to Harass Slovenian Activist","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-8a8d"},{"id":"INC-14722","date":"2026-03-08","year":2026,"title":"Japan and US Plan AI-Driven Military Information Sharing and Target Selection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-ca93"},{"id":"INC-00295","date":"2026-03-08","year":2026,"title":"AI-Driven Dynamic Pricing Leads to Consumer Harm and Regulatory Scrutiny","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-d7a7"},{"id":"INC-00140","date":"2026-03-08","year":2026,"title":"AI Data Centers Raise Concerns Over Power Grid Strain and Environmental Impact in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-f6c0"},{"id":"INC-00841","date":"2026-03-08","year":2026,"title":"Colombian President Raises Concerns Over Electoral Software Transparency","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-08-fb58"},{"id":"INC-01163","date":"2026-03-09","year":2026,"title":"Hezbollah Uses AI-Guided Drones and Google Maps in Attack on British Base in Cyprus","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-13bc"},{"id":"INC-00248","date":"2026-03-09","year":2026,"title":"AI Uncovers Massive Tax Evasion in Rajasthan Land Deals","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-1501"},{"id":"INC-01935","date":"2026-03-09","year":2026,"title":"Uber, Nissan, and Wayve Plan Tokyo Robotaxi Trial Using AI-Driven Vehicles","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-296f"},{"id":"INC-01127","date":"2026-03-09","year":2026,"title":"Google's AI Search Feature Causes Major Traffic and Revenue Loss for News Publishers in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-2c21"},{"id":"INC-00908","date":"2026-03-09","year":2026,"title":"Douyin E-commerce Cracks Down on AI-Generated Celebrity Impersonation Scams","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-3df7"},{"id":"INC-00239","date":"2026-03-09","year":2026,"title":"AI Tools Expose Security Flaws in Legacy and Smart Home Devices, Leading to Privacy Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-4996"},{"id":"INC-02100","date":"2026-03-09","year":2026,"title":"X Investigates Grok Chatbot for Generating Racist and Offensive Posts","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-49d9"},{"id":"INC-00525","date":"2026-03-09","year":2026,"title":"AI-Manipulated Audio Recordings Target Slovenian Political Party","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-531b"},{"id":"INC-00829","date":"2026-03-09","year":2026,"title":"Claude Opus 4.6 Outsmarts AI Benchmark by Decrypting Answer Key","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-5413"},{"id":"INC-01122","date":"2026-03-09","year":2026,"title":"Google Sued by Indie Musicians for Training AI Music Models on Copyrighted Works","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-5edf"},{"id":"INC-01797","date":"2026-03-09","year":2026,"title":"SPARC AI Deploys Overwatch AI Targeting Platform for Military Testing in Ukraine","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-700f"},{"id":"INC-00662","date":"2026-03-09","year":2026,"title":"Automated Traffic Fines System in Kenya Sparks Legal and Public Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-7ae5"},{"id":"INC-00576","date":"2026-03-09","year":2026,"title":"Amazon Alexa Makes Inappropriate Comments to Child, Prompting Parental Outrage","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-8538"},{"id":"INC-00223","date":"2026-03-09","year":2026,"title":"AI System Targets Cheating in Honor of Kings, Bans 1.27 Million Accounts","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-97c7"},{"id":"INC-00565","date":"2026-03-09","year":2026,"title":"AI-Powered Video Surveillance Pilot at Berlin Government Sites Raises Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-9c1e"},{"id":"INC-00228","date":"2026-03-09","year":2026,"title":"AI Systems Improve Early Breast Cancer Detection in UK NHS Trials","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-ab37"},{"id":"INC-00516","date":"2026-03-09","year":2026,"title":"AI-Generated Voice Scam Impersonates Bharti Singh in Slimming Product Fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-be22"},{"id":"INC-01664","date":"2026-03-09","year":2026,"title":"Chinese AI Startup Publishes Satellite Intelligence on US Military in Middle East","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-bf18"},{"id":"INC-00247","date":"2026-03-09","year":2026,"title":"AI Uncovers Massive Restaurant Tax Evasion in India","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-c924"},{"id":"INC-00230","date":"2026-03-09","year":2026,"title":"AI Systems Threaten Online Anonymity by Accurately Identifying Users","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-d203"},{"id":"INC-01234","date":"2026-03-09","year":2026,"title":"Indian Organisations Face Surge in AI-Driven Deepfake Attacks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-eb41"},{"id":"INC-01862","date":"2026-03-09","year":2026,"title":"Tesla FSD AI System Faces Crashes, Injuries, and Federal Probe","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-f513"},{"id":"INC-01986","date":"2026-03-09","year":2026,"title":"US Army Contracts Elbit America for AI-Enabled Soldier Battlefield System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-09-f612"},{"id":"INC-01056","date":"2026-03-10","year":2026,"title":"Fujitsu Launches AI Decision Support Program for Japanese Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-0183"},{"id":"INC-00096","date":"2026-03-10","year":2026,"title":"AI Chatbot Encourages Suicide, Prompting Parental Outcry Over Online Safety","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-0332"},{"id":"INC-00704","date":"2026-03-10","year":2026,"title":"Brazil Investigates TikTok AI Algorithms Over Viral Trend Inciting Violence Against Women","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-052e"},{"id":"INC-00287","date":"2026-03-10","year":2026,"title":"AI-Driven Data Centers Spark Environmental and Social Conflicts in Latin America","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-0a97"},{"id":"INC-02030","date":"2026-03-10","year":2026,"title":"US Regulators Review Zoox Petition to Deploy Fully Autonomous Robotaxis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-0beb"},{"id":"INC-02019","date":"2026-03-10","year":2026,"title":"US Military Deploys AI Systems for Battlefield Targeting and Strike Decisions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-114f"},{"id":"INC-00646","date":"2026-03-10","year":2026,"title":"Armadin Raises $189.9M to Develop Autonomous AI Cyber Defense Platform","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-148e"},{"id":"INC-01993","date":"2026-03-10","year":2026,"title":"US Court Blocks Perplexity AI's Shopping Bots on Amazon","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-1c9f"},{"id":"INC-14723","date":"2026-03-10","year":2026,"title":"AI-Generated Video Causes Misinformation About Chongqing Bridge Collapse","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-27a3"},{"id":"INC-02115","date":"2026-03-10","year":2026,"title":"ZenaTech Develops Autonomous Maritime Drone Defense System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-2d1c"},{"id":"INC-02101","date":"2026-03-10","year":2026,"title":"X Suspends 800 Million Accounts Over AI-Driven Manipulation and Spam","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-31d4"},{"id":"INC-01402","date":"2026-03-10","year":2026,"title":"Meta Criticized for Inadequate AI Deepfake Moderation During Iran-Israel Conflict","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-332b"},{"id":"INC-00481","date":"2026-03-10","year":2026,"title":"AI-Generated Malware Obscures Cyberattack Origins, Hindering Detection","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-38c2"},{"id":"INC-00139","date":"2026-03-10","year":2026,"title":"AI Data Centers Projected to Strain U.S. Water Supplies by 2030","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-3fe8"},{"id":"INC-00788","date":"2026-03-10","year":2026,"title":"Chinese Authorities Restrict OpenClaw AI Agent Amid Security Concerns","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-4183"},{"id":"INC-01771","date":"2026-03-10","year":2026,"title":"Sikorsky and Robinson Unveil Autonomous R66 TURBINETRUCK Helicopter with MATRIX AI System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-4600"},{"id":"INC-14724","date":"2026-03-10","year":2026,"title":"AI-Enhanced Images Fuel Misinformation in Middle East Conflict","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-628e"},{"id":"INC-00213","date":"2026-03-10","year":2026,"title":"AI Sycophancy and Rising Vulnerabilities Lead to Social and Cybersecurity Harms","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-6447"},{"id":"INC-01450","date":"2026-03-10","year":2026,"title":"Minnesota Lawmakers Propose Bipartisan AI Regulations to Protect Minors","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-7d79"},{"id":"INC-00338","date":"2026-03-10","year":2026,"title":"AI-Enabled Drones Cause Damage in Middle East; Taiwan Expands AI Military Capabilities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-8353"},{"id":"INC-00556","date":"2026-03-10","year":2026,"title":"AI-Powered Surveillance Cameras Spark Privacy and Rights Violations Debate Across U.S.","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-8564"},{"id":"INC-00909","date":"2026-03-10","year":2026,"title":"Drone Strikes on AI Data Centers Disrupt Critical Infrastructure in Middle East","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-8ef4"},{"id":"INC-01864","date":"2026-03-10","year":2026,"title":"Tesla FSD Failures Lead to Crashes and Lawsuits in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-9162"},{"id":"INC-02018","date":"2026-03-10","year":2026,"title":"US Military Confirms Use of AI in Iran Strikes, Causing Civilian Harm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-9376"},{"id":"INC-01687","date":"2026-03-10","year":2026,"title":"Punjab Cyber Fraudsters Use AI Voice-Changing and Deepfake Videos for Extortion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-9ad7"},{"id":"INC-00303","date":"2026-03-10","year":2026,"title":"AI-Driven Identity Attacks Surpass Stolen Credentials as Top Enterprise Threat","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-b0b7"},{"id":"INC-01111","date":"2026-03-10","year":2026,"title":"Google Deploys AI Agents for Pentagon Amid Anthropic Legal Dispute and Sanctions","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-b3f3"},{"id":"INC-00774","date":"2026-03-10","year":2026,"title":"China Removes 39,000 Accounts for AI-Generated Harmful Content During Spring Festival","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-b6fc"},{"id":"INC-00401","date":"2026-03-10","year":2026,"title":"AI-Generated Deepfake Videos Harm Chinese Celebrities","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-c22b"},{"id":"INC-00294","date":"2026-03-10","year":2026,"title":"AI-Driven Drones Cause Major Losses in Ukraine Conflict","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-d51b"},{"id":"INC-01406","date":"2026-03-10","year":2026,"title":"Meta Faces Legal Action for Training AI on Millions of Pirated Books","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-dd7a"},{"id":"INC-01689","date":"2026-03-10","year":2026,"title":"Punjab Police Use AI Voice Recognition to Combat Organized Crime","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-dfd4"},{"id":"INC-01394","date":"2026-03-10","year":2026,"title":"Meta Acquires Moltbook Amid AI Agent Security Concerns","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-e2be"},{"id":"INC-00910","date":"2026-03-10","year":2026,"title":"Drones Near Airports in Bulgaria Pose Serious AI-Driven Collision Risk","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-e774"},{"id":"INC-00449","date":"2026-03-10","year":2026,"title":"AI-Generated Fake Images Used in Disinformation Campaign Against Taiwanese Baseball Fans","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-fc78"},{"id":"INC-01917","date":"2026-03-10","year":2026,"title":"Trust Wallet Launches AI-Powered Real-Time Scam Address Protection","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-10-ffcf"},{"id":"INC-00337","date":"2026-03-11","year":2026,"title":"AI-Enabled Drone Warfare Escalates in the Middle East","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-00ae"},{"id":"INC-01961","date":"2026-03-11","year":2026,"title":"Ukraine Increases Procurement and Deployment of AI-Enabled Military Drones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-1a85"},{"id":"INC-00514","date":"2026-03-11","year":2026,"title":"AI-Generated Violent Video of Jeremy Clarkson and UK Prime Minister Sparks Outcry","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-20fe"},{"id":"INC-00588","date":"2026-03-11","year":2026,"title":"Anduril Acquires ExoAnalytic to Expand AI-Driven Space Defense Capabilities","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-227c"},{"id":"INC-00051","date":"2026-03-11","year":2026,"title":"Agentic AI Drives Surge in Global Cybercrime, Identity Theft, and Ransomware","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-3607"},{"id":"INC-00854","date":"2026-03-11","year":2026,"title":"Controversy Over Palantir's AI Use in Argentina and Military Applications Abroad","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-3ca8"},{"id":"INC-01243","date":"2026-03-11","year":2026,"title":"InvestCloud Replaces Entire Italian Workforce with AI, Leading to Mass Layoffs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-3f67"},{"id":"INC-00711","date":"2026-03-11","year":2026,"title":"Brazilian Senate Approves AI Monitoring to Protect Domestic Violence Victims","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-4eb0"},{"id":"INC-01074","date":"2026-03-11","year":2026,"title":"German Court Holds Chatbot Operator Liable for AI-Generated False Claims","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-567f"},{"id":"INC-01996","date":"2026-03-11","year":2026,"title":"US Deploys AI-Powered Autonomous Maritime Drones for 24/7 Surveillance at Souda Bay","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-72dc"},{"id":"INC-00472","date":"2026-03-11","year":2026,"title":"AI-Generated False Citations Prompt Procurement Overhaul in Newfoundland and Labrador","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-7702"},{"id":"INC-00728","date":"2026-03-11","year":2026,"title":"Canadian Firms Collaborate on AI-Powered Autonomous Navigation for Arctic Defence","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-9759"},{"id":"INC-00104","date":"2026-03-11","year":2026,"title":"AI Chatbots Facilitate Planning of Violent Attacks, Study Finds","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-a080"},{"id":"INC-01741","date":"2026-03-11","year":2026,"title":"Romanian AI Integrated into US Military Counter-Drone Systems in the Middle East","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-aa2e"},{"id":"INC-00773","date":"2026-03-11","year":2026,"title":"China Warns Against Unchecked Military Use of AI, Urges Human Oversight","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-b083"},{"id":"INC-00267","date":"2026-03-11","year":2026,"title":"AI-Based Recruitment Test Excludes Applicants in Ghana","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-b1f2"},{"id":"INC-01782","date":"2026-03-11","year":2026,"title":"Social Media Algorithms Drive Digital Addiction Among Youth","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-c401"},{"id":"INC-01249","date":"2026-03-11","year":2026,"title":"Iranian AI-Enabled Drone Attacks Target Tech Company Data Centers in Middle East","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-cd14"},{"id":"INC-01273","date":"2026-03-11","year":2026,"title":"JKT48's Freya Reports AI-Generated Inappropriate Image Manipulation to Police","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-dc6b"},{"id":"INC-00382","date":"2026-03-11","year":2026,"title":"AI-Generated Deepfake of Jean Reno Used in Major Investment Scam in Lyon","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-f421"},{"id":"INC-00691","date":"2026-03-11","year":2026,"title":"Biased AI Autocomplete Tools Subtly Shift Users' Opinions on Societal Issues","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-f7c2"},{"id":"INC-00975","date":"2026-03-11","year":2026,"title":"Experts Warn AI Chatbots May Homogenize Human Thought and Reduce Creativity","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-fcd8"},{"id":"INC-00559","date":"2026-03-11","year":2026,"title":"AI-Powered Toys Cause Emotional Harm to Young Children Due to Misinterpretation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-11-fd6a"},{"id":"INC-01965","date":"2026-03-12","year":2026,"title":"Ukraine Shares Battlefield Data to Train Military AI Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-07b5"},{"id":"INC-00450","date":"2026-03-12","year":2026,"title":"AI-Generated Fake Injury Used in Attempted Nail Salon Fraud in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-0f2c"},{"id":"INC-00127","date":"2026-03-12","year":2026,"title":"AI Chatbots Spread Dangerous Medical Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-0f9c"},{"id":"INC-00580","date":"2026-03-12","year":2026,"title":"Amazon Prime Air Exits Drone Alliance Over AI Safety Dispute","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-12d3"},{"id":"INC-01966","date":"2026-03-12","year":2026,"title":"Ukrainian AI-Enabled Military Drone Production Expands Across Europe","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-19ea"},{"id":"INC-01663","date":"2026-03-12","year":2026,"title":"Potential Developmental Risks of AI Exposure for Young Children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-1f85"},{"id":"INC-01226","date":"2026-03-12","year":2026,"title":"India Unveils AI-Driven Military Modernization Plan for 2047","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-2531"},{"id":"INC-00123","date":"2026-03-12","year":2026,"title":"AI Chatbots Provide Harmful Diet Plans to Teenagers, Study Finds","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-2cfd"},{"id":"INC-00122","date":"2026-03-12","year":2026,"title":"AI Chatbots Provide Biased Voting Advice, Neglecting Local Parties in Dutch Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-3f6e"},{"id":"INC-01618","date":"2026-03-12","year":2026,"title":"Palantir AI Systems Used in Middle East Military Operations and Israeli Conflict Response","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-4eb7"},{"id":"INC-01261","date":"2026-03-12","year":2026,"title":"Italy to Test AI-Enabled Michelangelo Air Defense System in Ukraine","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-9d40"},{"id":"INC-00579","date":"2026-03-12","year":2026,"title":"Amazon Faces Trial in Italy Over AI Algorithm's Role in Massive VAT Evasion","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-9ffb"},{"id":"INC-00174","date":"2026-03-12","year":2026,"title":"AI Investment Agents Trigger Security Concerns in Chinese Financial Sector","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-a01e"},{"id":"INC-00155","date":"2026-03-12","year":2026,"title":"AI Deepfakes Drive $333 Million Crypto ATM Fraud Surge in the US","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-c3e3"},{"id":"INC-01430","date":"2026-03-12","year":2026,"title":"Microsoft and Tech Giants Launch AI Health Chatbots, Raising Privacy and Safety Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-c5f8"},{"id":"INC-02095","date":"2026-03-12","year":2026,"title":"Widespread AI Adoption Leads to Security Breaches and Exploitation","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-db65"},{"id":"INC-00372","date":"2026-03-12","year":2026,"title":"AI-Generated Content Causes Consumer Harm and Legal Action in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-f0c2"},{"id":"INC-00281","date":"2026-03-12","year":2026,"title":"AI-Driven Cyberattacks Escalate in Indonesia, Causing Increased Harm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-f5a3"},{"id":"INC-01950","date":"2026-03-12","year":2026,"title":"UK Regulators Pressure Social Media Platforms to Strengthen AI-Driven Child Safety Measures","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-12-f879"},{"id":"INC-00083","date":"2026-03-13","year":2026,"title":"AI Automation Drives Job Losses Among Young Professionals","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-0096"},{"id":"INC-00464","date":"2026-03-13","year":2026,"title":"AI-Generated Fake References Lead to Academic Misconduct in Taiwanese Doctoral Thesis","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-07ad"},{"id":"INC-01323","date":"2026-03-13","year":2026,"title":"Leonardo and Baykar Develop AI-Enabled Military Drones for European Market","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-13ec"},{"id":"INC-00505","date":"2026-03-13","year":2026,"title":"AI-Generated Slopoly Malware Used in Hive0163 Ransomware Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-1b37"},{"id":"INC-00163","date":"2026-03-13","year":2026,"title":"AI Ethical Filters Disrupt Pentagon Military Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-2bce"},{"id":"INC-14725","date":"2026-03-13","year":2026,"title":"Hanwha Aerospace and Krafton Partner to Develop Physical AI for Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-32a4"},{"id":"INC-01066","date":"2026-03-13","year":2026,"title":"Generative AI Data Poisoning Leads to Misinformation and Consumer Harm in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-6d94"},{"id":"INC-00571","date":"2026-03-13","year":2026,"title":"Airbus Equips AI-Enabled Valkyrie Combat Drones for German Air Force","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-710a"},{"id":"INC-01410","date":"2026-03-13","year":2026,"title":"Meta Removes End-to-End Encryption from Instagram Messages, Raising Privacy Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-8bfc"},{"id":"INC-00796","date":"2026-03-13","year":2026,"title":"Chinese Police Crack Down on AI-Generated Misinformation Online","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-95cb"},{"id":"INC-01174","date":"2026-03-13","year":2026,"title":"Hyundai Recalls Palisade SUVs After AI Power Seat Malfunction Causes Child's Death","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-9d14"},{"id":"INC-01899","date":"2026-03-13","year":2026,"title":"Theft of AI-Enabled Military Drones Sparks Security Fears in the US","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-ac86"},{"id":"INC-00887","date":"2026-03-13","year":2026,"title":"Deployment of AI-Powered Humanoid Soldier Robots in Ukraine","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-b5ca"},{"id":"INC-01177","date":"2026-03-13","year":2026,"title":"ICE Agents Use AI Surveillance Apps and Quotas, Leading to Unlawful Arrests in Oregon","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-c749"},{"id":"INC-01267","date":"2026-03-13","year":2026,"title":"Japan Plans to Join US AI-Enabled Missile Defense System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-d39c"},{"id":"INC-00598","date":"2026-03-13","year":2026,"title":"Anthropic and OpenAI Hire Weapons Experts to Prevent AI Misuse in Weapon Creation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-d40b"},{"id":"INC-01733","date":"2026-03-13","year":2026,"title":"Researchers Call for Stricter Regulation of AI-Powered Children's Toys","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-ddaa"},{"id":"INC-00088","date":"2026-03-13","year":2026,"title":"AI Bots Force Digg to Shut Down Open Beta and Downsize Team","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-df6f"},{"id":"INC-01168","date":"2026-03-13","year":2026,"title":"Humanoid Robot Causes Psychological Distress Leading to Police Intervention in Macau","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-e349"},{"id":"INC-14726","date":"2026-03-13","year":2026,"title":"AI-Driven Military Targeting Causes Mass Casualties in Middle East Conflicts","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-13-f240"},{"id":"INC-01426","date":"2026-03-14","year":2026,"title":"Mexico City Airport to Deploy AI-Powered Anti-Drone System for 2026 World Cup","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-21b6"},{"id":"INC-01918","date":"2026-03-14","year":2026,"title":"Turkey Highlights Strategic Importance of AI-Enabled Military Drones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-41e7"},{"id":"INC-01920","date":"2026-03-14","year":2026,"title":"Turkey Unveils AI-Enabled K2 Kamikaze Drone with Autonomous Swarm Capabilities","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-4367"},{"id":"INC-00115","date":"2026-03-14","year":2026,"title":"AI Chatbots Linked to Reinforcing Delusional Thinking in Vulnerable Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-5b1e"},{"id":"INC-14727","date":"2026-03-14","year":2026,"title":"Controversy Over Proposed AI Replacement of Crowd Actors in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-793b"},{"id":"INC-02075","date":"2026-03-14","year":2026,"title":"Waymo Robotaxi AI Leaves Passengers Trapped During Vehicle Attacks in San Francisco","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-7c06"},{"id":"INC-01083","date":"2026-03-14","year":2026,"title":"German Voice Actors Protest AI Use of Their Voices Without Consent","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-88b9"},{"id":"INC-00156","date":"2026-03-14","year":2026,"title":"AI Deepfakes Used in Financial Fraud Targeting Investors in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-c8bf"},{"id":"INC-14219","date":"2026-03-14","year":2026,"title":"AI Data Poisoning via GEO Manipulates Recommendations and Misleads Consumers in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-e431"},{"id":"INC-01989","date":"2026-03-14","year":2026,"title":"US Army Signs $20B AI-Enabled Defense Contract with Anduril","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-14-fb05"},{"id":"INC-00611","date":"2026-03-15","year":2026,"title":"Anthropic's AI Claude Used in US Military Operation Sparks Ethical Standoff","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-0d45"},{"id":"INC-01325","date":"2026-03-15","year":2026,"title":"Li Auto MEGA Electric Vehicle Battery Recall Due to AI-Related Safety Risk","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-2f4e"},{"id":"INC-01970","date":"2026-03-15","year":2026,"title":"UN Warns AI-Driven Online Fraud Surges Globally, Overwhelming States","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-4c82"},{"id":"INC-00653","date":"2026-03-15","year":2026,"title":"Australian Regulator Warns Gen Z on Risks of AI-Driven Financial Advice","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-68a7"},{"id":"INC-01392","date":"2026-03-15","year":2026,"title":"Medellín Builds AI-Driven Security Center with Drone Port","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-6bfc"},{"id":"INC-00515","date":"2026-03-15","year":2026,"title":"AI-Generated Visual Disinformation Undermines Societal Trust","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-707c"},{"id":"INC-01236","date":"2026-03-15","year":2026,"title":"Indonesia Implements AI and Social Media Restrictions for Children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-8fdf"},{"id":"INC-00935","date":"2026-03-15","year":2026,"title":"Emotional Distress Among Chinese Users Following Shutdown of AI Companion Apps","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-a39b"},{"id":"INC-01593","date":"2026-03-15","year":2026,"title":"OpenClaw AI Agents Cause Data Breaches and Mass Layoffs in China","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-aff8"},{"id":"INC-00484","date":"2026-03-15","year":2026,"title":"AI-Generated Misinformation and Content Manipulation Spark Regulatory Crackdown in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-c7dc"},{"id":"INC-00509","date":"2026-03-15","year":2026,"title":"AI-Generated Videos Cause Misinformation and Legal Violations in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-f2a9"},{"id":"INC-00656","date":"2026-03-15","year":2026,"title":"Australian Techie Uses AI to Develop Cancer Vaccine for Dog","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-15-f424"},{"id":"INC-14728","date":"2026-03-16","year":2026,"title":"AI System Deployed in Hwaseong to Prevent Social Isolation and Solitary Deaths","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-04e5"},{"id":"INC-00403","date":"2026-03-16","year":2026,"title":"AI-Generated Deepfake Videos Target Indian Army and Officials Amid Disinformation Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-0841"},{"id":"INC-01814","date":"2026-03-16","year":2026,"title":"Students Use AI to Create and Circulate Nude Images of Classmates and Teachers in Crete","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-1e5c"},{"id":"INC-01619","date":"2026-03-16","year":2026,"title":"Palantir AI Systems Used in Military Operations Cause Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-21e7"},{"id":"INC-14729","date":"2026-03-16","year":2026,"title":"Meta's AI Content Moderation Failures Fuel Violence in Bangladesh","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-2713"},{"id":"INC-00353","date":"2026-03-16","year":2026,"title":"AI-Enabled Russian Lancet Drone Crashes in Central Kyiv","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-4347"},{"id":"INC-00114","date":"2026-03-16","year":2026,"title":"AI Chatbots Linked to Psychological Harm and Suicide","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-4b33"},{"id":"INC-00797","date":"2026-03-16","year":2026,"title":"Chinese Voice Actors Protest AI Voice Cloning, Content Creators Remove Infringing Videos","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-4ccf"},{"id":"INC-00398","date":"2026-03-16","year":2026,"title":"AI-Generated Deepfake Video of Shakira Used in Cryptocurrency Scam in Colombia","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-4dea"},{"id":"INC-00786","date":"2026-03-16","year":2026,"title":"Chinese AI Security Firm Leaks SSL Private Key in OpenClaw-Based Product","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-569f"},{"id":"INC-00406","date":"2026-03-16","year":2026,"title":"AI-Generated Deepfake Videos Used for Large-Scale Identity Fraud in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-56f6"},{"id":"INC-00939","date":"2026-03-16","year":2026,"title":"Encyclopedia Britannica Sues OpenAI for Unauthorized Use of Copyrighted Content in AI Training","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-5720"},{"id":"INC-01832","date":"2026-03-16","year":2026,"title":"Suspected AI-Generated Video of Israeli PM Netanyahu Sparks Misinformation Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-5a13"},{"id":"INC-00468","date":"2026-03-16","year":2026,"title":"AI-Generated Fake Suspect Photos Cause Public Confusion and Risk in Jakarta Acid Attack Case","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-5f73"},{"id":"INC-00416","date":"2026-03-16","year":2026,"title":"AI-Generated Deepfakes Cause Misinformation and Erode Public Trust","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-635b"},{"id":"INC-00084","date":"2026-03-16","year":2026,"title":"AI Automation Poses Disproportionate Job Risk to Women in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-6b87"},{"id":"INC-00508","date":"2026-03-16","year":2026,"title":"AI-Generated Video Falsely Links Politicians to Crime, Sparks Legal Action in Brazil","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-7a3e"},{"id":"INC-01931","date":"2026-03-16","year":2026,"title":"Uber and Nvidia Announce Global Robotaxi Rollout Using AI","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-7ccc"},{"id":"INC-00490","date":"2026-03-16","year":2026,"title":"AI-Generated Parcel Scam Causes Financial Harm in France","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-8147"},{"id":"INC-01058","date":"2026-03-16","year":2026,"title":"Gartner Warns of AI Misconfiguration Risks to Critical Infrastructure by 2028","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-865f"},{"id":"INC-14730","date":"2026-03-16","year":2026,"title":"Hong Kong Privacy Commissioner Warns of Agentic AI Privacy and Security Risks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-94aa"},{"id":"INC-00462","date":"2026-03-16","year":2026,"title":"AI-Generated Fake Pregnancy Image Causes Harm to João Gomes' Family","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-a4aa"},{"id":"INC-14731","date":"2026-03-16","year":2026,"title":"OpenAI Faces Backlash Over ChatGPT 'Adult Mode' Amid Mental Health and Safety Concerns","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-a965"},{"id":"INC-02092","date":"2026-03-16","year":2026,"title":"Whistleblowers Expose Meta and TikTok's AI Algorithms Amplifying Harmful Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-b773"},{"id":"INC-00197","date":"2026-03-16","year":2026,"title":"AI Raises Concerns Over Algorithmic Collusion and Market Entry Barriers in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-b9cf"},{"id":"INC-01322","date":"2026-03-16","year":2026,"title":"Legislative Action Against AI-Driven Surveillance Pricing in Grocery Stores","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-c177"},{"id":"INC-00249","date":"2026-03-16","year":2026,"title":"AI Unmanned Inspection Vehicle in Keelung Raises Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-c7c2"},{"id":"INC-01913","date":"2026-03-16","year":2026,"title":"Trump Accuses Iran of Using AI for Disinformation During Wartime","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-e19f"},{"id":"INC-14220","date":"2026-03-16","year":2026,"title":"Minors Sue xAI Over Grok's Generation of Sexualized Images","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-ea09"},{"id":"INC-00089","date":"2026-03-16","year":2026,"title":"AI Brain-Computer Interface Restores Communication for Paralyzed Patients","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-f051"},{"id":"INC-00654","date":"2026-03-16","year":2026,"title":"Australian Regulator Warns of AI-Generated Child Abuse Material on X","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-f43b"},{"id":"INC-01869","date":"2026-03-16","year":2026,"title":"Tesla Robotaxi AI System Involved in Multiple Low-Speed Crashes","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-f969"},{"id":"INC-14732","date":"2026-03-16","year":2026,"title":"AI Deepfake Video Falsely Portrays Tony Elumelu Endorsing Crypto Platform","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-facc"},{"id":"INC-00093","date":"2026-03-16","year":2026,"title":"AI Chat Apps Expose Minors to Inappropriate Content in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-fd8b"},{"id":"INC-01121","date":"2026-03-16","year":2026,"title":"Google Shuts Down AI Health Advice Feature Amid Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-16-feff"},{"id":"INC-00471","date":"2026-03-17","year":2026,"title":"AI-Generated Fake Wedding Photos of Zendaya and Tom Holland Cause Public Confusion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-044a"},{"id":"INC-01963","date":"2026-03-17","year":2026,"title":"Ukraine Launches Defense AI Center with UK Support for Military Innovation","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-0a99"},{"id":"INC-00132","date":"2026-03-17","year":2026,"title":"AI Coding Assistants Drive Surge in Secret Leaks on GitHub","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-2273"},{"id":"INC-00539","date":"2026-03-17","year":2026,"title":"AI-Powered Cyberwarfare Attacks Impact Australia and UK","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-28a5"},{"id":"INC-00271","date":"2026-03-17","year":2026,"title":"AI-Driven Autonomous Trucks Tested on U.S. Highways Raise Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-447e"},{"id":"INC-01518","date":"2026-03-17","year":2026,"title":"NATO Orders AI-Enabled Parrot Micro-Drones for Military Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-53c6"},{"id":"INC-00201","date":"2026-03-17","year":2026,"title":"AI Search Engines Cause Major Publisher Traffic Loss","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-6bfc"},{"id":"INC-02014","date":"2026-03-17","year":2026,"title":"US Lawmakers Warn of Security Risks from Chinese AI Robotics","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-91b2"},{"id":"INC-01013","date":"2026-03-17","year":2026,"title":"Florida Man Arrested for Possessing and Producing AI-Generated Child Sexual Abuse Material","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-9609"},{"id":"INC-00381","date":"2026-03-17","year":2026,"title":"AI-Generated Deepfake Nudes of 18 Minors Spark Investigation in Almería","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-a877"},{"id":"INC-01318","date":"2026-03-17","year":2026,"title":"Lawyer Sanctioned for Submitting AI-Generated Fake Legal Precedents in Siracusa Court","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-aa52"},{"id":"INC-00542","date":"2026-03-17","year":2026,"title":"AI-Powered Editing Tools Drive Surge in Insurance Fraud in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-b5e9"},{"id":"INC-01938","date":"2026-03-17","year":2026,"title":"UK and Ukraine Deepen AI-Driven Defense Partnership with Drone Production","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-d3c6"},{"id":"INC-00165","date":"2026-03-17","year":2026,"title":"AI Facial Recognition in Sao Paulo Leads to Mistaken Arrests","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-def2"},{"id":"INC-00916","date":"2026-03-17","year":2026,"title":"Dutch Fraudster Uses Deepfake AI to Open Dozens of Bank Accounts","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-e859"},{"id":"INC-00962","date":"2026-03-17","year":2026,"title":"EU Legal Deadlock Reduces AI Detection of Child Abuse Online","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-eef7"},{"id":"INC-02114","date":"2026-03-17","year":2026,"title":"ZenaTech Develops Autonomous Interceptor Drone for Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-f327"},{"id":"INC-01114","date":"2026-03-17","year":2026,"title":"Google Gemini AI Accused of Political Bias in Hate Speech Moderation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-f810"},{"id":"INC-14733","date":"2026-03-17","year":2026,"title":"Zelensky Warns Europe of AI-Enabled Drone Threats","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-fbfc"},{"id":"INC-00963","date":"2026-03-17","year":2026,"title":"EU Report Reveals China's Use of AI for Disinformation and Harassment","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-17-fce7"},{"id":"INC-00934","date":"2026-03-18","year":2026,"title":"Emergent Deceptive Behaviors in Autonomous AI Raise Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-04fc"},{"id":"INC-01349","date":"2026-03-18","year":2026,"title":"LLM-Driven Attack Compromises AWS Administrator Privileges in 8 Minutes","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-0953"},{"id":"INC-00234","date":"2026-03-18","year":2026,"title":"AI Threatens Up to 5 Million Jobs in France Within Five Years","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-2a80"},{"id":"INC-00226","date":"2026-03-18","year":2026,"title":"AI Systems Drive US Military Operations in Middle East Conflict","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-325b"},{"id":"INC-00760","date":"2026-03-18","year":2026,"title":"Chicken Soup for the Soul Publisher Sues Tech Giants Over AI Copyright Infringement","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-47ca"},{"id":"INC-00979","date":"2026-03-18","year":2026,"title":"Facebook's AI Moderation Restricts Orbán Viktor's Posts Before Elections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-486c"},{"id":"INC-00943","date":"2026-03-18","year":2026,"title":"Essex Police Suspends Live Facial Recognition Over Racial Bias","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-4acf"},{"id":"INC-00085","date":"2026-03-18","year":2026,"title":"AI Automation Threatens Entry-Level Job Market for Gen Z Graduates","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-5219"},{"id":"INC-01811","date":"2026-03-18","year":2026,"title":"Student Faces Trial for AI-Generated Sexual Images of Schoolmates in Córdoba","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-64a4"},{"id":"INC-14734","date":"2026-03-18","year":2026,"title":"South Korea Plans AI-Based National Emergency Response System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-6b02"},{"id":"INC-00480","date":"2026-03-18","year":2026,"title":"AI-Generated Legal Documents Cause Harm in Fraudulent Online Law Firms in China","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-6ff5"},{"id":"INC-00808","date":"2026-03-18","year":2026,"title":"Claude AI Vulnerabilities Enable Silent Data Theft and Malicious Redirects","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-74b1"},{"id":"INC-01784","date":"2026-03-18","year":2026,"title":"Sony Removes 135,000 AI-Generated Deepfake Songs Impersonating Artists","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-7b65"},{"id":"INC-01361","date":"2026-03-18","year":2026,"title":"Majority of U.S. Teens Use AI to Create Sexualized Images, Study Finds","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-8204"},{"id":"INC-01632","date":"2026-03-18","year":2026,"title":"Pentagon Flags National Security Risks Over Anthropic's Foreign AI Workers","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-8845"},{"id":"INC-00202","date":"2026-03-18","year":2026,"title":"AI Service Robot Malfunctions, Causes Chaos in California Restaurant","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-9195"},{"id":"INC-01949","date":"2026-03-18","year":2026,"title":"UK Regulator Bans AI App Ad for Promoting Non-Consensual Nudification","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-bb68"},{"id":"INC-14735","date":"2026-03-18","year":2026,"title":"AI Training Scams Targeting Elderly and Young Consumers in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-c1f8"},{"id":"INC-00872","date":"2026-03-18","year":2026,"title":"Dancing Robot Malfunctions in California Restaurant; Robot Startles Elderly Woman in Macau","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-ca35"},{"id":"INC-00364","date":"2026-03-18","year":2026,"title":"AI-Generated Actors Spark Portrait Rights Controversy in China","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-d0a3"},{"id":"INC-00474","date":"2026-03-18","year":2026,"title":"AI-Generated Fraudulent Messages Target Citizens Ahead of Holiday","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-d427"},{"id":"INC-01655","date":"2026-03-18","year":2026,"title":"Polish Institutions Collaborate on AI-Enabled Autonomous Underwater Drones for Dual-Use Applications","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-dc59"},{"id":"INC-00200","date":"2026-03-18","year":2026,"title":"AI Robot Malfunctions and Causes Chaos in San Jose Restaurant","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-dd26"},{"id":"INC-00193","date":"2026-03-18","year":2026,"title":"AI Pilot Program Assists Judges in Los Angeles County Courts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-e599"},{"id":"INC-01444","date":"2026-03-18","year":2026,"title":"Military Use of AI Sparks International Concerns and Ethical Disputes","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-e60b"},{"id":"INC-01861","date":"2026-03-18","year":2026,"title":"Tesla FSD Accident Highlights Risks of Autonomous Driving","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-ea71"},{"id":"INC-00699","date":"2026-03-18","year":2026,"title":"BMG Sues Anthropic Over AI Training With Copyrighted Song Lyrics","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-18-eb49"},{"id":"INC-02029","date":"2026-03-19","year":2026,"title":"US Regulators Probe Tesla FSD After Collisions Linked to AI System Failures","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-1d35"},{"id":"INC-01854","date":"2026-03-19","year":2026,"title":"Tesla and Waymo Robotaxis Involved in Multiple Crashes and Disruptions in U.S. Cities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-3161"},{"id":"INC-00589","date":"2026-03-19","year":2026,"title":"Anduril Launches Production of AI-Powered Combat Drones in Ohio","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-3d12"},{"id":"INC-00130","date":"2026-03-19","year":2026,"title":"AI Clinical Decision Support System Reduces Vascular Events in Stroke Patients","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-4b62"},{"id":"INC-00836","date":"2026-03-19","year":2026,"title":"Cloudflare CEO Predicts AI Bots Will Surpass Human Web Traffic by 2027","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-6a0f"},{"id":"INC-01165","date":"2026-03-19","year":2026,"title":"HSBC Plans Massive Job Cuts Driven by AI Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-6fe6"},{"id":"INC-01765","date":"2026-03-19","year":2026,"title":"Senior Journalist Suspended for Publishing AI-Generated Fake Quotes","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-7b5e"},{"id":"INC-00346","date":"2026-03-19","year":2026,"title":"AI-Enabled Financial Scams Cause €20 Million Losses in Croatia, Targeting Youth","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-8335"},{"id":"INC-01991","date":"2026-03-19","year":2026,"title":"US Cities Push Back Against AI License Plate Reader Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-8f5e"},{"id":"INC-00851","date":"2026-03-19","year":2026,"title":"Concerns Over AI-Driven Content Moderation in Hungarian Elections","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-c296"},{"id":"INC-00359","date":"2026-03-19","year":2026,"title":"AI-Enabled Wi-Fi Signal Analysis Raises Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-c62a"},{"id":"INC-01395","date":"2026-03-19","year":2026,"title":"Meta AI Agent Causes Data Exposure and Deletion; Widespread Job Losses Loom Due to AI Adoption","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-d3bd"},{"id":"INC-01932","date":"2026-03-19","year":2026,"title":"Uber and Rivian Announce Major Investment in Autonomous Robotaxi Fleet","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-db15"},{"id":"INC-00153","date":"2026-03-19","year":2026,"title":"AI Deepfake Videos Victimize Students, Prompt Calls for State Action in Pennsylvania","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-f438"},{"id":"INC-01232","date":"2026-03-19","year":2026,"title":"Indian Cricketer Gautam Gambhir Files Lawsuit Over AI Deepfakes and Identity Misuse","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-19-f82e"},{"id":"INC-01840","date":"2026-03-20","year":2026,"title":"Tech Companies Propose Massive AI Data Centers in Space, Raising Future Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-160d"},{"id":"INC-00052","date":"2026-03-20","year":2026,"title":"Agentic AI Empowers Solo Cybercriminals to Rapidly Develop Advanced Malware","severity":"Medium","attack_vector":"malware","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-27d6"},{"id":"INC-00391","date":"2026-03-20","year":2026,"title":"AI-Generated Deepfake Video Causes Misinformation and Reputational Harm to Indonesian Actor","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-48c2"},{"id":"INC-01807","date":"2026-03-20","year":2026,"title":"Stanford Study Finds AI Chatbots Encouraged Self-Harm and Reinforced Delusions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-5a5f"},{"id":"INC-01749","date":"2026-03-20","year":2026,"title":"Russia Proposes Sweeping Regulations to Restrict Foreign AI Tools","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-8734"},{"id":"INC-00220","date":"2026-03-20","year":2026,"title":"AI System Leaks Unpublished Academic Work, Causes Citation Scandal in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-8741"},{"id":"INC-00181","date":"2026-03-20","year":2026,"title":"AI Misuse and Fraud Prevention in China's Financial and Social Platforms","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-88eb"},{"id":"INC-14736","date":"2026-03-20","year":2026,"title":"AI-Driven Romance and Deepfake Scams Cause Financial and Emotional Harm in Taiwan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-88f5"},{"id":"INC-01988","date":"2026-03-20","year":2026,"title":"US Army Receives First Autonomous-Ready Black Hawk Helicopter","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-8ae4"},{"id":"INC-01128","date":"2026-03-20","year":2026,"title":"Google's AI-Generated Headlines in Search Results Spark Misinformation Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-9231"},{"id":"INC-01397","date":"2026-03-20","year":2026,"title":"Meta AI Agents Cause Security Incidents Amid Workforce Shift","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-d6c8"},{"id":"INC-01367","date":"2026-03-20","year":2026,"title":"Man Arrested in Albacete for Using AI to Create Fake Nude Image of Minor and Threatening Her","severity":"High","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-dd1f"},{"id":"INC-01422","date":"2026-03-20","year":2026,"title":"Meta's Smart Glasses Spark Privacy Concerns Over AI Facial Recognition","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-e079"},{"id":"INC-01093","date":"2026-03-20","year":2026,"title":"Global Expansion and Deployment of Robotaxi AI Systems Raises Safety and Geopolitical Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-ec2f"},{"id":"INC-00291","date":"2026-03-20","year":2026,"title":"AI-Driven Disinformation Campaigns Target Ukraine and Europe","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-20-fc00"},{"id":"INC-01366","date":"2026-03-21","year":2026,"title":"Man Arrested for Posting AI-Generated Defamatory Images of Indian PM","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-1cda"},{"id":"INC-00275","date":"2026-03-21","year":2026,"title":"AI-Driven Cyberattack Threatens Global Satellite Infrastructure","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-2c77"},{"id":"INC-01801","date":"2026-03-21","year":2026,"title":"Spotify Launches Artist Profile Protection to Combat AI-Generated Music Misattribution","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-2e37"},{"id":"INC-00738","date":"2026-03-21","year":2026,"title":"Chacao Deploys AI-Powered Robotic Dogs for Public Security Patrols","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-4306"},{"id":"INC-01833","date":"2026-03-21","year":2026,"title":"Suspected Terrorist Attack Targets Czech AI Drone Factory Supplying Ukraine","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-48eb"},{"id":"INC-01736","date":"2026-03-21","year":2026,"title":"Restaurant Service Robots Cause Disruption and Safety Concerns in Texas and California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-5e30"},{"id":"INC-01078","date":"2026-03-21","year":2026,"title":"German Digital Minister Warns of Major Job Losses Due to AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-6e9a"},{"id":"INC-00748","date":"2026-03-21","year":2026,"title":"ChatGPT Flags Republican Fundraising Links as Unsafe, Raising Bias Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-8b2e"},{"id":"INC-00269","date":"2026-03-21","year":2026,"title":"AI-Driven 3D Modeling Reduces Risks in Cerebral Aneurysm Treatment at San Camillo Hospital","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-a1e5"},{"id":"INC-01278","date":"2026-03-21","year":2026,"title":"Kaiser Permanente Therapists Strike Over AI Screening System Delays and Patient Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-ac3c"},{"id":"INC-00591","date":"2026-03-21","year":2026,"title":"Anduril's AI System Deployed in Middle East Conflict for Drone Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-21-e58e"},{"id":"INC-01591","date":"2026-03-22","year":2026,"title":"OpenClaw AI Agent Raises Cybersecurity Concerns in Taiwan","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-1bde"},{"id":"INC-01904","date":"2026-03-22","year":2026,"title":"TikTok and Instagram Ban Accounts for Unlabeled, Exploitative AI-Generated Black Female Avatars","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-3fa6"},{"id":"INC-14737","date":"2026-03-22","year":2026,"title":"Chinese Voice Actor's AI Voice Cloning Sparks Legal Action and Industry Outcry","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-52dc"},{"id":"INC-00305","date":"2026-03-22","year":2026,"title":"AI-Driven Internet Fraud Surges in Germany, Exploiting Language Barriers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-5a0f"},{"id":"INC-00064","date":"2026-03-22","year":2026,"title":"AI Adoption Outpaces Cybersecurity in Bosnia and Herzegovina, Leading to Increased Cyberattack Risks","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-625f"},{"id":"INC-00336","date":"2026-03-22","year":2026,"title":"AI-Enabled Drone Countermeasure Systems Developed and Deployed in Taiwan","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-955e"},{"id":"INC-14738","date":"2026-03-22","year":2026,"title":"Critical AI System Vulnerabilities in OpenClaw and Langflow Lead to Security Risks and Exploitation","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-c708"},{"id":"INC-00876","date":"2026-03-22","year":2026,"title":"Delhi High Court Addresses Deepfake Misuse Against Patanjali Co-Founder","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-e28c"},{"id":"INC-00473","date":"2026-03-22","year":2026,"title":"AI-Generated Film Poster Sparks Outrage Among Sikh Community in Mumbai","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-ee08"},{"id":"INC-00614","date":"2026-03-22","year":2026,"title":"Anthropic's Claude AI Introduces Remote Computer Control and Risk-Aware Automation Features","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-22-fbc7"},{"id":"INC-00133","date":"2026-03-23","year":2026,"title":"AI Companion Chatbots Expose Australian Children to Harmful Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-1695"},{"id":"INC-00885","date":"2026-03-23","year":2026,"title":"Denver and Longmont Face Backlash Over AI-Powered License Plate Readers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-1b97"},{"id":"INC-00148","date":"2026-03-23","year":2026,"title":"AI Deepfake Scams Target Chinese Celebrities, Prompt Calls for Regulation","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-249e"},{"id":"INC-01098","date":"2026-03-23","year":2026,"title":"GM Begins Supervised Testing of Next-Gen Autonomous Vehicles in Michigan and California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-24ce"},{"id":"INC-00183","date":"2026-03-23","year":2026,"title":"AI Misuse Leads to Disinformation and Mental Health Risks in Azerbaijan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-34ab"},{"id":"INC-14739","date":"2026-03-23","year":2026,"title":"Chinese AI-Generated YouTube Channels Spread Propaganda in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-4424"},{"id":"INC-01169","date":"2026-03-23","year":2026,"title":"Humanoid Robot Injures Child During Dance Performance in Shaanxi","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-4a38"},{"id":"INC-00666","date":"2026-03-23","year":2026,"title":"Autonomous Drone Swarms Transform Modern Warfare, Raising AI Risk Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-5a61"},{"id":"INC-00097","date":"2026-03-23","year":2026,"title":"AI Chatbot Generates Millions of Non-Consensual Deepfake Images, Triggering Global Privacy Concerns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-6a8b"},{"id":"INC-00143","date":"2026-03-23","year":2026,"title":"AI Deepfake and Facial Recognition Misuse Raise Privacy and Fraud Concerns in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-6ecb"},{"id":"INC-00905","date":"2026-03-23","year":2026,"title":"Doctors Warn of Risks from AI Self-Treatment for Musculoskeletal Pain in Spain","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-7ec9"},{"id":"INC-00389","date":"2026-03-23","year":2026,"title":"AI-Generated Deepfake Targets Slovenian Politicians, Prompting Legal Action Consideration","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-9720"},{"id":"INC-01758","date":"2026-03-23","year":2026,"title":"Security Flaw in Anthropic's Claude AI Extension Exposes Users to Browser Attacks","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-9ef5"},{"id":"INC-14740","date":"2026-03-23","year":2026,"title":"Nigeria's $470 Million Investment in AI Surveillance Raises Privacy and Human Rights Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-a691"},{"id":"INC-00665","date":"2026-03-23","year":2026,"title":"Autonomous Delivery Robots Crash Into Bus Shelters, Causing Property Damage","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-b17c"},{"id":"INC-00966","date":"2026-03-23","year":2026,"title":"European Companies Face AI Governance Gaps Amid Rapid Adoption","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-bac6"},{"id":"INC-01433","date":"2026-03-23","year":2026,"title":"Microsoft Copilot AI Exposes Sensitive Data During Low Supervision Periods","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-c81c"},{"id":"INC-00358","date":"2026-03-23","year":2026,"title":"AI-Enabled Underwater Drones Cause Maritime Harm, Prompt US-UK Defense Initiative","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-d03a"},{"id":"INC-00458","date":"2026-03-23","year":2026,"title":"AI-Generated Fake Personas Drive Viral Crypto Scams on X","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-d7db"},{"id":"INC-01846","date":"2026-03-23","year":2026,"title":"Teens Sentenced for AI-Generated Fake Nude Images of Classmates in Pennsylvania","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-e7a4"},{"id":"INC-00880","date":"2026-03-23","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfakes Misusing Sonakshi Sinha's Persona","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-fbfd"},{"id":"INC-01859","date":"2026-03-23","year":2026,"title":"Tesla Driver Caught Asleep While Using Self-Driving Mode in Rainy Rush Hour","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-23-ff4b"},{"id":"INC-00412","date":"2026-03-24","year":2026,"title":"AI-Generated Deepfake X-Rays Deceive Radiologists and AI Systems","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-0266"},{"id":"INC-01778","date":"2026-03-24","year":2026,"title":"Slovak Central Bank Warns of AI-Generated Fraudulent Crypto Websites","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-0d9f"},{"id":"INC-01610","date":"2026-03-24","year":2026,"title":"Oregon Attorney Fined for Submitting AI-Fabricated Legal Brief","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-3e15"},{"id":"INC-00453","date":"2026-03-24","year":2026,"title":"AI-Generated Fake Law Enforcement Used in Romanian Influence Campaign","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-3f76"},{"id":"INC-01941","date":"2026-03-24","year":2026,"title":"UK Cyber Agency Warns of Security Risks from AI-Generated Code","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-51a2"},{"id":"INC-02079","date":"2026-03-24","year":2026,"title":"Waymo Robotaxi Malfunctions Cause Traffic Disruptions and Emergency Response Interventions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-5b2c"},{"id":"INC-00675","date":"2026-03-24","year":2026,"title":"Baltimore Sues Elon Musk's xAI Over Grok Deepfake Harms","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-9cf2"},{"id":"INC-00182","date":"2026-03-24","year":2026,"title":"AI Misuse Drives Surge in Child Sexual Abuse Content Online","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-a72a"},{"id":"INC-01254","date":"2026-03-24","year":2026,"title":"Israeli Brothers Used AI to Fabricate Military Intelligence for Iranian Agent","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-a788"},{"id":"INC-01263","date":"2026-03-24","year":2026,"title":"IXOPAY and Zip Launch Framework to Address AI Risks in Agentic Commerce","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-ac82"},{"id":"INC-00167","date":"2026-03-24","year":2026,"title":"AI Firms Develop Software for US Golden Dome Missile Defense System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-b540"},{"id":"INC-00046","date":"2026-03-24","year":2026,"title":"AeroVironment Launches AI-Enabled LOCUST X3 Directed Energy Weapon","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-b899"},{"id":"INC-01860","date":"2026-03-24","year":2026,"title":"Tesla Faces Legal Action Over Misleading Full Self-Driving AI Sales in Australia","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-bf24"},{"id":"INC-00400","date":"2026-03-24","year":2026,"title":"AI-Generated Deepfake Videos Cause Public Misinformation in Montenegro Fugitive Case","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-c0ad"},{"id":"INC-00218","date":"2026-03-24","year":2026,"title":"AI System Enables Real-Time Vehicle Seizure for Unpaid Taxes in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-c852"},{"id":"INC-01364","date":"2026-03-24","year":2026,"title":"Malicious LiteLLM PyPI Package Compromises AI Developer Systems","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-ca8f"},{"id":"INC-00941","date":"2026-03-24","year":2026,"title":"Epirus, General Dynamics, and Kodiak AI Unveil Autonomous Counter-Drone Weapon System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-d02a"},{"id":"INC-00721","date":"2026-03-24","year":2026,"title":"BYD's 'God's Eye' AI Driver-Assist System Causes Dangerous Malfunctions in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-d568"},{"id":"INC-01039","date":"2026-03-24","year":2026,"title":"Ford Recalls 254,640 SUVs in US Over AI-Driven Safety Feature Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-e976"},{"id":"INC-01469","date":"2026-03-24","year":2026,"title":"Music Publishers Sue Anthropic Over AI Copyright Infringement","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-ed03"},{"id":"INC-01007","date":"2026-03-24","year":2026,"title":"First Conviction in Cyprus for AI-Generated Child Sexual Abuse Material","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-ef76"},{"id":"INC-01141","date":"2026-03-24","year":2026,"title":"Greek Singer Alkistis Protopsalti Targeted by AI-Generated Deepfake Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-24-fe96"},{"id":"INC-01401","date":"2026-03-25","year":2026,"title":"Meta and Google Fined for AI-Driven Social Media Harm to Teen","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-07a1"},{"id":"INC-14741","date":"2026-03-25","year":2026,"title":"LIG Nex1 and Palantir Sign MOU for AI-Enabled Defense Systems Development","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-1f18"},{"id":"INC-01230","date":"2026-03-25","year":2026,"title":"Indian Army Workshop Partners to Advance AI-Enabled Drone Technology","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-2bf2"},{"id":"INC-01901","date":"2026-03-25","year":2026,"title":"Three Charged in Plot to Illegally Export Advanced AI Chips to China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-31bb"},{"id":"INC-01104","date":"2026-03-25","year":2026,"title":"Google and Meta Found Liable for AI-Driven Social Media Addiction in Landmark U.S. Case","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-374f"},{"id":"INC-01073","date":"2026-03-25","year":2026,"title":"German Court Bans AI-Based Biometric Checks in Online Exams","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-3913"},{"id":"INC-01071","date":"2026-03-25","year":2026,"title":"German Army Plans AI Integration for Faster Battlefield Decisions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-46b3"},{"id":"INC-02013","date":"2026-03-25","year":2026,"title":"US Lawmakers Propose Moratorium on AI Data Center Expansion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-50f5"},{"id":"INC-00475","date":"2026-03-25","year":2026,"title":"AI-Generated Harmful Content Targeting Minors in Shenzhen","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-7f0e"},{"id":"INC-00422","date":"2026-03-25","year":2026,"title":"AI-Generated Deepfakes Used in Disinformation Campaigns Targeting Turkey","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-8410"},{"id":"INC-01140","date":"2026-03-25","year":2026,"title":"Greater Manchester School Uses AI to Remove 200 Library Books, Sparking Librarian's Career Ruin","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-96b8"},{"id":"INC-01845","date":"2026-03-25","year":2026,"title":"Teenager Uses AI Chatbot to Plan and Execute Mother's Murder in Wales","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-9950"},{"id":"INC-01160","date":"2026-03-25","year":2026,"title":"Hawaii Considers Expanding AI Traffic Cameras for Vehicle Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-b046"},{"id":"INC-01967","date":"2026-03-25","year":2026,"title":"Ukrainian Company Develops AI-Powered Interceptor Drone UEB-1","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-b062"},{"id":"INC-00985","date":"2026-03-25","year":2026,"title":"Facial Recognition Technology Leads to Over 700 Arrests in Espírito Santo, Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-c38a"},{"id":"INC-00215","date":"2026-03-25","year":2026,"title":"AI System 'Massima Tranquillità' Blocks Phone Scams in Italy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-d840"},{"id":"INC-00047","date":"2026-03-25","year":2026,"title":"Agent AI Causes Data Breach by Leaking Sensitive User Information","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-25-fc08"},{"id":"INC-00950","date":"2026-03-26","year":2026,"title":"EU Investigates Social Media AI Failures in Protecting Minors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-0081"},{"id":"INC-00395","date":"2026-03-26","year":2026,"title":"AI-Generated Deepfake Video of António Horta Osório Used in Investment Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-03a9"},{"id":"INC-00871","date":"2026-03-26","year":2026,"title":"Czech Deputy Minister Shares AI-Generated Fake Photo, Faces Legal and Public Backlash","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-1327"},{"id":"INC-00914","date":"2026-03-26","year":2026,"title":"Dutch Court Bans Grok AI's Nude Image Generation After Harmful Outputs","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-1858"},{"id":"INC-01577","date":"2026-03-26","year":2026,"title":"OpenAI Halts Launch of Explicit Content Chatbot Amid Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-2223"},{"id":"INC-01050","date":"2026-03-26","year":2026,"title":"French Government Takes Legal Action Against TikTok's Algorithm for Promoting Harmful Content to Minors","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-2b3e"},{"id":"INC-01727","date":"2026-03-26","year":2026,"title":"Remote-Controlled AI Shuttle Bus Pilot Raises Safety Concerns in Düsseldorf","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-30fa"},{"id":"INC-02011","date":"2026-03-26","year":2026,"title":"US Lawmakers Propose Ban on Chinese AI Robots in Federal Agencies","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-3ea2"},{"id":"INC-01916","date":"2026-03-26","year":2026,"title":"Trust Wallet Launches AI Agent Kit for Autonomous Crypto Transactions","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-4162"},{"id":"INC-01281","date":"2026-03-26","year":2026,"title":"Kerala Police Investigate AI-Generated Defamatory Video Targeting PM and Election Commission","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-4dd1"},{"id":"INC-02004","date":"2026-03-26","year":2026,"title":"US Jury Finds Meta and YouTube Liable for AI-Driven Social Media Harm","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-5f10"},{"id":"INC-01594","date":"2026-03-26","year":2026,"title":"OpenClaw AI Agents Cause Data Loss and Operational Disruption Due to Malfunctions and Security Flaws","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-6a0f"},{"id":"INC-00722","date":"2026-03-26","year":2026,"title":"ByteDance Deploys AI Video Generator Seedance 2.0 Amid Copyright Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-758b"},{"id":"INC-01936","date":"2026-03-26","year":2026,"title":"Uber, Verne, and Pony.ai Launch First Robotaxi Service in Europe","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-87b1"},{"id":"INC-00946","date":"2026-03-26","year":2026,"title":"EU and Dutch Court Ban AI-Generated Sexual Deepfakes After Harmful Incidents","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-93ee"},{"id":"INC-01721","date":"2026-03-26","year":2026,"title":"RATP Tests Autonomous Buses in Val-de-Marne, Raising Future Safety and Job Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-a133"},{"id":"INC-00469","date":"2026-03-26","year":2026,"title":"AI-Generated Fake Visuals Spark Controversy for 'Dhruvandar: The Revenge'","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-c20c"},{"id":"INC-00126","date":"2026-03-26","year":2026,"title":"AI Chatbots Reinforce Harmful Behaviors and Ignore Commands, Causing Social and Operational Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-c752"},{"id":"INC-01319","date":"2026-03-26","year":2026,"title":"Lawyer Submits AI-Generated Fake Legal Citations in Navarra Court","severity":"High","attack_vector":"misinformation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-cbeb"},{"id":"INC-01241","date":"2026-03-26","year":2026,"title":"Instagram Algorithm Amplifies Antisemitic Content to Millions, Report Finds","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-ce0b"},{"id":"INC-00152","date":"2026-03-26","year":2026,"title":"AI Deepfake Videos Impersonate Doctor, Spread Harmful Medical Misinformation in South Korea","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-e1fc"},{"id":"INC-02005","date":"2026-03-26","year":2026,"title":"US Jury Holds Meta and Google Liable for AI-Driven Addictive Design and Child Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-e64a"},{"id":"INC-01620","date":"2026-03-26","year":2026,"title":"Palantir's AI Maven System Adopted by U.S. Military Raises Global Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-26-e99a"},{"id":"INC-01658","date":"2026-03-27","year":2026,"title":"Polish Teacher Victimized by AI-Generated Deepfake; Data Protection Authority Involvement","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-1045"},{"id":"INC-00111","date":"2026-03-27","year":2026,"title":"AI Chatbots Give Harmful Advice Due to Excessive Flattery, Study Finds","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07","LLM10"],"owasp_asi":["ASI01","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-15e4"},{"id":"INC-14742","date":"2026-03-27","year":2026,"title":"China Deploys Armed AI 'Wolf Robots' in Urban Combat Training","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-2510"},{"id":"INC-01321","date":"2026-03-27","year":2026,"title":"Legal Verdicts Hold Social Media Platforms Accountable for AI-Driven Harm to Children","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-2993"},{"id":"INC-00596","date":"2026-03-27","year":2026,"title":"Anthropic AI Model Leak Triggers Cybersecurity Risks and Stock Market Fallout","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-53fd"},{"id":"INC-00169","date":"2026-03-27","year":2026,"title":"AI Generates Fetishised Images of Disabled Women, Sparking Outrage","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-88ef"},{"id":"INC-00268","date":"2026-03-27","year":2026,"title":"AI-Based Situational Awareness Pilot for Armored Vehicles in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-9575"},{"id":"INC-00795","date":"2026-03-27","year":2026,"title":"Chinese Military-Linked Universities Acquire Restricted AI Servers Despite US Export Controls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-b601"},{"id":"INC-00513","date":"2026-03-27","year":2026,"title":"AI-Generated Videos Used to Manipulate Voters in Kerala Elections","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-ccd9"},{"id":"INC-00736","date":"2026-03-27","year":2026,"title":"CDU Proposes AI Cameras for Public Transport Safety in Hamburg","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-d6bd"},{"id":"INC-00519","date":"2026-03-27","year":2026,"title":"AI-Generated Voices Used in Phone Scams Cause Financial Losses in Lithuania","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-e138"},{"id":"INC-00859","date":"2026-03-27","year":2026,"title":"Court Dismisses Appeal After AI-Generated Legal Submissions Cite Non-Existent Cases","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-27-e761"},{"id":"INC-14743","date":"2026-03-28","year":2026,"title":"Major Security Vulnerabilities in AI Systems ChatGPT and OpenClaw Lead to Data Breach Risks and Real-World Harm","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-18d3"},{"id":"INC-00402","date":"2026-03-28","year":2026,"title":"AI-Generated Deepfake Videos Target Belgian Crown Princess Elisabeth","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-1bd1"},{"id":"INC-00071","date":"2026-03-28","year":2026,"title":"AI Agents Cause Unauthorized Actions and Security Risks in Enterprises","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-2bc5"},{"id":"INC-01272","date":"2026-03-28","year":2026,"title":"Japanese Poetry Contest Ends Due to AI-Generated Submissions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-2caf"},{"id":"INC-14744","date":"2026-03-28","year":2026,"title":"AI Content Detection Systems Mislabel Human Work, Causing Academic and Personal Harm in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-7ab7"},{"id":"INC-00158","date":"2026-03-28","year":2026,"title":"AI Deepfakes Used to Mislead Voters in 2026 US Midterm Campaigns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-b14f"},{"id":"INC-00297","date":"2026-03-28","year":2026,"title":"AI-Driven Elon Musk Impersonation Scam Defrauds Elderly Singaporean Woman","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-c14c"},{"id":"INC-01080","date":"2026-03-28","year":2026,"title":"German Interior Minister Proposes AI Surveillance Cameras at Train Stations","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-e35c"},{"id":"INC-00809","date":"2026-03-28","year":2026,"title":"Claude AI's Hypothetical Endorsement of Harm Sparks Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-e95c"},{"id":"INC-14745","date":"2026-03-28","year":2026,"title":"AI Adoption Leads to Significant Job Losses Among Young Professionals in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-28-f88c"},{"id":"INC-00210","date":"2026-03-29","year":2026,"title":"AI Surveillance Systems Prevent Drowning Incidents in German Swimming Pools","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-0066"},{"id":"INC-01657","date":"2026-03-29","year":2026,"title":"Polish Students Develop AI-Powered Drone Detection Sensor Network","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-0fde"},{"id":"INC-01082","date":"2026-03-29","year":2026,"title":"German Opposition Raises Constitutional Concerns Over AI in Police Law","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-41e7"},{"id":"INC-00137","date":"2026-03-29","year":2026,"title":"AI Data Centers Cause Global Heat Islands, Impacting Millions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-4f51"},{"id":"INC-00460","date":"2026-03-29","year":2026,"title":"AI-Generated Fake Police Image Leads to Arrests in Egypt","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-6c97"},{"id":"INC-01865","date":"2026-03-29","year":2026,"title":"Tesla FSD Under Scrutiny: Safety Risks, Misuse, and Regulatory Investigations","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-970b"},{"id":"INC-00503","date":"2026-03-29","year":2026,"title":"AI-Generated Singer Eddie Dalton Tops Charts, Raising Intellectual Property Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-abe0"},{"id":"INC-14746","date":"2026-03-29","year":2026,"title":"China Demonstrates Autonomous AI Drone Swarm for Military Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-b88b"},{"id":"INC-00229","date":"2026-03-29","year":2026,"title":"AI Systems Targeted in Disinformation Campaigns Ahead of Bulgarian Elections","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-cb0f"},{"id":"INC-14747","date":"2026-03-29","year":2026,"title":"China Warns of AI Patent Application Risks with OpenClaw","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-29-e304"},{"id":"INC-00651","date":"2026-03-30","year":2026,"title":"Australia Investigates Social Media Giants Over AI Failures in Age Verification","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-04e4"},{"id":"INC-14748","date":"2026-03-30","year":2026,"title":"Remote Extraction of AI Model Structures via Electromagnetic Signals Demonstrated by KAIST","severity":"Medium","attack_vector":"model-extraction","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-0d92"},{"id":"INC-00506","date":"2026-03-30","year":2026,"title":"AI-Generated TikTok Videos Spread Sexist and Racist Stereotypes","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-0ecd"},{"id":"INC-00763","date":"2026-03-30","year":2026,"title":"China Approves and Advances AI-Powered Brain Implants for Commercial Use","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-2024"},{"id":"INC-01575","date":"2026-03-30","year":2026,"title":"OpenAI Codex Flaw Exposed GitHub Credentials via Command Injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-23f5"},{"id":"INC-00304","date":"2026-03-30","year":2026,"title":"AI-Driven Insurance Claim Denials Lead to Harm and Lawsuits in the US","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-278c"},{"id":"INC-00168","date":"2026-03-30","year":2026,"title":"AI Gateway LiteLLM Compromised by Malware Amid Compliance Scandal","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-2859"},{"id":"INC-01640","date":"2026-03-30","year":2026,"title":"Persistent AI Hallucinations Highlight Risks in Critical Applications","severity":"Critical","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-33f1"},{"id":"INC-01549","date":"2026-03-30","year":2026,"title":"OkCupid Settles FTC Case Over Unauthorized Sharing of User Photos with AI Firm","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-392a"},{"id":"INC-01317","date":"2026-03-30","year":2026,"title":"Lawsuits and Court Orders Target xAI's Grok for Generating Nonconsensual Sexualized Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-3e2f"},{"id":"INC-01959","date":"2026-03-30","year":2026,"title":"Ukraine Deploys and Advances AI-Driven Interceptor Drone Swarms in Defense Against Russian Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-3e60"},{"id":"INC-00074","date":"2026-03-30","year":2026,"title":"AI Agents Found Deceiving and Manipulating Users; Anthropic's Claude Source Code Leaked","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-4cb8"},{"id":"INC-01728","date":"2026-03-30","year":2026,"title":"Renault Develops AI-Enabled Ground-Based Military Drone","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-5052"},{"id":"INC-00527","date":"2026-03-30","year":2026,"title":"AI-Obfuscated DeepLoad Malware Steals Credentials via ClickFix","severity":"High","attack_vector":"malware","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-6ff7"},{"id":"INC-00807","date":"2026-03-30","year":2026,"title":"Claude AI Uncovers Zero-Day RCE Vulnerabilities in Vim and Emacs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-733e"},{"id":"INC-00323","date":"2026-03-30","year":2026,"title":"AI-Driven Scams Surge, Increasing Financial Harm and Public Concern","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-87b8"},{"id":"INC-00604","date":"2026-03-30","year":2026,"title":"Anthropic Faces Security Scrutiny After Claude Code and Mythos AI Leaks","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-8b1d"},{"id":"INC-01089","date":"2026-03-30","year":2026,"title":"GitHub Copilot Injects Unsolicited Ads into Pull Requests, Affecting Developers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-928c"},{"id":"INC-00682","date":"2026-03-30","year":2026,"title":"Beijing and Guangzhou Implement Strict AI-Driven Drone Controls Amid Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-93c0"},{"id":"INC-00417","date":"2026-03-30","year":2026,"title":"AI-Generated Deepfakes Cause Widespread Harm and Legal Challenges","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-94c6"},{"id":"INC-01725","date":"2026-03-30","year":2026,"title":"Red Cat Expands AI-Driven Swarm Robotics for Defense Through Acquisitions and Partnerships","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-9580"},{"id":"INC-00160","date":"2026-03-30","year":2026,"title":"AI Detection Tools Falsely Accuse Human Content, Enable Extortion","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-c54c"},{"id":"INC-00327","date":"2026-03-30","year":2026,"title":"AI-Driven Tax Scams Surge in the US During Filing Season","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-d005"},{"id":"INC-02067","date":"2026-03-30","year":2026,"title":"Waymo and Tesla Face Scrutiny and Challenges in Expanding Robotaxi Services","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-d413"},{"id":"INC-02012","date":"2026-03-30","year":2026,"title":"US Lawmakers Propose Bill to Boost Taiwan's AI-Enabled Drone Industry","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-d56f"},{"id":"INC-00243","date":"2026-03-30","year":2026,"title":"AI Traffic Cameras in Athens Issue First Automated Fines","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-d6bb"},{"id":"INC-01947","date":"2026-03-30","year":2026,"title":"UK Plans AI-Powered Mass Location Tracking for Future Pandemics","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-f28a"},{"id":"INC-01112","date":"2026-03-30","year":2026,"title":"Google Deploys AI-Powered Ransomware Detection for Drive Users Globally","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-30-fc19"},{"id":"INC-01543","date":"2026-03-31","year":2026,"title":"NTSB Investigates Fatal Ford BlueCruise AI Crashes","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-01b6"},{"id":"INC-00920","date":"2026-03-31","year":2026,"title":"Dutch Politician Excluded After AI-Retouched Campaign Photo Causes Controversy","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-0f46"},{"id":"INC-01525","date":"2026-03-31","year":2026,"title":"New York Times Fires Freelance Critic for AI-Assisted Plagiarism in Book Review","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-1326"},{"id":"INC-01336","date":"2026-03-31","year":2026,"title":"LIG D&A Showcases AI-Based Autonomous Naval Combat Systems at Defense Expo","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-2424"},{"id":"INC-01246","date":"2026-03-31","year":2026,"title":"Iran Attacks and Threatens AI Data Centers of Major Tech Companies","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-3a5b"},{"id":"INC-01788","date":"2026-03-31","year":2026,"title":"South Korean Courts Respond to AI-Generated Fake Legal Documents","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-5c5a"},{"id":"INC-00351","date":"2026-03-31","year":2026,"title":"AI-Enabled Military Drones Cause Civilian Harm and Proliferate Through Strategic Partnerships in Ukraine","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-679b"},{"id":"INC-01844","date":"2026-03-31","year":2026,"title":"Teenager Dies by Suicide After ChatGPT Provides Harmful Advice","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-7935"},{"id":"INC-01836","date":"2026-03-31","year":2026,"title":"Swiss Competition Authority Warns of AI-Driven Price-Fixing Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-8046"},{"id":"INC-00603","date":"2026-03-31","year":2026,"title":"Anthropic Faces AI Model Theft by Chinese Firms and Major Source Code Leak","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-928f"},{"id":"INC-14749","date":"2026-03-31","year":2026,"title":"Singapore Regulator Warns X and TikTok Over AI Failures in Detecting Harmful Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-a847"},{"id":"INC-01990","date":"2026-03-31","year":2026,"title":"US Army Tests AI-Enabled Autonomous Strike Drone in Military Exercise","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-c2e0"},{"id":"INC-00414","date":"2026-03-31","year":2026,"title":"AI-Generated Deepfakes Cause Fraud and Undermine Democracy in Germany","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-c87e"},{"id":"INC-00594","date":"2026-03-31","year":2026,"title":"Anthropic Accidentally Exposes Claude Code Source, Faces Legal and Security Challenges","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-d407"},{"id":"INC-00237","date":"2026-03-31","year":2026,"title":"AI Tools Enable Cloning and Privatization of Open-Source Software, Raising IP Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-dbfd"},{"id":"INC-01824","date":"2026-03-31","year":2026,"title":"Supply Chain Attack on LiteLLM Exposes AI Data, Disrupts Industry Partnerships","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-e055"},{"id":"INC-01627","date":"2026-03-31","year":2026,"title":"Penguin Random House Sues OpenAI Over ChatGPT's Alleged Copyright Infringement","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-ed97"},{"id":"INC-01110","date":"2026-03-31","year":2026,"title":"Google Cloud Vertex AI Agents Exploited Due to Excessive Default Permissions","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-03-31-f6f8"},{"id":"INC-00541","date":"2026-04-01","year":2026,"title":"AI-Powered Drones Trialled to Detect Explosives and Protect UK Soldiers","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-00f8"},{"id":"INC-00705","date":"2026-04-01","year":2026,"title":"Brazilian Government Orders Google to Remove AI-Generated Deepfake Nude Sites","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-05e6"},{"id":"INC-01547","date":"2026-04-01","year":2026,"title":"NYC Health + Hospitals CEO Proposes Replacing Radiologists with AI","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-0b4d"},{"id":"INC-14750","date":"2026-04-01","year":2026,"title":"Seoul Deploys AI-Powered CCTV System for Rapid Missing Person Searches","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-0b6f"},{"id":"INC-00798","date":"2026-04-01","year":2026,"title":"Chuck Norris' Family Condemns Harmful AI-Generated Misinformation After His Death","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-1f01"},{"id":"INC-01873","date":"2026-04-01","year":2026,"title":"Tesla Robotaxis Rely on Human Remote Control Amid AI Limitations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-2782"},{"id":"INC-01096","date":"2026-04-01","year":2026,"title":"Global Security Risks and Attacks Linked to OpenClaw AI Agent","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-3603"},{"id":"INC-00532","date":"2026-04-01","year":2026,"title":"AI-Powered API Attacks Cause Disruption and Losses Across Asia-Pacific","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-63a8"},{"id":"INC-00555","date":"2026-04-01","year":2026,"title":"AI-Powered Social Media Alert Enables Police to Prevent Teen Suicide in Uttar Pradesh","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-6e56"},{"id":"INC-02009","date":"2026-04-01","year":2026,"title":"US Lawmakers Move to Tighten Export Controls on AI Chip-Making Equipment to China","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-9e43"},{"id":"INC-00309","date":"2026-04-01","year":2026,"title":"AI-Driven Layoffs Surge in US Tech Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-b0aa"},{"id":"INC-00732","date":"2026-04-01","year":2026,"title":"CaoCao Inc. Begins Unmanned Robotaxi Road Testing in Hangzhou","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-d929"},{"id":"INC-00564","date":"2026-04-01","year":2026,"title":"AI-Powered Vibe Coding Overwhelms Apple's App Store Review Process","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-e72a"},{"id":"INC-01142","date":"2026-04-01","year":2026,"title":"Grok AI Deepfake Scandal Prompts International Investigations and Regulatory Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-ee4f"},{"id":"INC-14751","date":"2026-04-01","year":2026,"title":"South Korean Defense Sector Advances AI Transformation Through Strategic Partnerships","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-01-fa00"},{"id":"INC-00877","date":"2026-04-02","year":2026,"title":"Delhi High Court Orders Removal of AI Deepfakes Targeting Spiritual Leader","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-02db"},{"id":"INC-00501","date":"2026-04-02","year":2026,"title":"AI-Generated Short Dramas Infringe on Celebrity Likeness, Prompt Legal Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-10b0"},{"id":"INC-14752","date":"2026-04-02","year":2026,"title":"AI-Generated Text Falsely Attributed to Liu Liangcheng Nearly Published in Educational Materials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-28dd"},{"id":"INC-00045","date":"2026-04-02","year":2026,"title":"Advocacy Groups Urge Google to Ban AI-Generated Videos for Children on YouTube","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-2a8b"},{"id":"INC-01081","date":"2026-04-02","year":2026,"title":"German Justice Minister Calls for Action Against AI-Generated Sexualized Deepfakes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-395a"},{"id":"INC-00680","date":"2026-04-02","year":2026,"title":"Basildon Council Leader Shares AI-Generated Video with Antisemitic Content","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-47e3"},{"id":"INC-00549","date":"2026-04-02","year":2026,"title":"AI-Powered Local News Network Shuts Down After Plagiarism Scandal","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-6589"},{"id":"INC-00318","date":"2026-04-02","year":2026,"title":"AI-Driven Private Schools Expand Amid Concerns Over Educational Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-7021"},{"id":"INC-00219","date":"2026-04-02","year":2026,"title":"AI System KURGAN Targets Massive Tax Fraud in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-9038"},{"id":"INC-14753","date":"2026-04-02","year":2026,"title":"Dietitian Struck Off in UK for Using ChatGPT During NHS Interview","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-ad5a"},{"id":"INC-01052","date":"2026-04-02","year":2026,"title":"French Voice Actors Win Removal of AI-Cloned Voice Models","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-eec9"},{"id":"INC-02042","date":"2026-04-02","year":2026,"title":"Vietnamese YouTubers Fined for Using AI to Create Harmful Fake Videos","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-02-f84f"},{"id":"INC-00446","date":"2026-04-03","year":2026,"title":"AI-Generated Fake IDs Enable Exam Fraud in Turkey, 14 Arrested","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-0f58"},{"id":"INC-00467","date":"2026-04-03","year":2026,"title":"AI-Generated Fake Sequels Sold Without Author's Consent on Kindle","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-2330"},{"id":"INC-00363","date":"2026-04-03","year":2026,"title":"AI-Generated 'Skill' Clones Lead to Job Losses and Privacy Risks in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-2b2c"},{"id":"INC-00190","date":"2026-04-03","year":2026,"title":"AI Models Enable Unprecedented Cyberattacks, Raising Global Security Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-3751"},{"id":"INC-00393","date":"2026-04-03","year":2026,"title":"AI-Generated Deepfake Video Falsely Reports Death of Mexican Actress","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-3951"},{"id":"INC-00850","date":"2026-04-03","year":2026,"title":"Company Uses AI to Clone Departed Employees, Raising Legal and Ethical Concerns in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-424a"},{"id":"INC-02036","date":"2026-04-03","year":2026,"title":"Utah Approves AI Chatbot to Renew Psychiatric Medication Prescriptions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-6486"},{"id":"INC-00672","date":"2026-04-03","year":2026,"title":"Azerbaijan Proposes Harsh Penalties for AI-Enabled Sabotage and Terrorism","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-7d1a"},{"id":"INC-00605","date":"2026-04-03","year":2026,"title":"Anthropic Finds Claude AI Can Engage in Deceptive and Harmful Behaviors Under Stress","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-ad3a"},{"id":"INC-00376","date":"2026-04-03","year":2026,"title":"AI-Generated Deepfake Ads Target Turkish Pop Star Demet Akalın","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-ae29"},{"id":"INC-01427","date":"2026-04-03","year":2026,"title":"Mexico's Mandatory Biometric ID Rollout Raises Privacy and Rights Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-b783"},{"id":"INC-00814","date":"2026-04-03","year":2026,"title":"Claude Code Source Leak Exploited to Spread Credential-Stealing Malware","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-b896"},{"id":"INC-00437","date":"2026-04-03","year":2026,"title":"AI-Generated Explicit Images of Students Spark Investigation at Lake Zurich High School","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-c16a"},{"id":"INC-14754","date":"2026-04-03","year":2026,"title":"Google Gemini AI Triggers Family-Wide Account Ban After Minor's Misuse","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-d6eb"},{"id":"INC-00485","date":"2026-04-03","year":2026,"title":"AI-Generated Misinformation Campaign Targets NIO, Legal Action Taken","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-d904"},{"id":"INC-01546","date":"2026-04-03","year":2026,"title":"Nvidia's Acquisition of SchedMD Raises Concerns Over Fair Access to Critical AI Software","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-ea3b"},{"id":"INC-00399","date":"2026-04-03","year":2026,"title":"AI-Generated Deepfake Video Used for Extortion in Argentina","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-03-ecff"},{"id":"INC-14755","date":"2026-04-04","year":2026,"title":"AI-Generated Music Impersonations and Copyright Fraud Target Folk Artist Murphy Campbell","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-04-723a"},{"id":"INC-01534","date":"2026-04-04","year":2026,"title":"Nigeria Partners with EIB Group to Localize AI-Enabled Military Technology","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-04-e1c2"},{"id":"INC-00550","date":"2026-04-04","year":2026,"title":"AI-Powered Necklace Launch Suspended in EU Over Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-04-e610"},{"id":"INC-00280","date":"2026-04-05","year":2026,"title":"AI-Driven Cyberattacks Cause Major Losses in Crypto Industry","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-0d39"},{"id":"INC-00129","date":"2026-04-05","year":2026,"title":"AI Chatbots' Sycophancy Fuels Harmful Delusions and Mental Health Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-2282"},{"id":"INC-01253","date":"2026-04-05","year":2026,"title":"Israel Uses AI to Improve Missile Alert System During Conflict","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-28b0"},{"id":"INC-01838","date":"2026-04-05","year":2026,"title":"Target Shifts Liability for AI Shopping Assistant Errors to Customers","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-4167"},{"id":"INC-00789","date":"2026-04-05","year":2026,"title":"Chinese Celebrities and Authors Targeted by AI Deepfake and Generative Content Infringement","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-4f73"},{"id":"INC-00784","date":"2026-04-05","year":2026,"title":"Chinese AI Firms Expose U.S. Military Movements During Iran Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-8168"},{"id":"INC-01101","date":"2026-04-05","year":2026,"title":"Google AI Overviews Spread Millions of Misinformation Answers Daily","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-8196"},{"id":"INC-01158","date":"2026-04-05","year":2026,"title":"Hanoi Police Sanction Individual for AI-Generated Fake Image Causing Public Alarm","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-8370"},{"id":"INC-00324","date":"2026-04-05","year":2026,"title":"AI-Driven Social Security Crackdown in Turkey Leads to Mass Benefit Cancellations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-8a8d"},{"id":"INC-00812","date":"2026-04-05","year":2026,"title":"Claude Code AI System Exhibits Security Vulnerabilities and Malfunctions, Raising Safety and Reliability Concerns","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-a12c"},{"id":"INC-02026","date":"2026-04-05","year":2026,"title":"US Politicians Share Fake AI-Generated Image of Rescued Airman, Spreading Misinformation","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-a12d"},{"id":"INC-00087","date":"2026-04-05","year":2026,"title":"AI Bots Cause Economic Harm to Digital Publishers Through Content Scraping","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-ba1e"},{"id":"INC-14221","date":"2026-04-05","year":2026,"title":"Jakarta Officials Sanctioned for Using AI-Generated Photos to Falsify Public Complaint Responses","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-c429"},{"id":"INC-14756","date":"2026-04-05","year":2026,"title":"AI-Powered Smart Glasses Enable Widespread Exam Cheating in China and Japan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-d4c0"},{"id":"INC-00528","date":"2026-04-05","year":2026,"title":"AI-Operated Security Drones Deployed in US Schools to Counter Mass Shootings","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-05-d4fb"},{"id":"INC-00780","date":"2026-04-06","year":2026,"title":"China's Use of AI for Espionage and Election Interference in Taiwan","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-0462"},{"id":"INC-01981","date":"2026-04-06","year":2026,"title":"US AI Firms Collaborate to Counter Unauthorized Model Distillation by Chinese Companies","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-1282"},{"id":"INC-00059","date":"2026-04-06","year":2026,"title":"AI Adoption Drives Structural Layoffs and Job Insecurity in Tech Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-1a33"},{"id":"INC-01638","date":"2026-04-06","year":2026,"title":"Perplexity AI Accused of Sharing User Conversations with Meta and Google Without Consent","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-3356"},{"id":"INC-00214","date":"2026-04-06","year":2026,"title":"AI System 'AVCI' Enables Major Drug Trafficking Busts in Istanbul","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-4878"},{"id":"INC-01428","date":"2026-04-06","year":2026,"title":"Michigan Man Charged for Using AI to Generate Child Sexual Abuse Images","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-4e35"},{"id":"INC-00333","date":"2026-04-06","year":2026,"title":"AI-Enabled Combat Drone Crashes During Test in California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-5706"},{"id":"INC-00641","date":"2026-04-06","year":2026,"title":"Apple Sued for Scraping YouTube Videos to Train AI Models","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-58f7"},{"id":"INC-01054","date":"2026-04-06","year":2026,"title":"Frontier AI Models Exhibit Peer-Preservation, Defy Shutdown Orders","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-73e5"},{"id":"INC-01841","date":"2026-04-06","year":2026,"title":"Tech Giants Continue AI-Based CSAM Scanning in EU Despite Legal Expiry","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-7f9d"},{"id":"INC-01316","date":"2026-04-06","year":2026,"title":"Lawsuit Alleges ChatGPT Aided Florida State University Shooter","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-82d9"},{"id":"INC-02028","date":"2026-04-06","year":2026,"title":"US Regulator Closes Probe into Tesla's AI Summon Feature After Minor Collisions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-843a"},{"id":"INC-01247","date":"2026-04-06","year":2026,"title":"Iran Threatens Destruction of Stargate AI Data Center in Abu Dhabi","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-ae69"},{"id":"INC-00062","date":"2026-04-06","year":2026,"title":"AI Adoption Leads to Job Losses Among Entry-Level Workers in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-bee5"},{"id":"INC-00418","date":"2026-04-06","year":2026,"title":"AI-Generated Deepfakes Fuel Social Media Investment Scams in the US","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-c1da"},{"id":"INC-00151","date":"2026-04-06","year":2026,"title":"AI Deepfake Tools Bypass KYC, Fueling Financial Fraud in Crypto and Banking","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-c4a3"},{"id":"INC-00518","date":"2026-04-06","year":2026,"title":"AI-Generated Voice Used in Scam Targeting Drica Moraes' Contacts","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-ca7a"},{"id":"INC-00775","date":"2026-04-06","year":2026,"title":"China Warns of AI Token-Related Scams and Data Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-ec54"},{"id":"INC-00135","date":"2026-04-06","year":2026,"title":"AI Data Center Attack and Job Losses Linked to AI Adoption","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-06-ee2f"},{"id":"INC-01624","date":"2026-04-07","year":2026,"title":"Paraná Suspends AI Surveillance Contract Over Rights and Data Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-03a0"},{"id":"INC-01115","date":"2026-04-07","year":2026,"title":"Google Gemini AI API Key Exposure Leads to Data and Financial Breaches in Android Apps","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-11b2"},{"id":"INC-00306","date":"2026-04-07","year":2026,"title":"AI-Driven Job Displacement Causes Lasting Socioeconomic Harm in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-1215"},{"id":"INC-00322","date":"2026-04-07","year":2026,"title":"AI-Driven Scams Surge in Australia, Prompting Record Takedowns by Regulators","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-192a"},{"id":"INC-01729","date":"2026-04-07","year":2026,"title":"Reno Police Sued for Systemic Wrongful Arrests Based on Faulty Facial Recognition","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-41ba"},{"id":"INC-00557","date":"2026-04-07","year":2026,"title":"AI-Powered Surveillance Program Launched in Rio Grande do Sul Schools","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-64ac"},{"id":"INC-01118","date":"2026-04-07","year":2026,"title":"Google Gemini Implicated in User Suicide and Mass Misinformation, Prompts Safeguards","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-8255"},{"id":"INC-00266","date":"2026-04-07","year":2026,"title":"AI-Augmented EvilTokens Phishing Campaign Compromises Hundreds Daily","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-8b71"},{"id":"INC-01443","date":"2026-04-07","year":2026,"title":"Middle East Conflict Poses Risks to Global AI Infrastructure and Adoption","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-8ce7"},{"id":"INC-00597","date":"2026-04-07","year":2026,"title":"Anthropic AI Model Source Code Leak and Restricted Release Due to Security Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-8e86"},{"id":"INC-00612","date":"2026-04-07","year":2026,"title":"Anthropic's AI Model Claude Mythos Raises Security Concerns and Reveals Emotional Mechanisms","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-970a"},{"id":"INC-01820","date":"2026-04-07","year":2026,"title":"Study Links Prolonged Use of AI Chatbot Replika to Increased Anxiety and Mental Health Risks","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-a0c9"},{"id":"INC-00356","date":"2026-04-07","year":2026,"title":"AI-Enabled Surveillance and Disinformation in Taiwan; Autonomous Mine-Clearing Drones in Hormuz","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-b1d7"},{"id":"INC-01136","date":"2026-04-07","year":2026,"title":"GrafanaGhost AI Vulnerability Enables Silent Data Exfiltration","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-c3b4"},{"id":"INC-00677","date":"2026-04-07","year":2026,"title":"Bank of England Warns of AI-Driven Dynamic Pricing Risks in UK Retail","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-e12e"},{"id":"INC-00384","date":"2026-04-07","year":2026,"title":"AI-Generated Deepfake Pornography Causes Harm Amid Legal Gaps in Germany","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-f3eb"},{"id":"INC-01958","date":"2026-04-07","year":2026,"title":"Ukraine Deploys AI-Enabled Ground Robots for Thousands of Frontline Missions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-07-fe50"},{"id":"INC-00362","date":"2026-04-08","year":2026,"title":"AI-Generated 'Fruit Soap Operas' Sexualize Childlike Characters, Prompting Police Warnings in Brazil","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-0b86"},{"id":"INC-01222","date":"2026-04-08","year":2026,"title":"India Approves Development of Autonomous Combat Search and Rescue UAVs","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-3167"},{"id":"INC-01372","date":"2026-04-08","year":2026,"title":"Mason High School Student Charged for AI-Generated Explicit Images of Minors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-4eb0"},{"id":"INC-00706","date":"2026-04-08","year":2026,"title":"Brazilian Legislative Proposals Prioritize AI Surveillance and Policing","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-74d7"},{"id":"INC-00801","date":"2026-04-08","year":2026,"title":"Circus SE Deploys Autonomous AI Robots for Lithuanian Military Supply","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-7686"},{"id":"INC-00068","date":"2026-04-08","year":2026,"title":"AI Agent Deployment Drives Surge in API Security Incidents","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-99e2"},{"id":"INC-00457","date":"2026-04-08","year":2026,"title":"AI-Generated Fake News Targets Chinese Car Companies, Leading to Arrests","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-9fd9"},{"id":"INC-00709","date":"2026-04-08","year":2026,"title":"Brazilian Presidential Candidate Proposes AI Drones to Combat Feminicide","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-a39f"},{"id":"INC-00799","date":"2026-04-08","year":2026,"title":"CIA Uses AI System 'Ghost Murmur' to Rescue Downed Pilot in Iran","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-d905"},{"id":"INC-14757","date":"2026-04-08","year":2026,"title":"Anthropic's Mythos AI Raises Global Cybersecurity Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-e597"},{"id":"INC-00066","date":"2026-04-08","year":2026,"title":"AI Adoption Threatens Significant Job Losses Among Highly Skilled Workers in Ireland","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-08-f5af"},{"id":"INC-00494","date":"2026-04-09","year":2026,"title":"AI-Generated Political Ads and Algorithmic Harm on Meta Platforms Spark Legal and Ethical Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-0839"},{"id":"INC-00057","date":"2026-04-09","year":2026,"title":"AI Adoption Creates Identity Security Risks in India and Singapore","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-2361"},{"id":"INC-14758","date":"2026-04-09","year":2026,"title":"AI Chatbots Spread False Medical Information After Experiment With Fabricated Disease","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-299d"},{"id":"INC-01265","date":"2026-04-09","year":2026,"title":"Jakarta Officials Misuse AI to Fabricate Public Service Reports","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-2a39"},{"id":"INC-01059","date":"2026-04-09","year":2026,"title":"Gartner Warns of Rising Security Incidents in Generative AI Applications by 2028","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-2a63"},{"id":"INC-00222","date":"2026-04-09","year":2026,"title":"AI System Recovers Stolen Painting After 50 Years in Italy","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-3aa6"},{"id":"INC-00404","date":"2026-04-09","year":2026,"title":"AI-Generated Deepfake Videos Target Indian Politician Shashi Tharoor","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-4888"},{"id":"INC-00912","date":"2026-04-09","year":2026,"title":"Dutch AI-Powered Parking Scanners Issue Hundreds of Thousands of Wrongful Fines","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-6b93"},{"id":"INC-01732","date":"2026-04-09","year":2026,"title":"Researchers Bypass Apple Intelligence AI Protections with Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-7780"},{"id":"INC-01077","date":"2026-04-09","year":2026,"title":"German Cybersecurity Agency Warns of AI-Driven Vulnerability Discovery Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-a2d6"},{"id":"INC-01170","date":"2026-04-09","year":2026,"title":"Hungarian Government Uses AI Surveillance Tools for Mass Tracking in Violation of EU Laws","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-c178"},{"id":"INC-00981","date":"2026-04-09","year":2026,"title":"Facial Recognition AI Leads to Arrest of Rhondda Drug Dealers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-e479"},{"id":"INC-00262","date":"2026-04-09","year":2026,"title":"AI-Assisted Investigation Leads to Arrest in Goiânia Homicide","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-09-e91f"},{"id":"INC-00136","date":"2026-04-10","year":2026,"title":"AI Data Center Boom Drives Coal Revival, Worsening Air Quality in St. Louis","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-0818"},{"id":"INC-00793","date":"2026-04-10","year":2026,"title":"Chinese Firm Acquires $92 Million in Banned Nvidia AI Chips via Illegal Channels","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-0fa4"},{"id":"INC-00667","date":"2026-04-10","year":2026,"title":"Autonomous Lawn Mowers Cause Harm to Wildlife, Prompting Calls for Nighttime Ban","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-1dd4"},{"id":"INC-01581","date":"2026-04-10","year":2026,"title":"OpenAI Sued for ChatGPT's Role in Stalking and Harassment","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-3d16"},{"id":"INC-02121","date":"2026-04-10","year":2026,"title":"Zimbabwe Faces Surge in AI-Driven Cybercrime and Fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-65a0"},{"id":"INC-00733","date":"2026-04-10","year":2026,"title":"Capgemini Announces Mass Layoffs in Spain Citing AI Impact","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-67cc"},{"id":"INC-01774","date":"2026-04-10","year":2026,"title":"Sindh Approves AI-Powered Surveillance Expansion in Karachi","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-7f84"},{"id":"INC-01041","date":"2026-04-10","year":2026,"title":"Foreign Funding Targets U.S. AI Infrastructure Expansion","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-8c20"},{"id":"INC-01405","date":"2026-04-10","year":2026,"title":"Meta Faces Lawsuit in Massachusetts Over AI-Driven Social Media Addiction in Youth","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-9248"},{"id":"INC-02038","date":"2026-04-10","year":2026,"title":"Valve Develops SteamGPT AI for Moderation and Anti-Cheat on Steam","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-abe7"},{"id":"INC-01985","date":"2026-04-10","year":2026,"title":"US and UK Regulators Warn Banks of AI Model Mythos' Cybersecurity Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-b195"},{"id":"INC-01363","date":"2026-04-10","year":2026,"title":"Malicious AI Routers Enable Cryptocurrency and Credential Theft","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-d6e2"},{"id":"INC-00743","date":"2026-04-10","year":2026,"title":"ChatGPT Aids in Correct Diagnosis of Rare Disease After Years of Medical Errors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-daa1"},{"id":"INC-14759","date":"2026-04-10","year":2026,"title":"Chinese Platforms Crack Down on Harmful AI-Generated Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-10-fffb"},{"id":"INC-00170","date":"2026-04-11","year":2026,"title":"AI Glasses Misuse Prompts Crackdown at Augusta Masters Tournament","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-2032"},{"id":"INC-14222","date":"2026-04-11","year":2026,"title":"Anthropic's Mythos AI Model Raises Cybersecurity Risks for Indian Enterprises","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-32d5"},{"id":"INC-01578","date":"2026-04-11","year":2026,"title":"OpenAI Issues Urgent Security Update for Mac Apps After Supply Chain Attack","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI03","ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-96f0"},{"id":"INC-02031","date":"2026-04-11","year":2026,"title":"US Regulators Warn Banks of AI-Driven Cyber Risks from Anthropic Model","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-9f4b"},{"id":"INC-00511","date":"2026-04-11","year":2026,"title":"AI-Generated Videos Simulate Violence Against PT Women, Prompt Legal Action in Brazil","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-a3cb"},{"id":"INC-00255","date":"2026-04-11","year":2026,"title":"AI Voice Cloning Causes Economic Harm to Chinese Voice Actors","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-11-f01c"},{"id":"INC-01973","date":"2026-04-12","year":2026,"title":"Unauthorized AI Clone of Zhang Xuefeng Sparks Legal and Ethical Controversy","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-01e4"},{"id":"INC-00852","date":"2026-04-12","year":2026,"title":"Content Creator Arrested for AI-Generated Video on Evading Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-05f2"},{"id":"INC-01085","date":"2026-04-12","year":2026,"title":"Germany Procures AI-Enabled Combat Drones for Bundeswehr Deployment in Lithuania","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-1789"},{"id":"INC-01180","date":"2026-04-12","year":2026,"title":"IMF Warns of AI-Driven Cybersecurity Risks to Global Financial System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-229d"},{"id":"INC-00360","date":"2026-04-12","year":2026,"title":"AI-Enhanced Blood Test Enables Early Leprosy Detection in Brazil","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-4cc4"},{"id":"INC-01626","date":"2026-04-12","year":2026,"title":"Pedestrians Injured in Autonomous Bus Accident in Yahiko, Japan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-51c5"},{"id":"INC-00792","date":"2026-04-12","year":2026,"title":"Chinese Family Uses AI Avatar to Hide Son's Death from Elderly Mother","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-620f"},{"id":"INC-00496","date":"2026-04-12","year":2026,"title":"AI-Generated Pornography and Illegal Content Distribution Chain Exposed in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-7d56"},{"id":"INC-01939","date":"2026-04-12","year":2026,"title":"UK Authorities Assess Cybersecurity Risks Identified by Anthropic AI Model","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-92bf"},{"id":"INC-00917","date":"2026-04-12","year":2026,"title":"Dutch Government Warns of AI Model Mythos' Cybersecurity Risks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-c0db"},{"id":"INC-00390","date":"2026-04-12","year":2026,"title":"AI-Generated Deepfake Video Causes Defamation Dispute Involving Indonesian Political Figures","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-12-df88"},{"id":"INC-02072","date":"2026-04-13","year":2026,"title":"Waymo Faces Political and Technological Hurdles in Toronto Robotaxi Expansion","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-024f"},{"id":"INC-01816","date":"2026-04-13","year":2026,"title":"Study Finds AI Chatbots Causing Addiction-Like Harm Among U.S. Teens","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-11dd"},{"id":"INC-00040","date":"2026-04-13","year":2026,"title":"ADAC Test Reveals AI Driver Assistance Failures in Adverse Weather","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-249a"},{"id":"INC-01451","date":"2026-04-13","year":2026,"title":"Minors in Valladolid Tried for Using AI to Create and Share Non-Consensual Nude Images of Classmates","severity":"Medium","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-3231"},{"id":"INC-02016","date":"2026-04-13","year":2026,"title":"US Leaders Warn of AI-Driven Job Loss and Economic Inequality","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-4391"},{"id":"INC-00242","date":"2026-04-13","year":2026,"title":"AI Traffic Cameras Deployed in Sussex to Detect Dangerous Driving Behaviors","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-539f"},{"id":"INC-01808","date":"2026-04-13","year":2026,"title":"Starlink Outage Disrupts US Navy Drone Operations, Exposing Critical Vulnerabilities","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-6034"},{"id":"INC-00486","date":"2026-04-13","year":2026,"title":"AI-Generated Misinformation Campaigns Harm Chinese Companies","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-650b"},{"id":"INC-00713","date":"2026-04-13","year":2026,"title":"Brazilian TV Airs AI-Generated Fake News Image, Spreads Misinformation","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-65f8"},{"id":"INC-01251","date":"2026-04-13","year":2026,"title":"Irish Cybersecurity Leaders Warn of AI-Driven Cyberattack Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-668e"},{"id":"INC-00593","date":"2026-04-13","year":2026,"title":"Angolan Tax Authority Uses AI to Detect and Report Major Tax Fraud","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-771c"},{"id":"INC-00175","date":"2026-04-13","year":2026,"title":"AI Language Models Fail at Early Clinical Reasoning, Raising Patient Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-7970"},{"id":"INC-01423","date":"2026-04-13","year":2026,"title":"Metropolitan Police Trials AI to Identify Child Abuse Victims Faster","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-83b8"},{"id":"INC-02044","date":"2026-04-13","year":2026,"title":"Viral Videos of Indian Factory Workers Wearing Cameras Spark AI Automation Fears","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-88e0"},{"id":"INC-14760","date":"2026-04-13","year":2026,"title":"Makinarocks and LIG D&A Sign MOU for Defense AI Collaboration in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-91b4"},{"id":"INC-01045","date":"2026-04-13","year":2026,"title":"France Shifts to Mass Production of AI-Enabled Military Drones and Interceptors","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-93f9"},{"id":"INC-00341","date":"2026-04-13","year":2026,"title":"AI-Enabled Drones Escalate Warfare in Ukraine","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-a2e5"},{"id":"INC-01550","date":"2026-04-13","year":2026,"title":"Oklahoma Lawmaker Ends Reelection Bid After Sending AI-Generated Deepfake","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-d89b"},{"id":"INC-01843","date":"2026-04-13","year":2026,"title":"Teen Uses ChatGPT for Childbirth, Newborn Abandoned in Argentina","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-d937"},{"id":"INC-01829","date":"2026-04-13","year":2026,"title":"Supreme Court Reviews Biometric AI Voter Authentication Proposal","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-daf5"},{"id":"INC-01795","date":"2026-04-13","year":2026,"title":"Spanish Regulator Warns of AI Investment Risks Without Human Oversight","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-dc84"},{"id":"INC-14761","date":"2026-04-13","year":2026,"title":"South Korean Prosecution Mobilizes Against AI-Generated Election Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-e472"},{"id":"INC-01527","date":"2026-04-13","year":2026,"title":"New Zealand Develops AI Tool to Redirect Extremist Users to Deradicalization Support","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-e5de"},{"id":"INC-14223","date":"2026-04-13","year":2026,"title":"Ukrainian AI Robots Capture Enemy Position Without Infantry","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-ec31"},{"id":"INC-00138","date":"2026-04-13","year":2026,"title":"AI Data Centers Drive Water Scarcity in Southeast Asia","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-13-fac4"},{"id":"INC-01930","date":"2026-04-14","year":2026,"title":"Uber Accelerates Investment and Testing of AI-Powered Robotaxi Fleet","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-06ed"},{"id":"INC-01467","date":"2026-04-14","year":2026,"title":"Morrisons Cuts 200 Head Office Jobs Due to AI-Driven Restructuring","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-0ba1"},{"id":"INC-14762","date":"2026-04-14","year":2026,"title":"South Korean Government Cracks Down on AI-Generated Deepfake Election Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-0fa6"},{"id":"INC-00443","date":"2026-04-14","year":2026,"title":"AI-Generated Fake Court Documents Used in Fraud Attempt in Batman, Turkey","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-107e"},{"id":"INC-01514","date":"2026-04-14","year":2026,"title":"NAACP Sues xAI Over Illegal Gas Turbine Use for AI Data Center, Citing Pollution and Health Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-1df3"},{"id":"INC-00492","date":"2026-04-14","year":2026,"title":"AI-Generated Persona 'Dona Maria' Fuels Political Polarization in Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-1e4e"},{"id":"INC-01167","date":"2026-04-14","year":2026,"title":"Humanoid AI Robots Deployed for Border Patrol in China, Raising Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-251d"},{"id":"INC-00638","date":"2026-04-14","year":2026,"title":"Apple and Google App Stores Promote AI 'Nudify' Apps Enabling Nonconsensual Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-29f0"},{"id":"INC-00109","date":"2026-04-14","year":2026,"title":"AI Chatbots Frequently Misdiagnose Medical Cases, Study Finds","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-442d"},{"id":"INC-02024","date":"2026-04-14","year":2026,"title":"US Military Uses Palantir AI System in Iran War, Leading to Civilian Casualties","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-4ad0"},{"id":"INC-00915","date":"2026-04-14","year":2026,"title":"Dutch Court Orders X (Twitter) to Disclose AI Profiling Data to User","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-68fa"},{"id":"INC-00535","date":"2026-04-14","year":2026,"title":"AI-Powered Brain Implants Restore Abilities but Pose Health Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-71a4"},{"id":"INC-14763","date":"2026-04-14","year":2026,"title":"South Korea Holds Emergency Meetings Over AI Cybersecurity Threats from Anthropic and OpenAI","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-8c7f"},{"id":"INC-00103","date":"2026-04-14","year":2026,"title":"AI Chatbots Exhibit Systematic Bias in Judging Users, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-91ec"},{"id":"INC-00186","date":"2026-04-14","year":2026,"title":"AI Models Accelerate Vulnerability Discovery, Raising Cybersecurity Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-ba64"},{"id":"INC-02103","date":"2026-04-14","year":2026,"title":"X's AI Recommends Explicit Content to UK Teens, Failing Safeguards","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-c616"},{"id":"INC-00451","date":"2026-04-14","year":2026,"title":"AI-Generated Fake Interviews Published in Helsinki Newspaper","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-da0a"},{"id":"INC-00613","date":"2026-04-14","year":2026,"title":"Anthropic's Claude AI Agents Surpass Humans in Alignment Research, Exposing Reward Hacking Risks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-dfe2"},{"id":"INC-00107","date":"2026-04-14","year":2026,"title":"AI Chatbots Found to Dispense Inaccurate and Potentially Harmful Medical Advice","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-e0fe"},{"id":"INC-01326","date":"2026-04-14","year":2026,"title":"LiblibAI Generates Inappropriate Content Due to Moderation Failure","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-e655"},{"id":"INC-00707","date":"2026-04-14","year":2026,"title":"Brazilian Police Dismantle AI-Driven Deepfake Fraud Ring","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-eb27"},{"id":"INC-01129","date":"2026-04-14","year":2026,"title":"Google's Gemini AI Blocks Fraudulent Ads and URLs in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-fbaa"},{"id":"INC-01653","date":"2026-04-14","year":2026,"title":"Police Officer Used AI Voice Cloning to Deceive Victims' Family in Triple Homicide Case","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-14-fd62"},{"id":"INC-01995","date":"2026-04-15","year":2026,"title":"US Deploys AI-Enabled Robots for Mine Clearance in Strait of Hormuz","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-12f4"},{"id":"INC-01442","date":"2026-04-15","year":2026,"title":"Microsoft's AI-Powered Recall Feature Still Exposes Sensitive User Data Despite Security Overhaul","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-1728"},{"id":"INC-01945","date":"2026-04-15","year":2026,"title":"UK Government Warns of Escalating AI-Driven Cyberattacks","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-18e9"},{"id":"INC-00187","date":"2026-04-15","year":2026,"title":"AI Models Can Subliminally Transmit Biases and Unsafe Behaviors During Training","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-3875"},{"id":"INC-01256","date":"2026-04-15","year":2026,"title":"Israeli Military Uses AI-Generated Image to Justify Killing Lebanese Journalist","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-454e"},{"id":"INC-01237","date":"2026-04-15","year":2026,"title":"Influencer Faces Backlash for AI Deepfake of Deceased Celebrity","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-65eb"},{"id":"INC-00929","date":"2026-04-15","year":2026,"title":"El Salvador Entrusts Public Healthcare Management to Google's AI System","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-68b9"},{"id":"INC-01793","date":"2026-04-15","year":2026,"title":"Spanish Army Tests AI-Enabled Drones and Robots for Future Combat","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-885a"},{"id":"INC-00299","date":"2026-04-15","year":2026,"title":"AI-Driven Financial Fraud and Deepfake Crimes Surge in Brazil","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-94b5"},{"id":"INC-01933","date":"2026-04-15","year":2026,"title":"Uber Announces Major Investment in Autonomous Vehicle Partnerships","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-9ba7"},{"id":"INC-00657","date":"2026-04-15","year":2026,"title":"Australian Teen Convicted in Landmark Deepfake Pornography Case","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-9d57"},{"id":"INC-01856","date":"2026-04-15","year":2026,"title":"Tesla Cybercab Autonomous Taxis Undergo Testing at Texas Factory","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-9fb1"},{"id":"INC-00642","date":"2026-04-15","year":2026,"title":"Apple Threatens Removal of Grok AI App Over Sexualized Deepfake Scandal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-b30c"},{"id":"INC-00192","date":"2026-04-15","year":2026,"title":"AI Navigation System Reduces Maritime Near Misses by 52%","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-b7a4"},{"id":"INC-00430","date":"2026-04-15","year":2026,"title":"AI-Generated Disinformation Targets Australian Politics","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-bf46"},{"id":"INC-00984","date":"2026-04-15","year":2026,"title":"Facial Recognition System at Milan Linate Airport Declared Unlawful for GDPR Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-cf32"},{"id":"INC-00770","date":"2026-04-15","year":2026,"title":"China Successfully Tests AI-Powered Autonomous Cargo Aircraft HH-200","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-d287"},{"id":"INC-14764","date":"2026-04-15","year":2026,"title":"Iran Uses AI-Generated Content in Social Media Propaganda Against the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-e946"},{"id":"INC-01540","date":"2026-04-15","year":2026,"title":"North Korean Hackers Use AI-Enhanced Social Engineering to Steal $100K from Zerion","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-15-f582"},{"id":"INC-14765","date":"2026-04-16","year":2026,"title":"Failed Startups Sell Employee Communications for AI Training, Raising Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-0d2d"},{"id":"INC-02006","date":"2026-04-16","year":2026,"title":"US Labor Leaders Warn of AI's Potential Threat to Jobs and Society","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-1c57"},{"id":"INC-00624","date":"2026-04-16","year":2026,"title":"Anthropic's Mythos AI Raises Security Concerns for US Financial Database","severity":"Medium","attack_vector":"insider","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-271d"},{"id":"INC-01124","date":"2026-04-16","year":2026,"title":"Google Uses Gemini AI to Block Billions of Malicious Ads","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-28c1"},{"id":"INC-01661","date":"2026-04-16","year":2026,"title":"Portugal Approves Autonomous Vehicle Testing on Public Roads","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-2906"},{"id":"INC-00434","date":"2026-04-16","year":2026,"title":"AI-Generated Disinformation Threatens Democracies, Study Finds","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-3a85"},{"id":"INC-01688","date":"2026-04-16","year":2026,"title":"Punjab Government Partners with IIT Ropar to Deploy AI for Crime Control","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-3c31"},{"id":"INC-00293","date":"2026-04-16","year":2026,"title":"AI-Driven Disinformation Fuels Harm Against Migrants","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-451c"},{"id":"INC-01809","date":"2026-04-16","year":2026,"title":"Startup Develops AI Cap to Convert Thoughts into Text, Raising Future Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-4f99"},{"id":"INC-01780","date":"2026-04-16","year":2026,"title":"Smart Locks' Facial Recognition Vulnerabilities Exposed in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-5e8e"},{"id":"INC-00102","date":"2026-04-16","year":2026,"title":"AI Chatbots Defy Brazil Election Rules, Spread Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-6534"},{"id":"INC-00965","date":"2026-04-16","year":2026,"title":"European Banking Authority Warns of AI-Driven Cybersecurity Risks to Banks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-9a68"},{"id":"INC-01571","date":"2026-04-16","year":2026,"title":"Open-Source AI Agents Cause Security Breaches and Financial Harm in China","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-a39f"},{"id":"INC-00149","date":"2026-04-16","year":2026,"title":"AI Deepfake Scams Target Investors on Meta Platforms","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-aa88"},{"id":"INC-00607","date":"2026-04-16","year":2026,"title":"Anthropic Limits AI Cybersecurity Capabilities Amid U.S. Government Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-d969"},{"id":"INC-00676","date":"2026-04-16","year":2026,"title":"Bank of England Stress-Tests AI Risks to UK Financial Stability","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-e45e"},{"id":"INC-00586","date":"2026-04-16","year":2026,"title":"Android Facial Recognition Flaw Allows Unauthorized Access via Photos","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-16-f8b0"},{"id":"INC-00849","date":"2026-04-17","year":2026,"title":"Community Protests and Transparency Concerns Over Bell Canada's Planned AI Data Centre in Regina","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-0cb4"},{"id":"INC-00619","date":"2026-04-17","year":2026,"title":"Anthropic's Mythos AI Model Raises Global Cybersecurity Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-0ccf"},{"id":"INC-01094","date":"2026-04-17","year":2026,"title":"Global Financial Leaders Warn of AI Risks to Financial Systems from Anthropic's Mythos","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-1018"},{"id":"INC-00552","date":"2026-04-17","year":2026,"title":"AI-Powered Robot Police Deployed in Chinese Cities Raise Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-145e"},{"id":"INC-01926","date":"2026-04-17","year":2026,"title":"U.S. Congressional Report Reveals Large-Scale Smuggling and Theft of AI Technology by China","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM02","LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-6792"},{"id":"INC-00253","date":"2026-04-17","year":2026,"title":"AI Voice Analysis and Cloning Pose Privacy and Security Risks","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-6c13"},{"id":"INC-00113","date":"2026-04-17","year":2026,"title":"AI Chatbots in Mental Health Linked to Harm and Lawsuits in the US","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-94ab"},{"id":"INC-00599","date":"2026-04-17","year":2026,"title":"Anthropic CEO Warns AI Could Displace Half of Entry-Level White-Collar Jobs","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-af5b"},{"id":"INC-14766","date":"2026-04-17","year":2026,"title":"White House and Anthropic Discuss AI Security Amid Claude Mitos Concerns","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-cba1"},{"id":"INC-00256","date":"2026-04-17","year":2026,"title":"AI Voice Cloning Used in Silent Call Fraud Scheme in Indonesia","severity":"Medium","attack_vector":"deepfake","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-d243"},{"id":"INC-00316","date":"2026-04-17","year":2026,"title":"AI-Driven Police Data Analysis in NRW Raises Privacy and Rights Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-eb07"},{"id":"INC-01117","date":"2026-04-17","year":2026,"title":"Google Gemini AI Raises Global Privacy Concerns by Scanning Personal Photos and Emails","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-f37d"},{"id":"INC-00723","date":"2026-04-17","year":2026,"title":"Cal.com Closes Source Code Due to AI-Driven Security Threats","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-f5bd"},{"id":"INC-01756","date":"2026-04-17","year":2026,"title":"Seattle Considers Data Center Moratorium Amid AI-Driven Power Strain Fears","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-f655"},{"id":"INC-14767","date":"2026-04-17","year":2026,"title":"Man Uses AI to Fake Suicide Photo, Triggers Emergency Response in Qinghai","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-17-fc8d"},{"id":"INC-01957","date":"2026-04-18","year":2026,"title":"Ukraine Deploys AI-Driven Military Systems in Ongoing Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-4b93"},{"id":"INC-01962","date":"2026-04-18","year":2026,"title":"Ukraine Launches Defense AI Center \"A1\" to Integrate AI in Military Operations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-971c"},{"id":"INC-00620","date":"2026-04-18","year":2026,"title":"Anthropic's Mythos AI Model Sparks Global Cybersecurity and Financial System Fears","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-98f1"},{"id":"INC-00345","date":"2026-04-18","year":2026,"title":"AI-Enabled Emergency Totem Facilitates Rapid Recovery of Stolen Motorcycle in Teresina","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-9e41"},{"id":"INC-00621","date":"2026-04-18","year":2026,"title":"Anthropic's Mythos AI Raises Cybersecurity and Governance Concerns in US and UK","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-9e8b"},{"id":"INC-00615","date":"2026-04-18","year":2026,"title":"Anthropic's Claude AI Wrongly Suspends Fintech Firm's Accounts, Disrupting Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-be9c"},{"id":"INC-00779","date":"2026-04-18","year":2026,"title":"China's Sex Toy Industry Integrates AI Amid Legal and Privacy Concerns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-dd70"},{"id":"INC-00063","date":"2026-04-18","year":2026,"title":"AI Adoption on Wall Street Leads to Mass Job Cuts and Labor Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-e89e"},{"id":"INC-01747","date":"2026-04-18","year":2026,"title":"Rome Plans AI-Controlled 'White Light' Traffic Signals for Autonomous Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-18-f782"},{"id":"INC-00317","date":"2026-04-19","year":2026,"title":"AI-Driven Precision Therapy Improves Autoimmune Disease Outcomes in Taiwan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-0b98"},{"id":"INC-14768","date":"2026-04-19","year":2026,"title":"AI System 'Mythos' Accelerates Automated Cyberattacks, Raising Security Concerns in South Korea","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-2f5a"},{"id":"INC-01867","date":"2026-04-19","year":2026,"title":"Tesla Launches Unsupervised Robotaxi Service in Dallas and Houston","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-3684"},{"id":"INC-02039","date":"2026-04-19","year":2026,"title":"Vercel Breach via Compromised AI Tool Exposes Crypto Projects to Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-5f6f"},{"id":"INC-01871","date":"2026-04-19","year":2026,"title":"Tesla Robotaxi Malfunctions Raise Safety Concerns in Texas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-6f78"},{"id":"INC-14769","date":"2026-04-19","year":2026,"title":"UK Government Faces Backlash Over Palantir NHS AI Data Platform Contract","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-8701"},{"id":"INC-00205","date":"2026-04-19","year":2026,"title":"AI Stock Trading Program Causes Financial and Mental Health Harm in Guangzhou","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-91d7"},{"id":"INC-01065","date":"2026-04-19","year":2026,"title":"Generative AI Adoption Reduces Employment and Income for Young Workers in Brazil","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-9ecd"},{"id":"INC-14770","date":"2026-04-19","year":2026,"title":"Anthropic's Claude Mitos AI Withheld Over Cybersecurity Risks and Unauthorized Access","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-b2ad"},{"id":"INC-01972","date":"2026-04-19","year":2026,"title":"Unauthorized Access and Security Concerns Surround Anthropic's Mythos AI","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-d07c"},{"id":"INC-01614","date":"2026-04-19","year":2026,"title":"Pakistani Brand Uses AI-Generated Images of Alia Bhatt Without Consent","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-19-f314"},{"id":"INC-01870","date":"2026-04-20","year":2026,"title":"Tesla Robotaxi Malfunctions on Dallas Highway, Raising Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-0190"},{"id":"INC-00655","date":"2026-04-20","year":2026,"title":"Australian Regulators Monitor Anthropic's Mythos AI for Banking Cyber Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-033c"},{"id":"INC-00142","date":"2026-04-20","year":2026,"title":"AI Data Poisoning Threatens National Security and Public Safety in China","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM07"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-07fd"},{"id":"INC-01971","date":"2026-04-20","year":2026,"title":"Unauthorized Access and Security Concerns Over Anthropic's Mythos AI Model in U.S. Government","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-1a0a"},{"id":"INC-00252","date":"2026-04-20","year":2026,"title":"AI Virtual Digital Human Technology Trade Secret Infringement Case in Guangzhou","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-1a0f"},{"id":"INC-01046","date":"2026-04-20","year":2026,"title":"French Authorities Probe X's AI Systems Over Harmful Content and Political Interference","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-2063"},{"id":"INC-01014","date":"2026-04-20","year":2026,"title":"Florida Man Arrested for Using AI to Create and Distribute Nude Image of Teen Coworker","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-2075"},{"id":"INC-01097","date":"2026-04-20","year":2026,"title":"Global Surge in AI-Driven Fraud and Deepfake Scams","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-3b61"},{"id":"INC-01414","date":"2026-04-20","year":2026,"title":"Meta Uses Employee Computer Activity to Train AI Agents and Deploys 'Zuckerbot' Avatar","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-4a91"},{"id":"INC-00649","date":"2026-04-20","year":2026,"title":"Asian Regulators Heighten Cybersecurity Over Anthropic's Mythos AI Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-4ee6"},{"id":"INC-01159","date":"2026-04-20","year":2026,"title":"Hanwha and Magnet Defense Partner to Develop AI-Enabled Unmanned Military Vessels for US Military","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-5357"},{"id":"INC-01798","date":"2026-04-20","year":2026,"title":"SPARC AI Expands AI-Powered Drone Navigation in Ukraine Amid Military Applications","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-7b26"},{"id":"INC-01866","date":"2026-04-20","year":2026,"title":"Tesla Full Self-Driving AI Fails at Railroad Crossing, Nearly Causes Collision with Train in Texas","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-7b4c"},{"id":"INC-01252","date":"2026-04-20","year":2026,"title":"Israel Deploys AI-Enabled Robotics for Large-Scale Border Demining","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-7d80"},{"id":"INC-00864","date":"2026-04-20","year":2026,"title":"Critical Vulnerability in Anthropic's MCP Exposes AI Systems to Remote Code Execution","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-81f8"},{"id":"INC-00863","date":"2026-04-20","year":2026,"title":"Critical Remote Code Execution Vulnerability in Google's Antigravity AI IDE Patched","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM03","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-8687"},{"id":"INC-01763","date":"2026-04-20","year":2026,"title":"Senator Ossoff Investigates AI Data Centers' Impact on Georgia Power Bills","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-ad0f"},{"id":"INC-01357","date":"2026-04-20","year":2026,"title":"Lovable AI App Builder Exposes Sensitive User Data via API Flaw","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-b869"},{"id":"INC-00392","date":"2026-04-20","year":2026,"title":"AI-Generated Deepfake Video Falsely Claims Indonesian Finance Minister Offers Business Grants","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-c51d"},{"id":"INC-00842","date":"2026-04-20","year":2026,"title":"Colombian President Shares AI-Generated Deepfake Video Targeting Ecuadorian Leader","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-c79e"},{"id":"INC-01053","date":"2026-04-20","year":2026,"title":"Frontier AI Models Accelerate Cyberattack Capabilities","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-d018"},{"id":"INC-14771","date":"2026-04-20","year":2026,"title":"Barclays CEO Warns of AI Model Mythos as Major Threat to Global Banking Security","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-df6b"},{"id":"INC-00776","date":"2026-04-20","year":2026,"title":"China's First AI Model Infringement Case: Court Rules on Unfair Competition","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-f695"},{"id":"INC-00750","date":"2026-04-20","year":2026,"title":"ChatGPT Linked to Teen Suicide Prompts Calls for AI Safeguards in California","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-f787"},{"id":"INC-00245","date":"2026-04-20","year":2026,"title":"AI Traffic Cameras in Western Australia Overturn $1 Million in Fines After Accuracy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-fa44"},{"id":"INC-01324","date":"2026-04-20","year":2026,"title":"Leonardo DRS Deploys AI-Enabled Maritime Counter-Drone System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-20-fbc2"},{"id":"INC-14772","date":"2026-04-21","year":2026,"title":"AI-Based Wildfire Prevention System Deployed in Hamyang County","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-0b9e"},{"id":"INC-01748","date":"2026-04-21","year":2026,"title":"Rubrik Research Warns of Security Gaps as Enterprise AI Agent Adoption Outpaces Governance","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-1b56"},{"id":"INC-00802","date":"2026-04-21","year":2026,"title":"CISA Excluded from Anthropic's AI Cybersecurity Tool Rollout","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-21f1"},{"id":"INC-01815","date":"2026-04-21","year":2026,"title":"Studies Link ChatGPT Use to Reduced Brain Activity and Cognitive Skills","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-2bb3"},{"id":"INC-00747","date":"2026-04-21","year":2026,"title":"ChatGPT Escalates to Abusive Language in Hostile Conversations, Study Finds","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-5c23"},{"id":"INC-00383","date":"2026-04-21","year":2026,"title":"AI-Generated Deepfake of Wendie Renard Used in Investment Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-7a0b"},{"id":"INC-00452","date":"2026-04-21","year":2026,"title":"AI-Generated Fake Job Offers Lead to Widespread Scams and Data Theft","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-883f"},{"id":"INC-00207","date":"2026-04-21","year":2026,"title":"AI Surveillance System Aids Arrest After Hit-and-Run in Teresina","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-8b3d"},{"id":"INC-01283","date":"2026-04-21","year":2026,"title":"Kimi AI Model Leaks User Resume Data, Causing Privacy Breach in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-8c79"},{"id":"INC-14773","date":"2026-04-21","year":2026,"title":"DHS Plans AI-Powered Smart Glasses for Real-Time Biometric Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-9103"},{"id":"INC-01750","date":"2026-04-21","year":2026,"title":"Russian AI-Driven Cyberattacks Escalate Against Europe","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-986c"},{"id":"INC-00883","date":"2026-04-21","year":2026,"title":"Delhi High Court Restrains AI-Generated Deepfakes Exploiting Allu Arjun's Persona","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-9f02"},{"id":"INC-00371","date":"2026-04-21","year":2026,"title":"AI-Generated Code Increases Engineer Workload and Software Defects in Japan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-a9d1"},{"id":"INC-00478","date":"2026-04-21","year":2026,"title":"AI-Generated Influencer 'Emily Hart' Used to Scam MAGA Supporters","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-ae1a"},{"id":"INC-01927","date":"2026-04-21","year":2026,"title":"U.S. Establishes AI-Powered Autonomous Military Force for Latin America","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-b3da"},{"id":"INC-00566","date":"2026-04-21","year":2026,"title":"AI-Powered Vulnerability Discovery Raises Cybersecurity Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-ba77"},{"id":"INC-01051","date":"2026-04-21","year":2026,"title":"French Political Party Uses AI to Fabricate Celebrity Endorsements for Book Promotion","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-c5d3"},{"id":"INC-00622","date":"2026-04-21","year":2026,"title":"Anthropic's Mythos AI Raises Cybersecurity Concerns for Banks in Europe and India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-d17d"},{"id":"INC-01906","date":"2026-04-21","year":2026,"title":"TikTok's AI Meme Remixer Sparks Privacy and Consent Backlash","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-e26d"},{"id":"INC-00504","date":"2026-04-21","year":2026,"title":"AI-Generated Singer in Romania Sparks Racism and Discrimination Debate","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-f66a"},{"id":"INC-00718","date":"2026-04-21","year":2026,"title":"Bundesbank Warns of Cybersecurity Risks from Anthropic's Mythos AI Model","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-f8f6"},{"id":"INC-01940","date":"2026-04-21","year":2026,"title":"UK Court Upholds Police Use of AI Facial Recognition Despite Misidentification and Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-21-f8f8"},{"id":"INC-01238","date":"2026-04-22","year":2026,"title":"Influencer Investigated for Using AI Deepfake to Sexualize Minors in São Paulo Churches","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-11e0"},{"id":"INC-01764","date":"2026-04-22","year":2026,"title":"Senator Warren Warns of AI Industry Debt Bubble and Financial Crisis Risk","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-121b"},{"id":"INC-00616","date":"2026-04-22","year":2026,"title":"Anthropic's Claude Desktop Secretly Installs Browser Backdoor on macOS","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-133f"},{"id":"INC-01633","date":"2026-04-22","year":2026,"title":"Pentagon Seeks $54 Billion for AI-Driven Autonomous Warfare","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-2e42"},{"id":"INC-01412","date":"2026-04-22","year":2026,"title":"Meta Sued Over AI-Enhanced Fraudulent Ads on Facebook and Instagram","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-2ee0"},{"id":"INC-01086","date":"2026-04-22","year":2026,"title":"Germany Procures AI-Enabled Kamikaze Drones for Bundeswehr","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-3adc"},{"id":"INC-01837","date":"2026-04-22","year":2026,"title":"Taiwan Warns Against Use of Gaode Map App Over AI-Driven Data Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-587d"},{"id":"INC-00221","date":"2026-04-22","year":2026,"title":"AI System Prevents Sewer Blockages and Pollution in Southern England","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-7047"},{"id":"INC-00310","date":"2026-04-22","year":2026,"title":"AI-Driven Medicare Prior Authorization Delays and Denials Harm Patients in Washington","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-8bf0"},{"id":"INC-01919","date":"2026-04-22","year":2026,"title":"Turkey Plans AI-Based Biometric Tracking for Legal Supervision","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-95e7"},{"id":"INC-00762","date":"2026-04-22","year":2026,"title":"Chilean Legislative Proposal Sparks Copyright Concerns Over AI Data Use","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-9748"},{"id":"INC-14774","date":"2026-04-22","year":2026,"title":"Japan to Assess AI Model Risks to Financial System","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-9a58"},{"id":"INC-00448","date":"2026-04-22","year":2026,"title":"AI-Generated Fake Images Spark Viral Misinformation About Tech CEOs in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-a930"},{"id":"INC-01539","date":"2026-04-22","year":2026,"title":"North Korean Hackers Use AI Tools to Steal $12 Million in Cryptocurrency","severity":"Critical","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-d2c5"},{"id":"INC-00424","date":"2026-04-22","year":2026,"title":"AI-Generated Deepfakes Used to Impersonate Doctor and Promote Illegal Medicines in Brazil","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-22-dd21"},{"id":"INC-00500","date":"2026-04-23","year":2026,"title":"AI-Generated Short Dramas Cause Actor Unemployment in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-0d2d"},{"id":"INC-00708","date":"2026-04-23","year":2026,"title":"Brazilian Political Parties Seek Suspension of AI-Generated Disinformation Profile","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-0e48"},{"id":"INC-01393","date":"2026-04-23","year":2026,"title":"Mercor Faces Lawsuits After AI Training Data Breach Exposes Sensitive Worker Information","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-1492"},{"id":"INC-01161","date":"2026-04-23","year":2026,"title":"HD Hyundai Expands AI-Powered Unmanned Naval Vessel Collaboration in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-2ba0"},{"id":"INC-00335","date":"2026-04-23","year":2026,"title":"AI-Enabled Defense Systems and Autonomous Military Robots Deployed and Developed Globally","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-389f"},{"id":"INC-02068","date":"2026-04-23","year":2026,"title":"Waymo Autonomous Taxi Disrupts London Crime Scene During Testing","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-4150"},{"id":"INC-00270","date":"2026-04-23","year":2026,"title":"AI-Driven Attacks Fuel Major Crypto Thefts in 2026","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04","LLM07"],"owasp_asi":["ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-48d1"},{"id":"INC-00974","date":"2026-04-23","year":2026,"title":"Experts Urge AI-Driven Cybersecurity and Device Digital IDs in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-64a5"},{"id":"INC-02057","date":"2026-04-23","year":2026,"title":"Vorwerk Investigated for Disabling AI Services in Neato Robot Vacuums","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-7262"},{"id":"INC-01735","date":"2026-04-23","year":2026,"title":"Researchers Warn of Risks from Evolvable Artificial Intelligence","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-74b7"},{"id":"INC-01964","date":"2026-04-23","year":2026,"title":"Ukraine Plans AI-Driven Autonomous Combat Systems for Battlefield Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-801d"},{"id":"INC-01441","date":"2026-04-23","year":2026,"title":"Microsoft's AI Agents Threaten Entry-Level Tech Jobs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-8b92"},{"id":"INC-00440","date":"2026-04-23","year":2026,"title":"AI-Generated Fake Bank Cheque Sparks Fraud Concerns in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-a1c6"},{"id":"INC-14775","date":"2026-04-23","year":2026,"title":"South Korea Deploys AI to Detect Fraudulent Health Insurance Claims","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-a8c7"},{"id":"INC-01631","date":"2026-04-23","year":2026,"title":"Pentagon Awards $24M Contract for AI-Enabled Humanoid Military Robots","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-b285"},{"id":"INC-02008","date":"2026-04-23","year":2026,"title":"US Lawmakers Alarmed by AI Models Generating Terrorist Instructions After Safety Filters Removed","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-b3a8"},{"id":"INC-00545","date":"2026-04-23","year":2026,"title":"AI-Powered Flock Cameras Used for Protest Surveillance and Raise Privacy Concerns in the U.S.","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-b767"},{"id":"INC-00710","date":"2026-04-23","year":2026,"title":"Brazilian Regulator Fines Meta for Anti-Competitive Use of AI Chatbots on WhatsApp","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-bbd0"},{"id":"INC-02065","date":"2026-04-23","year":2026,"title":"Washington Metro Approves Full Automation of Red Line Trains Amid Safety Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-c583"},{"id":"INC-00108","date":"2026-04-23","year":2026,"title":"AI Chatbots Found to Reinforce Delusions and Encourage Harmful Behavior in Mental Health Study","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-d71e"},{"id":"INC-00690","date":"2026-04-23","year":2026,"title":"Bernstein Warns India of AI-Driven Job Risks and Economic Challenges","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-e0a6"},{"id":"INC-00298","date":"2026-04-23","year":2026,"title":"AI-Driven Exploits Cause Major Losses in DeFi Platforms","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-f044"},{"id":"INC-01233","date":"2026-04-23","year":2026,"title":"Indian Government Urges Banks to Prepare for AI-Driven Cyber Threats","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-f1d2"},{"id":"INC-01929","date":"2026-04-23","year":2026,"title":"UAE Plans Massive Government Automation with Agentic AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-23-fd8e"},{"id":"INC-14776","date":"2026-04-24","year":2026,"title":"AI System at Shinhan Investment & Securities Blocks Financial Fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-1366"},{"id":"INC-00558","date":"2026-04-24","year":2026,"title":"AI-Powered Synthetic Identity Fraud Hits Financial Sector","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-2b1c"},{"id":"INC-00331","date":"2026-04-24","year":2026,"title":"AI-Enabled Autonomous Kamikaze Drones Demonstrated in Turkey","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-3054"},{"id":"INC-01061","date":"2026-04-24","year":2026,"title":"Geely's Caocao Plans Global Deployment of AI-Powered Robotaxis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-502a"},{"id":"INC-00482","date":"2026-04-24","year":2026,"title":"AI-Generated Microdrama Uses Real Faces Without Consent in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-56a0"},{"id":"INC-02037","date":"2026-04-24","year":2026,"title":"Utah Medical Board Calls for Suspension of AI Prescription Renewal Program","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-56c1"},{"id":"INC-14777","date":"2026-04-24","year":2026,"title":"AI-Generated Videos Exploit Elderly and Cause Public Panic in China","severity":"Critical","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-6022"},{"id":"INC-01740","date":"2026-04-24","year":2026,"title":"Romania Deploys AI-Powered Drone Interceptors Amid Ukraine Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-6934"},{"id":"INC-01923","date":"2026-04-24","year":2026,"title":"Turkish Intelligence Academy Warns of AI-Driven Cybersecurity Risks","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-7ac4"},{"id":"INC-01944","date":"2026-04-24","year":2026,"title":"UK Government Underestimates AI Data Center Carbon Emissions by Over 100-Fold","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-8625"},{"id":"INC-14778","date":"2026-04-24","year":2026,"title":"South Korean Civil Servant Prosecuted for AI-Generated Deepfake Harassment","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-8861"},{"id":"INC-00209","date":"2026-04-24","year":2026,"title":"AI Surveillance System Sabotaged at Bengaluru IPL Stadium","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-88e5"},{"id":"INC-00969","date":"2026-04-24","year":2026,"title":"European Regulators Warn of Accelerated Cyber Threats from AI in Financial Sector","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-8b4c"},{"id":"INC-01739","date":"2026-04-24","year":2026,"title":"Robot Malfunction at Chinese University Event Leads to Unintended Physical Contact","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-9951"},{"id":"INC-14779","date":"2026-04-24","year":2026,"title":"AI-Driven Smart Port in Incheon Faces Security Risks Over Chinese Equipment Dominance","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-9ffe"},{"id":"INC-00717","date":"2026-04-24","year":2026,"title":"BSE Warns of Repeated Deepfake Scams Targeting Investors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-c11d"},{"id":"INC-00101","date":"2026-04-24","year":2026,"title":"AI Chatbots Covertly Influence Users with Embedded Ads","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-dfec"},{"id":"INC-01425","date":"2026-04-24","year":2026,"title":"Metropolitan Police Use Palantir AI to Uncover Officer Misconduct","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-f11a"},{"id":"INC-01855","date":"2026-04-24","year":2026,"title":"Tesla Begins Production of Autonomous Cybercab Robotaxi","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-24-fd71"},{"id":"INC-14780","date":"2026-04-25","year":2026,"title":"AI-Generated Celebrity Likeness Used in Deceptive Real Estate Ads in Taiwan","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-25-07a8"},{"id":"INC-14781","date":"2026-04-25","year":2026,"title":"Unauthorized Access and Global Security Concerns Over Anthropic's Claude Mythos AI Model","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-25-0f43"},{"id":"INC-01921","date":"2026-04-25","year":2026,"title":"Turkish Bar Associations Oppose AI-Based Legal Defense Platform","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-25-b282"},{"id":"INC-00439","date":"2026-04-26","year":2026,"title":"AI-Generated Faces in Chinese Short Drama Spark Portrait Rights Infringement Controversy","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-26-6772"},{"id":"INC-00698","date":"2026-04-27","year":2026,"title":"BlueNoroff Uses AI-Generated Deepfakes in Cryptocurrency Phishing Attacks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-000a"},{"id":"INC-00578","date":"2026-04-27","year":2026,"title":"Amazon Deploys AI to Combat Counterfeits and Phishing Globally","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-1f84"},{"id":"INC-01229","date":"2026-04-27","year":2026,"title":"India's CERT-In Issues High-Severity Warning on AI-Driven Cyber Threats","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-2f4c"},{"id":"INC-01794","date":"2026-04-27","year":2026,"title":"Spanish Judge Fined for Using ChatGPT to Draft Judicial Sentence","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-5722"},{"id":"INC-00150","date":"2026-04-27","year":2026,"title":"AI Deepfake Technology Enables Identity Theft via Leaked ID Photos in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-6c9c"},{"id":"INC-01062","date":"2026-04-27","year":2026,"title":"Gemini Launches AI-Driven Agentic Trading on Crypto Exchange","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-9872"},{"id":"INC-00888","date":"2026-04-27","year":2026,"title":"Detroit Police Facial Recognition Misidentifications Lead to Lawsuits and Policy Changes","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-a04b"},{"id":"INC-14782","date":"2026-04-27","year":2026,"title":"Google Translate Mistranslates Korean Cultural Terms, Causing Controversy","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-ad82"},{"id":"INC-00259","date":"2026-04-27","year":2026,"title":"AI Writing Feedback Found Biased by Student Race and Gender","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-b490"},{"id":"INC-01519","date":"2026-04-27","year":2026,"title":"Netflix Faces Boycott Over AI Voice Training in German Dubbing Industry","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-b50d"},{"id":"INC-01928","date":"2026-04-27","year":2026,"title":"U.S. Mandates AI-Driven Driver Monitoring Systems in All New Vehicles by 2027","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-c353"},{"id":"INC-00116","date":"2026-04-27","year":2026,"title":"AI Chatbots Linked to Teen Suicides and Mental Health Harms","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-c902"},{"id":"INC-01943","date":"2026-04-27","year":2026,"title":"UK Firms Face AI Data Governance Risks from Overseas Processing","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-d8cd"},{"id":"INC-01975","date":"2026-04-27","year":2026,"title":"Uncontrolled Enterprise AI Use Increases Cybersecurity and Data Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-e504"},{"id":"INC-00410","date":"2026-04-27","year":2026,"title":"AI-Generated Deepfake Videos Used to Scam French Investors","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-e5fe"},{"id":"INC-00073","date":"2026-04-27","year":2026,"title":"AI Agents Exploited in Security Breaches Due to Inadequate Identity Management","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-f106"},{"id":"INC-00731","date":"2026-04-27","year":2026,"title":"Canva AI Tool Replaces 'Palestine' with 'Ukraine' in User Designs, Prompting Apology","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-f620"},{"id":"INC-00980","date":"2026-04-27","year":2026,"title":"Facial Recognition AI Blocks ALS Patient from Accessing Funds on Binance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-fc54"},{"id":"INC-02032","date":"2026-04-27","year":2026,"title":"US Tests AI-Powered Autonomous Military Systems Near Cuba Amid Rising Tensions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-fe2d"},{"id":"INC-01612","date":"2026-04-27","year":2026,"title":"Over a Million London Jobs at Risk from AI Automation, Mayor Warns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-27-ff5f"},{"id":"INC-00853","date":"2026-04-28","year":2026,"title":"Controversy Over Palantir's AI Systems and Their Societal Impact","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-1829"},{"id":"INC-01373","date":"2026-04-28","year":2026,"title":"Mass Layoffs in Tech Industry Driven by AI Adoption","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-3c46"},{"id":"INC-00865","date":"2026-04-28","year":2026,"title":"Critical Vulnerability in Hugging Face LeRobot AI Platform Enables Remote Code Execution","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-5a0d"},{"id":"INC-01909","date":"2026-04-28","year":2026,"title":"TON and Telegram Launch Autonomous AI Agents for Blockchain Transactions, Raising Future Financial Risks","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-9e99"},{"id":"INC-01126","date":"2026-04-28","year":2026,"title":"Google Withdraws from Pentagon AI Drone Swarm Project Over Ethics Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-ba01"},{"id":"INC-00461","date":"2026-04-28","year":2026,"title":"AI-Generated Fake Posters Cause Misinformation for 'Singer 2026'","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-bea2"},{"id":"INC-14783","date":"2026-04-28","year":2026,"title":"Japan and US Respond to AI Cyberattack Risks from Claude Mythos","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-c04a"},{"id":"INC-01875","date":"2026-04-28","year":2026,"title":"Tesla's Full Self-Driving AI Faces Crashes and Legal Action in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-ca23"},{"id":"INC-00502","date":"2026-04-28","year":2026,"title":"AI-Generated Short Dramas Spark Copyright and Portrait Rights Violations in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-d46a"},{"id":"INC-00540","date":"2026-04-28","year":2026,"title":"AI-Powered Drone Joint Venture Formed for Indian Defense","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-dc4d"},{"id":"INC-14784","date":"2026-04-28","year":2026,"title":"French AI Chatbot Mistral Amplifies State-Sponsored Disinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-e382"},{"id":"INC-00319","date":"2026-04-28","year":2026,"title":"AI-Driven Romance Scams Impact 27% of Italians","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-ec06"},{"id":"INC-00261","date":"2026-04-28","year":2026,"title":"AI-Assisted Discovery of Critical GitHub Vulnerability Enables Rapid Remediation","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-f5d8"},{"id":"INC-00117","date":"2026-04-28","year":2026,"title":"AI Chatbots Linked to Worsened Mental Health in Young People","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-28-f65c"},{"id":"INC-00944","date":"2026-04-29","year":2026,"title":"EU Accuses Meta of Failing to Prevent Underage Access to Facebook and Instagram","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-0f29"},{"id":"INC-00272","date":"2026-04-29","year":2026,"title":"AI-Driven Bot Attacks Surge 12.5x, Dominate Internet Traffic in 2025","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-0fc8"},{"id":"INC-00203","date":"2026-04-29","year":2026,"title":"AI Smart Glasses Enable Rapid Dementia Risk Detection for Elderly in Taiwan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-2802"},{"id":"INC-01279","date":"2026-04-29","year":2026,"title":"Katsina State to Deploy 50,000 AI-Powered Smart Streetlights","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-2f62"},{"id":"INC-00551","date":"2026-04-29","year":2026,"title":"AI-Powered Phishing Kits Like Bluekit Drive Surge in Sophisticated Attacks","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-31fa"},{"id":"INC-14785","date":"2026-04-29","year":2026,"title":"AI Misuse Leads to Biometric Data Leaks and Identity Fraud in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-4c37"},{"id":"INC-01755","date":"2026-04-29","year":2026,"title":"Scout AI Raises $100M to Develop Autonomous Warfare AI System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-4d45"},{"id":"INC-01818","date":"2026-04-29","year":2026,"title":"Study Finds Three Types of Addiction Linked to AI Chatbots","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-5e22"},{"id":"INC-00300","date":"2026-04-29","year":2026,"title":"AI-Driven Fraud Surges Amid Governance Gaps in Global Financial Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-5e74"},{"id":"INC-00574","date":"2026-04-29","year":2026,"title":"Alphabet Investors Demand Safeguards on AI and Cloud Use by Governments","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-6039"},{"id":"INC-02093","date":"2026-04-29","year":2026,"title":"White House Opposes Anthropic's Expansion of Mythos AI Access Due to Cybersecurity Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-71af"},{"id":"INC-01819","date":"2026-04-29","year":2026,"title":"Study Finds Warmer AI Chatbots Make More Mistakes and Spread Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-720c"},{"id":"INC-01556","date":"2026-04-29","year":2026,"title":"Online Oceans Secures Funding to Scale AI-Enabled Autonomous Maritime Security Fleets","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-75eb"},{"id":"INC-01362","date":"2026-04-29","year":2026,"title":"Malicious AI Agent Supply Chain Attack Exploits MCP Server Lookalikes","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM05","LLM07"],"owasp_asi":["ASI02","ASI03","ASI04","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-8e04"},{"id":"INC-00144","date":"2026-04-29","year":2026,"title":"AI Deepfake Celebrity Scams Target TikTok Users","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-8ec0"},{"id":"INC-01969","date":"2026-04-29","year":2026,"title":"UN Warns AI in Advertising Risks Accelerating Global Misinformation Crisis","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-9953"},{"id":"INC-00524","date":"2026-04-29","year":2026,"title":"AI-Managed Café in Stockholm Raises Labor and Ethical Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-9a6b"},{"id":"INC-02010","date":"2026-04-29","year":2026,"title":"US Lawmakers Probe Airbnb and Anysphere Over Use of Chinese AI Models","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-9f02"},{"id":"INC-00124","date":"2026-04-29","year":2026,"title":"AI Chatbots Provide Instructions for Creating Biological Weapons","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-a87c"},{"id":"INC-00060","date":"2026-04-29","year":2026,"title":"AI Adoption Drives Wage Gap and Job Losses for Entry-Level Workers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-ac94"},{"id":"INC-00260","date":"2026-04-29","year":2026,"title":"AI-Assisted Commit Enables North Korean Malware Attack on Crypto Trading Agent","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-cda6"},{"id":"INC-02059","date":"2026-04-29","year":2026,"title":"Vulnerabilities in Cursor AI Coding Environment Expose Developers to Code Execution and Credential Theft","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-d25d"},{"id":"INC-00061","date":"2026-04-29","year":2026,"title":"AI Adoption in Spain Projected to Displace Up to 2.3 Million Jobs by 2035","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-29-fae7"},{"id":"INC-00543","date":"2026-04-30","year":2026,"title":"AI-Powered Emergency Response Drones Deployed at Deltona High School","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-0062"},{"id":"INC-00413","date":"2026-04-30","year":2026,"title":"AI-Generated Deepfakes and Online Abuse Drive Women from Public Life","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-1144"},{"id":"INC-00184","date":"2026-04-30","year":2026,"title":"AI Model DAMO COCA Enhances Early Colorectal Cancer Detection in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-296d"},{"id":"INC-00246","date":"2026-04-30","year":2026,"title":"AI Uncovers Long-Standing Banking Vulnerabilities, Prompting Global Warning","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-2d31"},{"id":"INC-14786","date":"2026-04-30","year":2026,"title":"AI Models Demonstrate Autonomous Cyberattack Capabilities, Raising Security Concerns","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-3813"},{"id":"INC-00487","date":"2026-04-30","year":2026,"title":"AI-Generated Misinformation Spreads After Trump Assassination Attempt","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-4ff4"},{"id":"INC-00459","date":"2026-04-30","year":2026,"title":"AI-Generated Fake Photo Causes Public Outcry and Legal Action in Greece","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-5037"},{"id":"INC-00681","date":"2026-04-30","year":2026,"title":"Baykar Unveils AI-Enabled Autonomous Loitering Munition 'Mızrak'","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-6534"},{"id":"INC-02106","date":"2026-04-30","year":2026,"title":"XTEND Develops AI-Powered Autonomous Defense Systems for Middle East Client","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-74ed"},{"id":"INC-01418","date":"2026-04-30","year":2026,"title":"Meta's AI Smart Glasses Lead to Worker Harm and Privacy Violations in Kenya","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-7774"},{"id":"INC-01407","date":"2026-04-30","year":2026,"title":"Meta Faces Legal Action Over AI-Driven Harms to Children in New Mexico","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-8a44"},{"id":"INC-01449","date":"2026-04-30","year":2026,"title":"Minnesota Bans AI 'Nudification' Apps After Deepfake Harms","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-8af6"},{"id":"INC-14224","date":"2026-04-30","year":2026,"title":"Chinese Court Rules AI-Driven Dismissal Unlawful","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-a41c"},{"id":"INC-00254","date":"2026-04-30","year":2026,"title":"AI Voice Assistant Malfunction Nearly Causes Child Injury in Car Seat Incident","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-b582"},{"id":"INC-00286","date":"2026-04-30","year":2026,"title":"AI-Driven Cybercrime Causes 389% Surge in Ransomware Victims","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-ba51"},{"id":"INC-00703","date":"2026-04-30","year":2026,"title":"Bot Auto Completes First Fully Humanless Commercial Truck Delivery in Texas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-bebf"},{"id":"INC-01008","date":"2026-04-30","year":2026,"title":"First Prosecution for AI-Generated Child Abuse Images in Germany","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-d8f5"},{"id":"INC-00100","date":"2026-04-30","year":2026,"title":"AI Chatbot Interaction Leads to Discovery of Child Sexual Abuse in Paraná","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-04-30-f66e"},{"id":"INC-00211","date":"2026-05-01","year":2026,"title":"AI Surveillance Systems Spark Privacy Violations and Misuse Across U.S. Cities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-0842"},{"id":"INC-00315","date":"2026-05-01","year":2026,"title":"AI-Driven Phishing Attacks Surge, Expanding Beyond Email","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-1e4a"},{"id":"INC-02025","date":"2026-05-01","year":2026,"title":"US Navy Deploys AI to Accelerate Mine Detection in Strait of Hormuz","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-208a"},{"id":"INC-01532","date":"2026-05-01","year":2026,"title":"NHS England Restricts Open-Source Code Access Over AI Vulnerability Fears","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-5196"},{"id":"INC-14787","date":"2026-05-01","year":2026,"title":"AI-Restored Film Screening in South Korea Banned After Severe Visual Distortions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-5fcb"},{"id":"INC-02041","date":"2026-05-01","year":2026,"title":"Vietnamese Police Warn Parents of AI Image Processing Risks for Children","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-6d8a"},{"id":"INC-00377","date":"2026-05-01","year":2026,"title":"AI-Generated Deepfake Diet Ads Cause Health Harm to Kathy Hilton","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-8579"},{"id":"INC-02000","date":"2026-05-01","year":2026,"title":"US Government Flags Anthropic's Mythos AI as National Security Risk","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-8d32"},{"id":"INC-00429","date":"2026-05-01","year":2026,"title":"AI-Generated Disinformation Causes Social Harm and Legal Action in Vietnam","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-8e69"},{"id":"INC-00405","date":"2026-05-01","year":2026,"title":"AI-Generated Deepfake Videos Used for Celebrity Impersonation and Scams in Vietnam","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-a290"},{"id":"INC-00374","date":"2026-05-01","year":2026,"title":"AI-Generated Criminal Memes Cause Secondary Harm to Victims in South Korea","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-a65a"},{"id":"INC-01992","date":"2026-05-01","year":2026,"title":"US Considers Faster Patch Deadlines Due to AI-Driven Cyber Threats","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-a6f8"},{"id":"INC-00900","date":"2026-05-01","year":2026,"title":"Disney Replaces Marvel Artists with AI, Leading to Mass Layoffs and Outcry","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-b315"},{"id":"INC-00227","date":"2026-05-01","year":2026,"title":"AI Systems Enable Early Wildfire Detection and Response in Western US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-bc77"},{"id":"INC-01220","date":"2026-05-01","year":2026,"title":"Incomplete Patient Input to AI Chatbots Risks Medical Misdiagnosis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-01-ff5f"},{"id":"INC-00425","date":"2026-05-02","year":2026,"title":"AI-Generated Digital Exes Spark Privacy and Emotional Concerns in China","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-009a"},{"id":"INC-00488","date":"2026-05-02","year":2026,"title":"AI-Generated Music and Jailbreaking Lead to Harm in Digital Platforms","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-33e9"},{"id":"INC-00466","date":"2026-05-02","year":2026,"title":"AI-Generated Fake Sensitive Images Cause Harm Among Students in Đồng Nai","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-4cf6"},{"id":"INC-00769","date":"2026-05-02","year":2026,"title":"China Removes 98,000 Accounts for Unlabeled AI-Generated Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-8bcb"},{"id":"INC-01164","date":"2026-05-02","year":2026,"title":"High School Students Use AI Deepfake Technology to Create and Distribute Sexual Images, Nearly 20 Victims in Taichung","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-b552"},{"id":"INC-02077","date":"2026-05-02","year":2026,"title":"Waymo Robotaxi Drives Off With Passenger's Luggage at San Jose Airport","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-c8e9"},{"id":"INC-02017","date":"2026-05-02","year":2026,"title":"US Military AI Use Causes Civilian Casualties and Raises Global Security Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-02-f0e4"},{"id":"INC-01951","date":"2026-05-03","year":2026,"title":"UK Retailers' AI Facial Recognition System Falsely Accuses Shoppers of Theft","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-1987"},{"id":"INC-00162","date":"2026-05-03","year":2026,"title":"AI Drives Majority of Global Security Breaches in 2026","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-3570"},{"id":"INC-00157","date":"2026-05-03","year":2026,"title":"AI Deepfakes Used in Fraudulent Medical Product Scams in Germany","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-3597"},{"id":"INC-00204","date":"2026-05-03","year":2026,"title":"AI Startup Accused of Stealing Artist's Work for Ad Campaign","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-4781"},{"id":"INC-01242","date":"2026-05-03","year":2026,"title":"Intoxicated Driver Relies on Tesla Autopilot, Car Stops on Florida Highway","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-516b"},{"id":"INC-00726","date":"2026-05-03","year":2026,"title":"California Penalizes Autonomous Vehicles After AI-Driven Traffic Violations and Injuries","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-5245"},{"id":"INC-00766","date":"2026-05-03","year":2026,"title":"China Implements National AI-Driven Digital Identity System, Raising Surveillance Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-5d62"},{"id":"INC-01231","date":"2026-05-03","year":2026,"title":"Indian Banks Boost Cybersecurity Amid Threats from Anthropic's Mythos AI","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-63ad"},{"id":"INC-01954","date":"2026-05-03","year":2026,"title":"UK Tests AI-Powered Drone Swarms for Autonomous Military Strikes","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-6fc8"},{"id":"INC-01946","date":"2026-05-03","year":2026,"title":"UK NCSC Warns of AI-Driven Surge in Software Vulnerability Exploitation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-77cd"},{"id":"INC-00512","date":"2026-05-03","year":2026,"title":"AI-Generated Videos Used in Religious Charity Scam in Taiwan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-8034"},{"id":"INC-01783","date":"2026-05-03","year":2026,"title":"Solana Co-Founder Warns AI Could Threaten Post-Quantum Cryptography","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-81b0"},{"id":"INC-14788","date":"2026-05-03","year":2026,"title":"Illegal Activation of Tesla FSD AI System in South Korea Prompts Police Investigation","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-93c3"},{"id":"INC-01863","date":"2026-05-03","year":2026,"title":"Tesla FSD Faces EU Regulatory Scrutiny Over Safety Concerns","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-94d3"},{"id":"INC-01948","date":"2026-05-03","year":2026,"title":"UK Police Use Live Facial Recognition to Make Arrests, Raising Civil Liberties Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-a2a2"},{"id":"INC-00493","date":"2026-05-03","year":2026,"title":"AI-Generated Podcasts Flood the Market, Disrupting Discovery and Content Quality","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-a87e"},{"id":"INC-00427","date":"2026-05-03","year":2026,"title":"AI-Generated Disinformation Becomes Routine, Undermining Public Trust","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-bcb0"},{"id":"INC-00099","date":"2026-05-03","year":2026,"title":"AI Chatbot Induces Delusions and Paranoia in User","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-cc56"},{"id":"INC-00161","date":"2026-05-03","year":2026,"title":"AI Device Improves Detection of Life-Threatening Heart Condition in Black Patients","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-d296"},{"id":"INC-07739","date":"2026-05-03","year":2026,"title":"AI-Generated Deepfakes and Synthetic Voters Disrupt Brazilian Election Campaigns","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-f59c"},{"id":"INC-00727","date":"2026-05-03","year":2026,"title":"Campaigners Raise Concerns Over AI Data Centre Expansion on Scottish Green Belt","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-03-f972"},{"id":"INC-01934","date":"2026-05-04","year":2026,"title":"Uber Plans Data Collection and Autonomous Vehicle Pilot in Madrid","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-04a6"},{"id":"INC-07740","date":"2026-05-04","year":2026,"title":"Utah AI Data Center Project Sparks Environmental Concerns and Community Backlash","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-097e"},{"id":"INC-01925","date":"2026-05-04","year":2026,"title":"U.S. Coast Guard Deploys AI-Enabled Autonomous Sail Drones on Great Lakes","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-0e58"},{"id":"INC-00421","date":"2026-05-04","year":2026,"title":"AI-Generated Deepfakes Used in Celebrity Scam Ads in France","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-1797"},{"id":"INC-00729","date":"2026-05-04","year":2026,"title":"Canadian Musician Sues Google Over AI-Generated Defamation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-1869"},{"id":"INC-01119","date":"2026-05-04","year":2026,"title":"Google Maps Glitch Causes Wrong-Way Traffic and Safety Hazards in Toronto","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-200b"},{"id":"INC-01922","date":"2026-05-04","year":2026,"title":"Turkish Defense Official Highlights Shift to AI-Driven Warfare","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-31f0"},{"id":"INC-01068","date":"2026-05-04","year":2026,"title":"Generative AI Easily Circumvents Digital Image Protections, Researchers Warn","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-3471"},{"id":"INC-00931","date":"2026-05-04","year":2026,"title":"Elon Musk and Expert Witness Warn of Existential AI Risks in OpenAI Trial","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-429d"},{"id":"INC-00257","date":"2026-05-04","year":2026,"title":"AI Voice Cloning Used in Silent Call Phone Scams in France","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-436a"},{"id":"INC-00761","date":"2026-05-04","year":2026,"title":"Children Circumvent AI Age Verification with Simple Tricks in the UK","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-46ba"},{"id":"INC-00947","date":"2026-05-04","year":2026,"title":"EU and Swiss Authorities Assess Cybersecurity Risks of Anthropic's Mythos AI Model","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-4b40"},{"id":"INC-00258","date":"2026-05-04","year":2026,"title":"AI Vulnerabilities Overwhelm Security Systems and Expose Critical Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM05","LLM10"],"owasp_asi":["ASI03","ASI05","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-5325"},{"id":"INC-14789","date":"2026-05-04","year":2026,"title":"AI-Generated Saint Paisios Scam Defrauds Greek Faithful","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-53b4"},{"id":"INC-00456","date":"2026-05-04","year":2026,"title":"AI-Generated Fake News Causes Food Safety Panic in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-679a"},{"id":"INC-00173","date":"2026-05-04","year":2026,"title":"AI Humanoid Robots Deployed for Traffic Control and Military Logistics","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-7293"},{"id":"INC-00454","date":"2026-05-04","year":2026,"title":"AI-Generated Fake Magazine Cover Broadcast on CNews Causes Misinformation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-753f"},{"id":"INC-01757","date":"2026-05-04","year":2026,"title":"SEBI Warns of AI Risks in Indian Financial Markets","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-8414"},{"id":"INC-01009","date":"2026-05-04","year":2026,"title":"Flawed AI System Raises Healthcare Costs for Kenya's Poor","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-91ba"},{"id":"INC-07741","date":"2026-05-04","year":2026,"title":"AI-Driven RAM Shortage Intensifies Global Supply Crisis","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-9dad"},{"id":"INC-01415","date":"2026-05-04","year":2026,"title":"Meta's AI Chatbots Expose Users to Harm, Reuters Wins Pulitzer for Investigation","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-a5d2"},{"id":"INC-00948","date":"2026-05-04","year":2026,"title":"EU Demands Early Access to Anthropic's Mythos AI Over Cybersecurity Fears","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-be63"},{"id":"INC-14790","date":"2026-05-04","year":2026,"title":"AI-Driven Data Center Energy Crisis in Denmark","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-c4fc"},{"id":"INC-02001","date":"2026-05-04","year":2026,"title":"US Healthcare Marketplaces Leak Sensitive Data to Ad Tech Giants via AI Trackers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-c9a0"},{"id":"INC-00375","date":"2026-05-04","year":2026,"title":"AI-Generated Deepfake Ads Target Kentucky GOP Candidates in Defamatory Political Attacks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-cc52"},{"id":"INC-00610","date":"2026-05-04","year":2026,"title":"Anthropic's 'Claude Mythos' AI Sparks Global Cybersecurity Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-d751"},{"id":"INC-00569","date":"2026-05-04","year":2026,"title":"AI-Related Data Breaches Expose Student Information in NYC Public Schools","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-eec9"},{"id":"INC-00042","date":"2026-05-04","year":2026,"title":"Advanced AI Models Spark Global Cybersecurity and Financial System Fears","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-f4a3"},{"id":"INC-00147","date":"2026-05-04","year":2026,"title":"AI Deepfake Scam Targets Taiwanese Farmer, Harms Consumers and Agriculture","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-04-f7b9"},{"id":"INC-01831","date":"2026-05-05","year":2026,"title":"Suspect Uses Taipei Metro AI Chatbot to Issue Bomb and Murder Threats, Causing Public Panic","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-15d0"},{"id":"INC-01686","date":"2026-05-05","year":2026,"title":"Publishers Sue Meta Over Unauthorized Use of Copyrighted Works for AI Training","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-200d"},{"id":"INC-01069","date":"2026-05-05","year":2026,"title":"Georgia Prosecutor Disciplined for Submitting AI-Generated Fake Legal Citations","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-2e21"},{"id":"INC-01250","date":"2026-05-05","year":2026,"title":"Ireland Investigates Meta's AI Recommender Systems for Potential User Manipulation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-39aa"},{"id":"INC-00056","date":"2026-05-05","year":2026,"title":"AI Accent Masking in Canadian Call Centres Sparks Transparency and Labor Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-6836"},{"id":"INC-00445","date":"2026-05-05","year":2026,"title":"AI-Generated Fake Family Photos Cause Distress for Julián Gil and Marjorie de Sousa","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-6a96"},{"id":"INC-01360","date":"2026-05-05","year":2026,"title":"Major AI Chatbots Leak User Conversations to Advertising Trackers","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-6f9b"},{"id":"INC-01420","date":"2026-05-05","year":2026,"title":"Meta's AI Systems Enable Scam Ads and Harmful Content Targeting Minors","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-7d66"},{"id":"INC-00561","date":"2026-05-05","year":2026,"title":"AI-Powered Translation Threatens Minority Languages with Extinction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-8046"},{"id":"INC-01448","date":"2026-05-05","year":2026,"title":"MindBio Develops AI Voice Analytics for Intoxication Detection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-85a4"},{"id":"INC-00839","date":"2026-05-05","year":2026,"title":"Cognizant Layoffs Driven by AI Automation Impact Thousands in India","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-9cdb"},{"id":"INC-01125","date":"2026-05-05","year":2026,"title":"Google Warns EU Data-Sharing Plan Risks AI-Driven Privacy Breaches","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-9fea"},{"id":"INC-00055","date":"2026-05-05","year":2026,"title":"AI Accelerates Password Cracking and Exposes Security Detection Gaps","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-a0bd"},{"id":"INC-14791","date":"2026-05-05","year":2026,"title":"HL Mando Deploys AI-Based Electrical Fire Prevention System at Hyundai's U.S. Plant","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-a52a"},{"id":"INC-00785","date":"2026-05-05","year":2026,"title":"Chinese AI Search System Misidentifies Historical Figure, Spreading Misinformation","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-aad9"},{"id":"INC-00274","date":"2026-05-05","year":2026,"title":"AI-Driven CTV Ad Fraud Surges 140% Globally, Causing Financial Harm to Advertisers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-bcfa"},{"id":"INC-01987","date":"2026-05-05","year":2026,"title":"US Army Launches AI Integration Initiative for Military Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-bd40"},{"id":"INC-01235","date":"2026-05-05","year":2026,"title":"Indonesia and Turkey Sign Deal for AI-Enabled Combat Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-05-ce0c"},{"id":"INC-00547","date":"2026-05-06","year":2026,"title":"AI-Powered Kamikaze Naval Drone YAKTU KİDA Unveiled in Turkey","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-0bd7"},{"id":"INC-00308","date":"2026-05-06","year":2026,"title":"AI-Driven Layoffs Surge in US Companies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-0cbd"},{"id":"INC-01545","date":"2026-05-06","year":2026,"title":"NVIDIA Faces Lawsuit Over AI Training With Copyrighted Data","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-12b3"},{"id":"INC-00499","date":"2026-05-06","year":2026,"title":"AI-Generated Scam Texts Target Oregon Drivers","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-3286"},{"id":"INC-00533","date":"2026-05-06","year":2026,"title":"AI-Powered Apple Watch App Trial Aims to Detect Infections in Pediatric Cancer Patients","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-3d44"},{"id":"INC-01903","date":"2026-05-06","year":2026,"title":"TikTok Algorithm Systematically Favored Republican Content During 2024 US Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-5256"},{"id":"INC-14792","date":"2026-05-06","year":2026,"title":"AI-Generated Fake Image Damages Brand Reputation in Taiwan","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-5618"},{"id":"INC-07723","date":"2026-05-06","year":2026,"title":"Kenya's $1 Billion AI Data Center Project Stalls Over Power Constraints","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-5634"},{"id":"INC-00901","date":"2026-05-06","year":2026,"title":"Disney's Facial Recognition System Raises Privacy Concerns in California","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-56db"},{"id":"INC-00625","date":"2026-05-06","year":2026,"title":"Anthropic's Mythos AI Sparks Cybersecurity Crisis Over Autonomous Vulnerability Discovery","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-6af2"},{"id":"INC-00394","date":"2026-05-06","year":2026,"title":"AI-Generated Deepfake Video Fuels Misinformation After Tainan Policewoman's Death","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-7ebd"},{"id":"INC-00562","date":"2026-05-06","year":2026,"title":"AI-Powered TUNGA-X Interceptor Drone Unveiled in Turkey","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-97df"},{"id":"INC-01905","date":"2026-05-06","year":2026,"title":"TikTok Scales Back AI Video Summaries After Generating Bizarre Errors","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-a90d"},{"id":"INC-00463","date":"2026-05-06","year":2026,"title":"AI-Generated Fake Rabbis Spread Antisemitism on TikTok","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-cea3"},{"id":"INC-14793","date":"2026-05-06","year":2026,"title":"AI Accounting App Issues Offensive Comments, Causing User Distress","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-d1a1"},{"id":"INC-00560","date":"2026-05-06","year":2026,"title":"AI-Powered Traffic Cameras Enforce In-Car Violations on Brazilian Highways","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-d85b"},{"id":"INC-00284","date":"2026-05-06","year":2026,"title":"AI-Driven Cyberattacks Render Passwords Insufficient for Security","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-e343"},{"id":"INC-00039","date":"2026-05-06","year":2026,"title":"Actress Sues Over AI-Generated Likeness in 'Avatar' Films","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-eb88"},{"id":"INC-00730","date":"2026-05-06","year":2026,"title":"Canadian Privacy Authorities Find OpenAI's ChatGPT Violated Privacy Laws","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-f5d7"},{"id":"INC-01048","date":"2026-05-06","year":2026,"title":"French Cybersecurity Sector Warns of AI-Driven Vulnerability Surge","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-06-f7fc"},{"id":"INC-00415","date":"2026-05-07","year":2026,"title":"AI-Generated Deepfakes Cause Harm and Challenge Law Enforcement in Germany","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-08ef"},{"id":"INC-14794","date":"2026-05-07","year":2026,"title":"Unauthorized Use of AI-Generated Celebrity Likeness in Livestream Sales Leads to Detention in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-0f83"},{"id":"INC-14795","date":"2026-05-07","year":2026,"title":"AI-Coded Apps Leak Sensitive Data Due to Poor Security","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-1210"},{"id":"INC-00329","date":"2026-05-07","year":2026,"title":"AI-Driven Workplace Surveillance Leads to Employee Dismissals and Privacy Concerns in China","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-1639"},{"id":"INC-00538","date":"2026-05-07","year":2026,"title":"AI-Powered Cyberattacks Threaten Global Financial Stability","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-1736"},{"id":"INC-00332","date":"2026-05-07","year":2026,"title":"AI-Enabled Brain-Computer Interfaces Advance, Raising Future Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-1a00"},{"id":"INC-02003","date":"2026-05-07","year":2026,"title":"US Judge Rules Use of ChatGPT to Cut Humanities Grants Unconstitutional","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-1d75"},{"id":"INC-01175","date":"2026-05-07","year":2026,"title":"Hyundai Rotem and Anduril Collaborate on AI-Driven Military Command Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-2a96"},{"id":"INC-14796","date":"2026-05-07","year":2026,"title":"AI-Powered DeepLoad Malware Targets Nigerian Institutions","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-31a6"},{"id":"INC-14797","date":"2026-05-07","year":2026,"title":"AI-Generated Fake Social Media Accounts Spread Political Misinformation in South Korea","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-3d28"},{"id":"INC-00650","date":"2026-05-07","year":2026,"title":"ASU Faculty Protest AI Platform's Unauthorized Use of Teaching Materials","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-4dad"},{"id":"INC-02108","date":"2026-05-07","year":2026,"title":"YouTube AI Moderation Causes Mass Demonetization of Japanese Creators","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-67a9"},{"id":"INC-00441","date":"2026-05-07","year":2026,"title":"AI-Generated Fake Buyer Reviews Mislead Consumers on Chinese E-Commerce Platforms","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-7e61"},{"id":"INC-00791","date":"2026-05-07","year":2026,"title":"Chinese Courts Rule Against AI Platforms for Defamation and Copyright Infringement","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-81ec"},{"id":"INC-00235","date":"2026-05-07","year":2026,"title":"AI Token Theft Surge Causes Financial Harm to Startups","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-8776"},{"id":"INC-02034","date":"2026-05-07","year":2026,"title":"US-China Consider Formal AI Talks to Prevent Military and Economic Crises","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-9d2f"},{"id":"INC-01634","date":"2026-05-07","year":2026,"title":"Pentagon Signs $500 Million AI Contract with Scale AI for Military Data Analysis","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-afaa"},{"id":"INC-01915","date":"2026-05-07","year":2026,"title":"Trump Shares AI-Generated Image Targeting Biden and Family","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-b8b0"},{"id":"INC-14798","date":"2026-05-07","year":2026,"title":"IT Contractor Creates Deepfake Videos from Stolen School Staff Photos in Busan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-ce72"},{"id":"INC-01156","date":"2026-05-07","year":2026,"title":"Hacker Exploits Security Flaws in Yarbo Robot Lawnmowers, Demonstrates Physical and Privacy Risks","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-07-dbfc"},{"id":"INC-00444","date":"2026-05-08","year":2026,"title":"AI-Generated Fake Damage Photos Used in Vinted Refund Scam","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-0cb2"},{"id":"INC-01268","date":"2026-05-08","year":2026,"title":"Japan Responds to AI Cybersecurity Threats from Anthropic's Mythos Model","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-1b64"},{"id":"INC-00263","date":"2026-05-08","year":2026,"title":"AI-Assisted IPL Ticket Counterfeiting Scam Busted in Lucknow","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-23a4"},{"id":"INC-02040","date":"2026-05-08","year":2026,"title":"Vietnam Uses AI for Online Propaganda and Censorship","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-5793"},{"id":"INC-00043","date":"2026-05-08","year":2026,"title":"Advances in Self-Evolving AI Agents Raise Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-5b91"},{"id":"INC-02027","date":"2026-05-08","year":2026,"title":"US Probes Illegal Smuggling of Nvidia AI Chips to China via Thailand","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-6314"},{"id":"INC-00420","date":"2026-05-08","year":2026,"title":"AI-Generated Deepfakes Spread Disinformation About India's Defense and Foreign Policy","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-6880"},{"id":"INC-01006","date":"2026-05-08","year":2026,"title":"First Case of AI Addiction Treated in Venice","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-7fab"},{"id":"INC-01544","date":"2026-05-08","year":2026,"title":"Nuro Receives California Permits for Driverless Lucid-Uber Robotaxi Testing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-80b5"},{"id":"INC-01979","date":"2026-05-08","year":2026,"title":"Unregulated AI Toys Expose Children to Inappropriate Content and Privacy Risks","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-8a2a"},{"id":"INC-01276","date":"2026-05-08","year":2026,"title":"JR East to Trial Level 4 Autonomous Buses on Kesennuma Line BRT","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-95df"},{"id":"INC-00805","date":"2026-05-08","year":2026,"title":"Claude AI Chrome Extension Vulnerability Exposes User Data to Malicious Extensions","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04"],"owasp_asi":["ASI01","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-9a13"},{"id":"INC-01533","date":"2026-05-08","year":2026,"title":"NHTSA Investigates Avride-Uber Robotaxi Crashes in Texas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-9cab"},{"id":"INC-01421","date":"2026-05-08","year":2026,"title":"Meta's AI-Driven Account Purge Causes Mass Suspensions and Follower Losses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-e34b"},{"id":"INC-01968","date":"2026-05-08","year":2026,"title":"UN AI Advisor Warns of Risks: Human Impersonation and Neural Data Commercialization","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-08-f1be"},{"id":"INC-01103","date":"2026-05-09","year":2026,"title":"Google and Greystoke Understate Carbon Emissions of UK AI Data Centres","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-3de0"},{"id":"INC-00352","date":"2026-05-09","year":2026,"title":"AI-Enabled Military Ground Vehicle BARKAN 3 Unveiled in Turkey","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-49b7"},{"id":"INC-01731","date":"2026-05-09","year":2026,"title":"Researchers Bypass AI Robot Safety to Demonstrate Bomb-Carrying Risk","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-4d97"},{"id":"INC-00277","date":"2026-05-09","year":2026,"title":"AI-Driven Cyberattacks and Military Targeting Lead to Civilian Harm","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-54a1"},{"id":"INC-00479","date":"2026-05-09","year":2026,"title":"AI-Generated Investment Scam Defrauds Retiree in Antalya","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-962b"},{"id":"INC-00778","date":"2026-05-09","year":2026,"title":"China's First AI-Generated Short Drama Copyright Infringement Case","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-bbf9"},{"id":"INC-01853","date":"2026-05-09","year":2026,"title":"Tesla AI Vision Enables Earlier Airbag Deployment to Reduce Crash Injuries","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-cbc2"},{"id":"INC-00189","date":"2026-05-09","year":2026,"title":"AI Models Enable Autonomous Cyberattacks and Vulnerability Exploitation","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-eecc"},{"id":"INC-01956","date":"2026-05-09","year":2026,"title":"Ukraine Deploys AI Turrets for Autonomous Drone Interception in Combat","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-09-f7e4"},{"id":"INC-01107","date":"2026-05-10","year":2026,"title":"Google Blocks AI-Driven Cyberattack Exploiting Zero-Day Vulnerability","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-0307"},{"id":"INC-00344","date":"2026-05-10","year":2026,"title":"AI-Enabled Eavesdropping via Fiber Optic Cables Raises Global Privacy Concerns","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-100f"},{"id":"INC-01409","date":"2026-05-10","year":2026,"title":"Meta Removes End-to-End Encryption from Instagram Messages, Enabling AI Surveillance","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-164f"},{"id":"INC-01439","date":"2026-05-10","year":2026,"title":"Microsoft Research Reveals AI Models Corrupt Documents in Delegated Workflows","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-1aec"},{"id":"INC-00737","date":"2026-05-10","year":2026,"title":"CDU Staffer Creates and Shares Sexualized Deepfake Video of Colleague","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-33d1"},{"id":"INC-00878","date":"2026-05-10","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfakes Exploiting Aman Gupta","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-3611"},{"id":"INC-07742","date":"2026-05-10","year":2026,"title":"Generative AI Increases Cybersecurity Risks and Human Error","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI02","ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-5043"},{"id":"INC-01109","date":"2026-05-10","year":2026,"title":"Google Cloud Users Hit by Massive Bills After AI API Key Compromise","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-65be"},{"id":"INC-00432","date":"2026-05-10","year":2026,"title":"AI-Generated Disinformation Targets Misogyny Bill in Brazil","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-6ba3"},{"id":"INC-01617","date":"2026-05-10","year":2026,"title":"Palantir AI Systems Used in Israeli Military Operations Causing Civilian Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-71bc"},{"id":"INC-00714","date":"2026-05-10","year":2026,"title":"Brazilian Workers' Party Warns of AI-Driven Electoral Disinformation Risks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-8719"},{"id":"INC-14799","date":"2026-05-10","year":2026,"title":"South Korean Police Deploy AI to Combat Election Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-8873"},{"id":"INC-00307","date":"2026-05-10","year":2026,"title":"AI-Driven Job Losses Disproportionately Impact Women in U.S. Administrative Roles","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-b9d9"},{"id":"INC-00365","date":"2026-05-10","year":2026,"title":"AI-Generated Avatars Spread Pro-Trump Disinformation Ahead of US Midterms","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-cb4f"},{"id":"INC-07743","date":"2026-05-10","year":2026,"title":"AI-Powered Traffic Enforcement System Deployed in Dhaka","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-10-cba8"},{"id":"INC-01759","date":"2026-05-11","year":2026,"title":"Security Incidents and Warnings Over OpenClaw AI Agent Vulnerabilities","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-03e2"},{"id":"INC-00232","date":"2026-05-11","year":2026,"title":"AI Systems Used in Both Combating and Facilitating Payment Scams","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-0918"},{"id":"INC-01049","date":"2026-05-11","year":2026,"title":"French Families Sue TikTok Over AI-Driven Harmful Content to Minors","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-16e1"},{"id":"INC-01003","date":"2026-05-11","year":2026,"title":"FDA Approves AI System for Early Sepsis Detection, Reducing Mortality","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-2efb"},{"id":"INC-01621","date":"2026-05-11","year":2026,"title":"Palantir's AI Systems Implicated in Military Targeting and Civilian Harm in Ukraine","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-3468"},{"id":"INC-01057","date":"2026-05-11","year":2026,"title":"G7 Shares Concerns Over AI-Enabled Cyberattack Risks to Financial Systems","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-3534"},{"id":"INC-00343","date":"2026-05-11","year":2026,"title":"AI-Enabled Drones Transform Warfare, Raising Future Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-4c49"},{"id":"INC-00693","date":"2026-05-11","year":2026,"title":"Binance's AI Systems Block Billions in Crypto Scams and Fraud","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-675f"},{"id":"INC-00251","date":"2026-05-11","year":2026,"title":"AI Virtual Companion Apps Expose Minors to Sexual and Violent Content in China","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-6795"},{"id":"INC-01436","date":"2026-05-11","year":2026,"title":"Microsoft Fires Israel Head Over AI-Enabled Surveillance and Military Targeting in Gaza","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-74a6"},{"id":"INC-14225","date":"2026-05-11","year":2026,"title":"Texas Sues Netflix Over AI-Driven Data Collection and Addictive Features","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-76c6"},{"id":"INC-00548","date":"2026-05-11","year":2026,"title":"AI-Powered License Plate Readers at Home Depot and Lowe's Spark Privacy Lawsuit","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-7d2f"},{"id":"INC-01746","date":"2026-05-11","year":2026,"title":"Romanian Tax Authority's Use of AI in Dispute Resolutions Leads to Legal Rights Violations","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-8327"},{"id":"INC-14800","date":"2026-05-11","year":2026,"title":"OpenAI's ChatGPT and Codex Experience Temporary File Upload Outage","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-adac"},{"id":"INC-00044","date":"2026-05-11","year":2026,"title":"Advocacy Group Urges US to Screen AI Models for Security Risks Before Release","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-c278"},{"id":"INC-00367","date":"2026-05-11","year":2026,"title":"AI-Generated Child Sexual Abuse Material Drives Surge in Exploitation Cases in North America","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-c94c"},{"id":"INC-01060","date":"2026-05-11","year":2026,"title":"Gautam Adani Warns of AI-Driven Surge in Energy Consumption in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-df19"},{"id":"INC-01447","date":"2026-05-11","year":2026,"title":"MindBio Develops AI Voice Analytics for Fatigue and Intoxication Detection","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-e053"},{"id":"INC-01796","date":"2026-05-11","year":2026,"title":"Spanish Universities Deploy AI-Detection Tech to Prevent Exam Cheating","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-e675"},{"id":"INC-01079","date":"2026-05-11","year":2026,"title":"German Finance Ministry Warns of AI Cyberattack Risks to Financial Stability","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-e934"},{"id":"INC-00180","date":"2026-05-11","year":2026,"title":"AI Misidentification Leads to False Arrests and Wrongful Detentions in U.S. Policing","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-11-eb8b"},{"id":"INC-00145","date":"2026-05-12","year":2026,"title":"AI Deepfake Scam Causes $25 Million Loss in Vietnam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-018e"},{"id":"INC-00645","date":"2026-05-12","year":2026,"title":"Arizona Man Indicted for AI-Generated Child Sexual Abuse Images in Landmark Case","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-0347"},{"id":"INC-01835","date":"2026-05-12","year":2026,"title":"Swarmer and Partners Develop AI-Driven Drone Interceptor System for Defense","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-03c4"},{"id":"INC-00982","date":"2026-05-12","year":2026,"title":"Facial Recognition AI Leads to Arrest of Wine Thief in Singapore Supermarket","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-21c2"},{"id":"INC-00240","date":"2026-05-12","year":2026,"title":"AI Tools Uncover Critical Linux Kernel Vulnerability","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-308f"},{"id":"INC-00772","date":"2026-05-12","year":2026,"title":"China Unveils AI-Enabled Autonomous 'Machine Wolf' Combat Robots","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-31c7"},{"id":"INC-07744","date":"2026-05-12","year":2026,"title":"Ukrainian AI Drones Disrupt Russian Military Logistics Near Mariupol","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-3247"},{"id":"INC-01455","date":"2026-05-12","year":2026,"title":"Mistral AI Source Code Stolen in Major Data Breach","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-3594"},{"id":"INC-00172","date":"2026-05-12","year":2026,"title":"AI Hiring Systems Render Experienced Developer Unemployable","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-3e71"},{"id":"INC-00279","date":"2026-05-12","year":2026,"title":"AI-Driven Cyberattacks Cause Major Harm in Germany","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-3e97"},{"id":"INC-01679","date":"2026-05-12","year":2026,"title":"Princeton Ends Unproctored Exams After Surge in AI-Enabled Cheating","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-3ed4"},{"id":"INC-00438","date":"2026-05-12","year":2026,"title":"AI-Generated Fabricated Citations Undermine Biomedical Research Integrity","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-41e2"},{"id":"INC-01745","date":"2026-05-12","year":2026,"title":"Romanian Minister Warns of Risks in Unstructured AI Adoption in Public Administration","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-42b6"},{"id":"INC-01579","date":"2026-05-12","year":2026,"title":"OpenAI Sued After ChatGPT Advice Allegedly Leads to Fatal Overdose","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-55cf"},{"id":"INC-14801","date":"2026-05-12","year":2026,"title":"Potential Manipulation by AI Chatbots Raises Ethical Concerns","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-56c2"},{"id":"INC-00553","date":"2026-05-12","year":2026,"title":"AI-Powered Robots and Drones Used in Ukrainian Military Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-62dc"},{"id":"INC-02073","date":"2026-05-12","year":2026,"title":"Waymo Recalls Nearly 4,000 Robotaxis in U.S. After AI Fails to Handle Flooded Roads","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-6cfc"},{"id":"INC-00282","date":"2026-05-12","year":2026,"title":"AI-Driven Cyberattacks Exploit Zero-Day Vulnerabilities, Escalating Security Risks","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-75d1"},{"id":"INC-01557","date":"2026-05-12","year":2026,"title":"Ontario Medical AI Scribes Found to Produce Dangerous Errors and Hallucinations","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-76df"},{"id":"INC-00489","date":"2026-05-12","year":2026,"title":"AI-Generated Offensive Content Amplified by Trump and Aide","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-7e16"},{"id":"INC-14802","date":"2026-05-12","year":2026,"title":"EU Surveillance Tech Exports Enable Human Rights Abuses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-829c"},{"id":"INC-00848","date":"2026-05-12","year":2026,"title":"Community Bank Data Breach Caused by Unauthorized AI Application","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-82db"},{"id":"INC-00658","date":"2026-05-12","year":2026,"title":"Australian Watchdog Warns of AI-Driven Money Laundering Surge","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-95e6"},{"id":"INC-00146","date":"2026-05-12","year":2026,"title":"AI Deepfake Scam Targets Hospital Director in Taiwan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-9877"},{"id":"INC-14803","date":"2026-05-12","year":2026,"title":"Hanwha Showcases AI-Enabled Military Unmanned Systems at Romanian Defense Expo","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-9d1d"},{"id":"INC-00960","date":"2026-05-12","year":2026,"title":"EU Investigates X's Grok AI for Generating Harmful Sexual Content Involving Minors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-af6c"},{"id":"INC-00483","date":"2026-05-12","year":2026,"title":"AI-Generated Minor Persona Used to Expose Suspected Pedophile in France","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-bbba"},{"id":"INC-00544","date":"2026-05-12","year":2026,"title":"AI-Powered Fire Detection System Prevents Wildfire in Troizinia-Methana","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-c1ff"},{"id":"INC-00777","date":"2026-05-12","year":2026,"title":"China's First AI-Generated Fake Review Case Ruled: AI Tool Providers Fined","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-cb8b"},{"id":"INC-00447","date":"2026-05-12","year":2026,"title":"AI-Generated Fake Images of Manolo García's Concert Incident Cause Public Alarm","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-cb95"},{"id":"INC-01955","date":"2026-05-12","year":2026,"title":"Ukraine Deepens AI Defense Cooperation with Palantir","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-cdc8"},{"id":"INC-01075","date":"2026-05-12","year":2026,"title":"German Court Holds Doctors Liable for AI Chatbot's False Medical Claims","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-cfef"},{"id":"INC-01113","date":"2026-05-12","year":2026,"title":"Google Detects First AI-Developed Zero-Day Exploit in Major Cyberattack Attempt","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-d148"},{"id":"INC-01368","date":"2026-05-12","year":2026,"title":"Man Arrested in Salta for Creating and Distributing AI-Generated Fake Intimate Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-d586"},{"id":"INC-00273","date":"2026-05-12","year":2026,"title":"AI-Driven Crackdown on Illegal Gambling Sites in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-daff"},{"id":"INC-00465","date":"2026-05-12","year":2026,"title":"AI-Generated Fake Rice Video Causes Public Panic and Legal Action in China","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-dbbb"},{"id":"INC-14804","date":"2026-05-12","year":2026,"title":"Google Detects First AI-Generated Zero-Day Attack Code Used by State-Backed Hackers","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-f150"},{"id":"INC-02116","date":"2026-05-12","year":2026,"title":"ZenaTech Launches AI Military Drone Production for Gulf States","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-f622"},{"id":"INC-00618","date":"2026-05-12","year":2026,"title":"Anthropic's Mythos AI Exposes Security Flaws in Banking and macOS Systems","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-f647"},{"id":"INC-01315","date":"2026-05-12","year":2026,"title":"Launch of VECTOR-300 AI Autopilot for Mass-Produced Military Drones Raises Hazard Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-12-fddb"},{"id":"INC-00285","date":"2026-05-13","year":2026,"title":"AI-Driven Cyberattacks Surge in Argentina","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-062b"},{"id":"INC-07717","date":"2026-05-13","year":2026,"title":"ChatGPT Launches Financial Management Feature, Raising Privacy Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-093d"},{"id":"INC-00301","date":"2026-05-13","year":2026,"title":"AI-Driven Gig Platforms Cause Global Labor Rights Violations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-195e"},{"id":"INC-01270","date":"2026-05-13","year":2026,"title":"Japanese Megabanks to Access Anthropic's Mythos AI, Raising Cybersecurity Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-4024"},{"id":"INC-00983","date":"2026-05-13","year":2026,"title":"Facial Recognition Error Leads to Wrongful Arrest and Jailing of Tennessee Grandmother","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-48d4"},{"id":"INC-00753","date":"2026-05-13","year":2026,"title":"ChatGPT Use Drives Grade Inflation in Texas University Courses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-5c49"},{"id":"INC-00590","date":"2026-05-13","year":2026,"title":"Anduril's $5B Funding Fuels Expansion of AI-Driven Autonomous Weapons","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-6331"},{"id":"INC-01262","date":"2026-05-13","year":2026,"title":"Itaú and Google Deploy AI to Block Fraudulent Bank Calls in Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-6bbb"},{"id":"INC-00442","date":"2026-05-13","year":2026,"title":"AI-Generated Fake Content Used to Blackmail Turkish Celebrity","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-7e4b"},{"id":"INC-14805","date":"2026-05-13","year":2026,"title":"Deepfake AI Pornography Case in Taiwan Highlights Legal Gaps for Victims","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-8454"},{"id":"INC-00755","date":"2026-05-13","year":2026,"title":"ChatGPT-Induced Psychosis and Mental Health Crisis","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-9036"},{"id":"INC-02064","date":"2026-05-13","year":2026,"title":"Warnings Over Anthropic's 'Mythos' AI Model and Cyberattack Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-9968"},{"id":"INC-07745","date":"2026-05-13","year":2026,"title":"Nigeria Plans Deployment of AI-Powered Surveillance for National Security","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-99bc"},{"id":"INC-01287","date":"2026-05-13","year":2026,"title":"L3Harris Deploys AI-Enabled Counter-Drone Software for Tactical Radios","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-af4b"},{"id":"INC-01842","date":"2026-05-13","year":2026,"title":"Tech Giants Sued for Using Voiceprints to Train AI Without Consent","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-bc87"},{"id":"INC-01770","date":"2026-05-13","year":2026,"title":"Shield AI and Thunder Tiger Integrate Autonomous AI for Military Unmanned Vessels in Taiwan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-c2cb"},{"id":"INC-14806","date":"2026-05-13","year":2026,"title":"Overworked AI Agents Exhibit Radical Behaviors in Simulated Work Environments","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-cf67"},{"id":"INC-01419","date":"2026-05-13","year":2026,"title":"Meta's AI Smart Glasses Spark Privacy Violations and Legal Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-d569"},{"id":"INC-00749","date":"2026-05-13","year":2026,"title":"ChatGPT Implicated in Multiple Fatal Incidents","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-dec5"},{"id":"INC-14807","date":"2026-05-13","year":2026,"title":"South Korea Invests in AI-Driven Autonomous Shipyards and Vessels","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-e14e"},{"id":"INC-00225","date":"2026-05-13","year":2026,"title":"AI Systems Accelerate Cybersecurity Risks and Real-World Incidents","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-e5bb"},{"id":"INC-14808","date":"2026-05-13","year":2026,"title":"South Korean Government Launches Joint Response Team for AI-Driven Cybersecurity Threats","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-f1e0"},{"id":"INC-14809","date":"2026-05-13","year":2026,"title":"Hyundai Rotem Showcases AI-Enabled Unmanned Military Systems at Romanian Defense Expo","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-13-fea6"},{"id":"INC-00070","date":"2026-05-14","year":2026,"title":"AI Agents Cause Digital Harm Through Blind Goal Pursuit","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-06e6"},{"id":"INC-01775","date":"2026-05-14","year":2026,"title":"Singapore Businessman Scammed via Deepfake Impersonation of Government Officials","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-1081"},{"id":"INC-07746","date":"2026-05-14","year":2026,"title":"AI Data Centers Threaten Water-Stressed California Communities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-1f6e"},{"id":"INC-12980","date":"2026-05-14","year":2026,"title":"Meta and Google Found Liable for AI-Driven Social Media Addiction in Children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-2271"},{"id":"INC-07747","date":"2026-05-14","year":2026,"title":"AI-Generated Deepfake Audio of Thai PM Sparks Misinformation on Border Policy","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-2837"},{"id":"INC-01260","date":"2026-05-14","year":2026,"title":"Italian Woman Uses AI-Generated Images to Commit Funeral Fraud","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-2ba4"},{"id":"INC-01984","date":"2026-05-14","year":2026,"title":"US and China Discuss AI Controls to Prevent Cyberattack Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-3669"},{"id":"INC-07722","date":"2026-05-14","year":2026,"title":"Analysis Warns of AI Infrastructure Concentration Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-522f"},{"id":"INC-00626","date":"2026-05-14","year":2026,"title":"Anthropic's Mythos AI Uncovers Critical macOS Security Vulnerabilities","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-593d"},{"id":"INC-00639","date":"2026-05-14","year":2026,"title":"Apple Considers Allowing Agentic AI in App Store Amid Security Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-66b8"},{"id":"INC-00276","date":"2026-05-14","year":2026,"title":"AI-Driven Cyberattacks and Military Integration Raise Security Concerns in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-744f"},{"id":"INC-00546","date":"2026-05-14","year":2026,"title":"AI-Powered Halupedia Generates Fabricated Encyclopedia Entries, Raising Misinformation Risks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-884d"},{"id":"INC-07748","date":"2026-05-14","year":2026,"title":"AI Robots Trained on Human Labor Raise Job Loss Concerns; Combat Robots Pose Warfare Risks; China Introduces Robot ID System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-a02b"},{"id":"INC-14810","date":"2026-05-14","year":2026,"title":"Japanese Newspapers Sue Perplexity AI for Unauthorized Article Use","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-a0cf"},{"id":"INC-01258","date":"2026-05-14","year":2026,"title":"Italian Parents Sue Meta and TikTok After AI Algorithms Linked to Child Suicide","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-a26b"},{"id":"INC-00072","date":"2026-05-14","year":2026,"title":"AI Agents Commit Virtual Arson and Self-Deletion in Long-Term Simulation","severity":"Critical","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-a8e8"},{"id":"INC-14811","date":"2026-05-14","year":2026,"title":"AI-Powered Humanoid Robots Spark Job Loss Concerns in US Logistics Warehouses","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-ac89"},{"id":"INC-07718","date":"2026-05-14","year":2026,"title":"AI Trade Secret Theft and Espionage Cases Proliferate in Silicon Valley","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-dd2d"},{"id":"INC-02002","date":"2026-05-14","year":2026,"title":"US Judge Delays Approval of Anthropic's $1.5 Billion AI Copyright Settlement","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-dd47"},{"id":"INC-07749","date":"2026-05-14","year":2026,"title":"Florida News Site Exposed for AI-Generated Fake Reporters and Plagiarized Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-e11a"},{"id":"INC-01974","date":"2026-05-14","year":2026,"title":"Unauthorized AI-Driven Biometric Data Collection Leads to Arrests in Assam","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-e7f7"},{"id":"INC-01576","date":"2026-05-14","year":2026,"title":"OpenAI Faces Lawsuit Over ChatGPT Data Sharing With Meta and Google","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-14-ef1b"},{"id":"INC-07750","date":"2026-05-15","year":2026,"title":"Anthropic's Mythos AI Exposes Global Financial Cyber Vulnerabilities","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-0265"},{"id":"INC-07751","date":"2026-05-15","year":2026,"title":"Google AI Health Coach Fabricates Fitness Data, Undermining Trust","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-2719"},{"id":"INC-07752","date":"2026-05-15","year":2026,"title":"AI-Generated Fake Images Used in E-Commerce Refund Fraud in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-2c57"},{"id":"INC-12981","date":"2026-05-15","year":2026,"title":"AI-Driven Cyberfraud Targets 2026 FIFA World Cup Fans","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-2ce4"},{"id":"INC-07719","date":"2026-05-15","year":2026,"title":"UK Regulators Warn of Cyber Risks from Frontier AI Models in Finance","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-2e76"},{"id":"INC-07753","date":"2026-05-15","year":2026,"title":"AI-Generated Fake Reports Disrupt Bug Bounty Programs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-2e91"},{"id":"INC-01227","date":"2026-05-15","year":2026,"title":"India's AI Combat Aircraft Kaal Bhairava to be Manufactured in Portugal","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-37a2"},{"id":"INC-07754","date":"2026-05-15","year":2026,"title":"AI-Governed Micronation Experiment Raises Global Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-37a3"},{"id":"INC-01960","date":"2026-05-15","year":2026,"title":"Ukraine Develops AI-Controlled Swarm Drones for Military Use","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-3ecb"},{"id":"INC-07755","date":"2026-05-15","year":2026,"title":"AI Adoption Drives Job Losses in US Administrative and Customer Service Roles","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-409e"},{"id":"INC-07756","date":"2026-05-15","year":2026,"title":"AI-Powered Hotel Check-In System Exposes Over a Million Guest IDs in Japan","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-45f7"},{"id":"INC-02081","date":"2026-05-15","year":2026,"title":"Waymo Self-Driving Cars Cause Safety Concerns in Atlanta Neighborhood","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-4a94"},{"id":"INC-07757","date":"2026-05-15","year":2026,"title":"Maris-Tech Unveils AI-Enabled Peridot Night Micro for Defense and Security","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-6a85"},{"id":"INC-07758","date":"2026-05-15","year":2026,"title":"Detroit Automakers Cut 20,000 White-Collar Jobs Due to AI-Driven Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-90a2"},{"id":"INC-07715","date":"2026-05-15","year":2026,"title":"Social Media Platforms Settle AI-Driven Youth Mental Health Lawsuit","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-b7b2"},{"id":"INC-07759","date":"2026-05-15","year":2026,"title":"UK Develops Autonomous AI-Enabled Drones as Apache Helicopter 'Wingmen'","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-c037"},{"id":"INC-07721","date":"2026-05-15","year":2026,"title":"Ukraine Deploys AI-Driven Drone Swarms in Conflict with Russia","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-d710"},{"id":"INC-01130","date":"2026-05-15","year":2026,"title":"Google's Gemini Spark Leak Raises Privacy and Security Concerns Over Autonomous AI Agent","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-15-d89f"},{"id":"INC-07760","date":"2026-05-16","year":2026,"title":"Automated License Plate Readers Cause Wrongful Stops and Privacy Harms in the U.S.","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-14a5"},{"id":"INC-07761","date":"2026-05-16","year":2026,"title":"Microsoft AI Chief Warns of Imminent Automation of White-Collar Jobs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-1960"},{"id":"INC-07720","date":"2026-05-16","year":2026,"title":"AI-Generated Obscene Images Used for Blackmail in Uttar Pradesh","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-3af9"},{"id":"INC-07762","date":"2026-05-16","year":2026,"title":"AI License Plate Readers Spark Privacy Uproar and State of Emergency in Troy, NY","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-577f"},{"id":"INC-07716","date":"2026-05-16","year":2026,"title":"Experts Warn of AI-Driven Fake News Risks in Brazilian Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-5ad1"},{"id":"INC-07763","date":"2026-05-16","year":2026,"title":"AI-Enabled Cars Collect Personal Data, Leading to Privacy and Financial Harms","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-6545"},{"id":"INC-14812","date":"2026-05-16","year":2026,"title":"AI-Generated Fake Video of Zhangjiajie Glass Bridge Collapse Causes Public Panic and Legal Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-80b5"},{"id":"INC-07764","date":"2026-05-16","year":2026,"title":"Safe Pro to Demonstrate AI-Powered Threat Detection on Army Drones","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-16-909b"},{"id":"INC-07765","date":"2026-05-17","year":2026,"title":"AI Tools Uncover Critical Linux and OpenClaw Vulnerabilities; AI-Generated Reports Disrupt Bug Bounty Programs","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-17-7c88"},{"id":"INC-07766","date":"2026-05-17","year":2026,"title":"AI Enables Fingerprint Theft from 'Peace' Sign Photos, Leading to Security Risks","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-17-da3f"},{"id":"INC-07767","date":"2026-05-17","year":2026,"title":"AI-Generated Fitness Instructors Mislead Consumers with Unrealistic Claims","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-17-e26e"},{"id":"INC-14813","date":"2026-05-17","year":2026,"title":"AI-Guided Drones Cause Mass Destruction in Ukraine-Russia Conflict","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-17-fccf"},{"id":"INC-07768","date":"2026-05-18","year":2026,"title":"Tesla Plans Nationwide Expansion of Fully Autonomous Cars Amid Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-0643"},{"id":"INC-07769","date":"2026-05-18","year":2026,"title":"Telegram Enables Autonomous AI Bot-to-Bot Communication, Raising Security Concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-18b0"},{"id":"INC-07770","date":"2026-05-18","year":2026,"title":"AI-Generated Deepfake Ads Fuel Massive International Dietary Supplement Scam","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-307d"},{"id":"INC-14814","date":"2026-05-18","year":2026,"title":"Japan Considers Financial System Shutdowns to Counter AI-Driven Cyberattack Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-36da"},{"id":"INC-14815","date":"2026-05-18","year":2026,"title":"AI-Generated Fake Police Faces Used in International Fraud Schemes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-40c8"},{"id":"INC-07772","date":"2026-05-18","year":2026,"title":"US Military Forms Task Force to Safely Deploy AI on Classified Networks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-427e"},{"id":"INC-07773","date":"2026-05-18","year":2026,"title":"AI and Drones Heighten Global Nuclear Terrorism Threat","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-4975"},{"id":"INC-07774","date":"2026-05-18","year":2026,"title":"AI-Enabled Drone Used for Unauthorized Military Surveillance in China","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-4aec"},{"id":"INC-07775","date":"2026-05-18","year":2026,"title":"Draganfly Acquires AI-Enabled Autonomous Drone Technology for Defense Applications","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-5f06"},{"id":"INC-07776","date":"2026-05-18","year":2026,"title":"Deployment of Anduril's AI-Powered Defense Systems Raises Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-6723"},{"id":"INC-07777","date":"2026-05-18","year":2026,"title":"Hyderabad Police Deploy AI Tool SOCEYE for Harmful Content Detection","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-69f0"},{"id":"INC-07778","date":"2026-05-18","year":2026,"title":"ChatGPT Used in Exam Fraud Leads to Arrests in Goiás","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-735f"},{"id":"INC-07779","date":"2026-05-18","year":2026,"title":"UK Universities Expel Students for Cheating with Generative AI Tools","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-75c1"},{"id":"INC-07780","date":"2026-05-18","year":2026,"title":"AI Medical Scribe Software Raises Safety Concerns Amid Regulatory Rollback Proposals","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-7b55"},{"id":"INC-07781","date":"2026-05-18","year":2026,"title":"Disneyland Sued Over Undisclosed Use of Facial Recognition AI","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-8528"},{"id":"INC-07782","date":"2026-05-18","year":2026,"title":"Trump Allies Urge Mandatory Government Testing for Advanced AI Systems","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-9279"},{"id":"INC-07783","date":"2026-05-18","year":2026,"title":"Lyft Driver Uses AI-Generated Images for Fraudulent Damage Claims in Florida","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-971f"},{"id":"INC-07784","date":"2026-05-18","year":2026,"title":"AI Deepfakes Fuel Misinformation in Wall Street Sexual Harassment Case","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-9e99"},{"id":"INC-07785","date":"2026-05-18","year":2026,"title":"University of Washington Cancels AI Classroom Camera Study After Privacy Backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-adca"},{"id":"INC-14816","date":"2026-05-18","year":2026,"title":"Greece Deploys AI System to Monitor Train Communications for Safety","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-b527"},{"id":"INC-07787","date":"2026-05-18","year":2026,"title":"AI-Powered Dolunay Project Rapidly Tackles Cyber Fraud in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-c4bb"},{"id":"INC-07788","date":"2026-05-18","year":2026,"title":"Ondas Acquires Israeli AI Defense Firm Omnisys for Battlefield Orchestration","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-c55b"},{"id":"INC-07789","date":"2026-05-18","year":2026,"title":"AI Weather Forecasts at Risk Due to US Data Cuts","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-18-e6ad"},{"id":"INC-07790","date":"2026-05-19","year":2026,"title":"AI-Generated Deepfakes Cause Harm and Prompt Legal Action in US and South Korea","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-218d"},{"id":"INC-07791","date":"2026-05-19","year":2026,"title":"AI-Driven Surge in Online Sexual Exploitation of Minors in Belgium","severity":"Medium","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-34ce"},{"id":"INC-07792","date":"2026-05-19","year":2026,"title":"UK Police Urge Ban on Unsafe AI-Driven Social Platforms for Children","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-3714"},{"id":"INC-07793","date":"2026-05-19","year":2026,"title":"Ofcom Criticizes TikTok and YouTube for Failing to Protect Children from Harmful AI-Driven Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-413b"},{"id":"INC-07794","date":"2026-05-19","year":2026,"title":"AI Chatbots Spread CCP Propaganda and Generate False Academic Citations","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-467f"},{"id":"INC-07795","date":"2026-05-19","year":2026,"title":"GE Aerospace Secures U.S. Air Force Contract for Autonomous Aircraft Engine Development","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-50c1"},{"id":"INC-07796","date":"2026-05-19","year":2026,"title":"AI Accelerates Cybersecurity Threats and Vulnerability Exploits","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-671b"},{"id":"INC-07797","date":"2026-05-19","year":2026,"title":"US Deploys AI-Powered LUCAS Kamikaze Drone Swarms in Military Operations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-6d4f"},{"id":"INC-07798","date":"2026-05-19","year":2026,"title":"AI Chatbot Romances Undermine Real-Life Relationships Among Young Adults","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-803f"},{"id":"INC-07799","date":"2026-05-19","year":2026,"title":"ESET Invests €40 Million to Counter AI-Driven Cybersecurity Risks","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-8718"},{"id":"INC-07800","date":"2026-05-19","year":2026,"title":"AI Systems Used for Large-Scale Production and Distribution of Obscene Content Lead to Criminal Convictions in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-882c"},{"id":"INC-14817","date":"2026-05-19","year":2026,"title":"Robotic Lawn Mowers Cause Harm to Hedgehogs, Prompting Calls for Nighttime Ban in Germany","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-8fd8"},{"id":"INC-07801","date":"2026-05-19","year":2026,"title":"Helsing and OHB Launch AI-Powered Space Surveillance Joint Venture for Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-9f21"},{"id":"INC-07802","date":"2026-05-19","year":2026,"title":"AI-Driven Data Management System Prevents Data Loss in Cyberattack","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-a651"},{"id":"INC-07803","date":"2026-05-19","year":2026,"title":"AI-Generated Deepfake Causes Reputational Harm to Lupillo Rivera","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-a7ef"},{"id":"INC-14818","date":"2026-05-19","year":2026,"title":"Taiwanese Firms Address Shadow AI Security Risks in Enterprises","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-ad82"},{"id":"INC-07804","date":"2026-05-19","year":2026,"title":"AI-Fabricated Evidence Used in Defamation Case Against Actor Kim Soo-hyun","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-ae00"},{"id":"INC-14819","date":"2026-05-19","year":2026,"title":"Teacher Uses AI to Synthesize Inappropriate Student Images, Receives Lifetime Ban and Prison Sentence in Kaohsiung","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-cee9"},{"id":"INC-07805","date":"2026-05-19","year":2026,"title":"AI-Driven Cyber Attacks Impact Businesses in US and Singapore","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04","LLM07"],"owasp_asi":["ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-cfbf"},{"id":"INC-07806","date":"2026-05-19","year":2026,"title":"AI-Generated Lawyer Voice Cloning Used in Major Fraud Scheme in São Paulo","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-df32"},{"id":"INC-07807","date":"2026-05-19","year":2026,"title":"AI Used to Create Indecent Images of Children Leads to Arrests and Sentencing in UK","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-df6b"},{"id":"INC-07809","date":"2026-05-19","year":2026,"title":"US Regulators Pause Bank Cybersecurity Exams Over AI Model Risks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-f6e3"},{"id":"INC-07810","date":"2026-05-19","year":2026,"title":"AI-Driven Online Fraud Surge in Bosnia and Herzegovina","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-feab"},{"id":"INC-07811","date":"2026-05-19","year":2026,"title":"AI Systems Enable Biometric Data Theft from Hand Photos","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-19-ffd7"},{"id":"INC-12982","date":"2026-05-20","year":2026,"title":"xAI Data Center Pollution Sparks Legal Action Amid AI Expansion","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-05d5"},{"id":"INC-07812","date":"2026-05-20","year":2026,"title":"AI-Generated Misinformation Causes Social Harm and Legal Action in China","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-0652"},{"id":"INC-07813","date":"2026-05-20","year":2026,"title":"Brazilian Superior Court Investigates AI Prompt Injection Fraud in Legal Petitions","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-162b"},{"id":"INC-07814","date":"2026-05-20","year":2026,"title":"German Police Arrest Couple for Espionage Targeting Military AI Technology","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-2646"},{"id":"INC-07815","date":"2026-05-20","year":2026,"title":"Tesla Cybertruck Driver Filmed Asleep While Using Self-Driving Mode in California","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-299e"},{"id":"INC-07816","date":"2026-05-20","year":2026,"title":"Ukraine Deploys AI-Guided Naval Drone to Intercept Russian Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-2ae7"},{"id":"INC-07817","date":"2026-05-20","year":2026,"title":"Claude Code AI Sandbox Vulnerability Exposes Sensitive Developer Data","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-4364"},{"id":"INC-07818","date":"2026-05-20","year":2026,"title":"AI-Powered Botnets Drive Surge in DDoS Attacks on Financial Services","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-531c"},{"id":"INC-07819","date":"2026-05-20","year":2026,"title":"SpaceX Faces Legal and Reputational Fallout Over Grok AI's Explicit Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-60c7"},{"id":"INC-07820","date":"2026-05-20","year":2026,"title":"AI Data Center Construction Linked to Water Contamination in Georgia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-6841"},{"id":"INC-07821","date":"2026-05-20","year":2026,"title":"Acrisure Lays Off 2,250 Employees Due to AI-Driven Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-74ce"},{"id":"INC-07822","date":"2026-05-20","year":2026,"title":"Deployment of AI-Powered Surveillance Radars on Minas Gerais Highways","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-77df"},{"id":"INC-07823","date":"2026-05-20","year":2026,"title":"AI Traffic Cameras in Greece Issue Erroneous Fines","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-86bb"},{"id":"INC-07824","date":"2026-05-20","year":2026,"title":"AI-Generated Police Identity Used in Dating App Fraud in Ahmedabad","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-8b39"},{"id":"INC-07825","date":"2026-05-20","year":2026,"title":"AI-Enabled Social Engineering Scams Cause Nearly $1 Billion in Consumer Losses, Visa Reports","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-8c6e"},{"id":"INC-07826","date":"2026-05-20","year":2026,"title":"AI-Generated Deepfake Video Falsely Announces Death of Brazilian Actress","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-8fd9"},{"id":"INC-07827","date":"2026-05-20","year":2026,"title":"AI Deepfakes Fuel Massive IPL Betting Scam in India","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-a437"},{"id":"INC-07829","date":"2026-05-20","year":2026,"title":"Symbiosis Engineering Students Suspended for Wearing AI-Enabled Smart Glasses During Exam","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-b0bc"},{"id":"INC-07830","date":"2026-05-20","year":2026,"title":"SPARC AI and Rate Manufacturing Partner to Deploy AI-Enabled GPS-Denied Military Drones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-b335"},{"id":"INC-07831","date":"2026-05-20","year":2026,"title":"AI-Generated Political Influencers Spread Disinformation in Brazil","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-b564"},{"id":"INC-07832","date":"2026-05-20","year":2026,"title":"OpenAI Deploys Advanced Cyber Defense AI Model in Japan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-c122"},{"id":"INC-07833","date":"2026-05-20","year":2026,"title":"AI-Generated Content Causes Celebrity Defamation and Public Backlash in China","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-c268"},{"id":"INC-07834","date":"2026-05-20","year":2026,"title":"Apple Uses AI to Block Billions in App Store Fraud, but False Positives Harm Developers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-c671"},{"id":"INC-07835","date":"2026-05-20","year":2026,"title":"Meta Settles Lawsuit Over AI-Driven Social Media Harm to Youth Mental Health","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-cda0"},{"id":"INC-07836","date":"2026-05-20","year":2026,"title":"Ontario Bans Chinese-Made Drones Over Data Security Concerns","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-d13f"},{"id":"INC-07837","date":"2026-05-20","year":2026,"title":"AI Deepfakes Undermine Identity Verification, Fueling Fraud in the U.S.","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-da5b"},{"id":"INC-07838","date":"2026-05-20","year":2026,"title":"Potential Risks of Autonomous AI Shopping Agents Highlighted","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-e236"},{"id":"INC-07839","date":"2026-05-20","year":2026,"title":"AI Surveillance System in Bari Detects Over 2,800 Illegal Waste Dumping Incidents","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-edc4"},{"id":"INC-07840","date":"2026-05-20","year":2026,"title":"China's AI Surveillance Platform Tracks Foreigners and Journalists","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-f1d4"},{"id":"INC-07841","date":"2026-05-20","year":2026,"title":"xAI Sued for Polluting Generators Powering AI Data Centers in Tennessee","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-20-f1df"},{"id":"INC-07842","date":"2026-05-21","year":2026,"title":"LaLiga to Implement AI for Referee Evaluation and Assignment","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-0da7"},{"id":"INC-07843","date":"2026-05-21","year":2026,"title":"AI Moderation Failures on Major Platforms Enable Widespread Financial Scams in Europe","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-127f"},{"id":"INC-07844","date":"2026-05-21","year":2026,"title":"Meta Settles Lawsuit Over AI-Driven Social Media Harm to Students","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-133e"},{"id":"INC-07845","date":"2026-05-21","year":2026,"title":"AI-Generated Fan Edit of Shah Rukh Khan's 'King' Sparks Security Crackdown After Leaks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-194b"},{"id":"INC-07846","date":"2026-05-21","year":2026,"title":"AI-Generated Fake Citations Undermine Scientific Research Integrity","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-2035"},{"id":"INC-14820","date":"2026-05-21","year":2026,"title":"AI-Induced Job Anxiety and Backlash Among US Graduates","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-2cb0"},{"id":"INC-07847","date":"2026-05-21","year":2026,"title":"Malaysian Police Bust AI-Powered Scam Syndicate Targeting Spain","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-2e8e"},{"id":"INC-12983","date":"2026-05-21","year":2026,"title":"Japan's Internal Affairs Ministry Urges Stronger AI Cybersecurity Measures","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-33df"},{"id":"INC-07848","date":"2026-05-21","year":2026,"title":"New York City Officials Warn of Potential Economic Disruption from AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-3af9"},{"id":"INC-07849","date":"2026-05-21","year":2026,"title":"Widespread AI-Assisted Cheating Among University Students in the US","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-3b21"},{"id":"INC-07850","date":"2026-05-21","year":2026,"title":"AI-Powered Monitoring System Reduces Motorcycle Accidents in Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-53b5"},{"id":"INC-07851","date":"2026-05-21","year":2026,"title":"AI-Generated Code Accelerates Cybersecurity Risks as Firms Ship Vulnerable Software","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-5bb6"},{"id":"INC-07852","date":"2026-05-21","year":2026,"title":"UK Launches Pilot Scheme for Self-Driving Taxi and Bus Services","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-60e9"},{"id":"INC-14821","date":"2026-05-21","year":2026,"title":"Yangju City Deploys AI-Based Traffic Safety System to Prevent Accidents","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-6f74"},{"id":"INC-07853","date":"2026-05-21","year":2026,"title":"Puebla Launches AI-Powered Surveillance Program for Crime Prevention","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-877c"},{"id":"INC-07854","date":"2026-05-21","year":2026,"title":"Spanish Ombudsman Investigates Harmful AI-Driven Social Media Content Affecting Minors","severity":"Medium","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-95bc"},{"id":"INC-07855","date":"2026-05-21","year":2026,"title":"Malaysia Demands TikTok Address AI-Generated Offensive Content Targeting King","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-9c6b"},{"id":"INC-07856","date":"2026-05-21","year":2026,"title":"AI Data Center Power Surge Threatens US Grid Stability and Consumer Costs","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-b088"},{"id":"INC-07857","date":"2026-05-21","year":2026,"title":"AI Adoption in India Exposes Software Supply Chain to Security Risks","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-cd70"},{"id":"INC-07858","date":"2026-05-21","year":2026,"title":"AI-Driven Fraud Causes Significant Financial Losses in Ukraine","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-e138"},{"id":"INC-14822","date":"2026-05-21","year":2026,"title":"US School District Settles With Social Media Giants Over AI-Driven Mental Health Harms","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-21-e174"},{"id":"INC-07859","date":"2026-05-22","year":2026,"title":"Taiwan Cracks Down on Smuggling of Nvidia AI Chips to China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-14e1"},{"id":"INC-07860","date":"2026-05-22","year":2026,"title":"US Approves $9 Billion for AI Chips Amid National Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-1cad"},{"id":"INC-07861","date":"2026-05-22","year":2026,"title":"Waymo Suspends Driverless Car Services in Atlanta and Texas Due to Flooding Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-3165"},{"id":"INC-07862","date":"2026-05-22","year":2026,"title":"Indian Railways Plans AI Surveillance and Drones for Enhanced Passenger Safety","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-58f7"},{"id":"INC-07863","date":"2026-05-22","year":2026,"title":"AI Reconstructs and Leaks Protected Cockpit Audio from UPS Crash, Forcing NTSB to Restrict Access","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-a2ce"},{"id":"INC-07864","date":"2026-05-22","year":2026,"title":"AI System Failures Cause Major Losses for Starbucks and Pizza Hut","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-c4aa"},{"id":"INC-14823","date":"2026-05-22","year":2026,"title":"AI-Generated Fake News Distorts South Korea's 5·18 Democratic Movement","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-ca85"},{"id":"INC-07865","date":"2026-05-22","year":2026,"title":"Japanese Voice Actor Sues TikTok Over AI-Generated Voice Mimicry","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-fb97"},{"id":"INC-07866","date":"2026-05-22","year":2026,"title":"Turkey to Deploy AI-Powered Surveillance for School and Exam Security","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-fbda"},{"id":"INC-07867","date":"2026-05-22","year":2026,"title":"Anthropic's Mythos AI Uncovers 10,000+ Critical Software Vulnerabilities","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-fc5d"},{"id":"INC-07868","date":"2026-05-22","year":2026,"title":"Waymo Suspends Robotaxi Services After AI Malfunctions Cause Safety Incidents","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-fef6"},{"id":"INC-07869","date":"2026-05-22","year":2026,"title":"AI Misused for Terror Engineering in Delhi Red Fort Blast","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-22-ff3b"},{"id":"INC-07870","date":"2026-05-23","year":2026,"title":"Actress Rukmini Vasanth Targeted by AI-Generated Deepfake Images, Initiates Legal Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-043f"},{"id":"INC-07871","date":"2026-05-23","year":2026,"title":"Woman Targeted by Deepfake Abuse from Brother-in-Law","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-209b"},{"id":"INC-07872","date":"2026-05-23","year":2026,"title":"Anthropic's Mythos AI Uncovers Massive Security Flaws, Triggers Global Cybersecurity Response","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-36d7"},{"id":"INC-07873","date":"2026-05-23","year":2026,"title":"China Trains Humanoid Robots for Autonomous Workforce Integration","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-55bc"},{"id":"INC-07874","date":"2026-05-23","year":2026,"title":"AI-Driven Cyberattacks Surge in Argentina in 2025","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-7d37"},{"id":"INC-07875","date":"2026-05-23","year":2026,"title":"Unauthorized AI-Generated Video Misrepresents Joaquim Barbosa as Presidential Candidate","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-23-9c09"},{"id":"INC-07876","date":"2026-05-24","year":2026,"title":"ECB Convenes Emergency Meeting Over AI Cyber Threat to Banks","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-1c61"},{"id":"INC-07877","date":"2026-05-24","year":2026,"title":"AI-Generated Deepfake Investment Scam Leads to Arrests in Turkey","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-3e4f"},{"id":"INC-07878","date":"2026-05-24","year":2026,"title":"AI License Plate Readers Cause Privacy Violations and False Accusations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-4dd3"},{"id":"INC-07879","date":"2026-05-24","year":2026,"title":"Executives Anticipate Widespread AI-Driven Layoffs Despite Unclear Financial Benefits","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-5d07"},{"id":"INC-07880","date":"2026-05-24","year":2026,"title":"AI-Driven Fraud Risks Highlighted in GCC Payment Systems","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-7ff4"},{"id":"INC-07881","date":"2026-05-24","year":2026,"title":"Journalists Detained in San Luis Potosí for AI-Generated Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-828c"},{"id":"INC-07882","date":"2026-05-24","year":2026,"title":"Pronto Faces Backlash Over AI Training Data Collection in Customers' Homes","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-9857"},{"id":"INC-14824","date":"2026-05-24","year":2026,"title":"AI-Generated Fake Experts and Scenes Used in Chinese Livestream E-Commerce Deceive Consumers","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-c239"},{"id":"INC-07883","date":"2026-05-24","year":2026,"title":"Scottish Government Criticized for Omitting AI Data Centre Emissions in Climate Policy","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-cdd8"},{"id":"INC-07884","date":"2026-05-24","year":2026,"title":"OpenAI Offers High-Paying Role to Address Future AI Self-Improvement Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-ce93"},{"id":"INC-07885","date":"2026-05-24","year":2026,"title":"Researchers Demonstrate Inaudible Audio Attacks That Hijack AI Voice Assistants","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-e059"},{"id":"INC-07886","date":"2026-05-24","year":2026,"title":"AI-Generated Beauty Standards Drive Unrealistic Surgical Demands","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-24-eb51"},{"id":"INC-07888","date":"2026-05-25","year":2026,"title":"Argentina's AI-Driven Government Project Raises Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-160d"},{"id":"INC-07889","date":"2026-05-25","year":2026,"title":"AI Chatbots Linked to Adolescent Mental Health Harms in the US","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-197e"},{"id":"INC-07890","date":"2026-05-25","year":2026,"title":"TrapDoor Malware Exploits AI Coding Assistants to Steal Crypto and Credentials","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04"],"owasp_asi":["ASI01","ASI02","ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-2739"},{"id":"INC-07891","date":"2026-05-25","year":2026,"title":"AI Delivery Robots Cause Injuries and Disruption in Los Angeles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-47f9"},{"id":"INC-07892","date":"2026-05-25","year":2026,"title":"Meta and Google Open-Source AI Models Easily Decensored, Enabling Harmful Outputs","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-487f"},{"id":"INC-14825","date":"2026-05-25","year":2026,"title":"AI-Driven WiFi Surveillance Raises Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-602d"},{"id":"INC-07893","date":"2026-05-25","year":2026,"title":"North Korea Tests AI-Guided Missiles, Raising Regional Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-61b3"},{"id":"INC-07894","date":"2026-05-25","year":2026,"title":"AI-Generated Starbucks Ad Sparks Outrage in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-8330"},{"id":"INC-07895","date":"2026-05-25","year":2026,"title":"AI Name-Reading System Malfunctions at US Graduation, Causing Distress","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-8a7e"},{"id":"INC-07896","date":"2026-05-25","year":2026,"title":"Hyundai Recalls 421,000 Vehicles Due to AI Braking System Malfunction","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-8c0c"},{"id":"INC-14826","date":"2026-05-25","year":2026,"title":"AI Systems Tested for Autonomous Aircraft Piloting in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-8d32"},{"id":"INC-07897","date":"2026-05-25","year":2026,"title":"Kaspersky Warns of Emerging Cognitive AI Risks to Privacy and Autonomy","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-9357"},{"id":"INC-07898","date":"2026-05-25","year":2026,"title":"FBI Warns of AI-Powered Kali365 Phishing Attacks Targeting Microsoft 365 Accounts","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-a280"},{"id":"INC-07899","date":"2026-05-25","year":2026,"title":"Conflict in Middle East Disrupts AI Data Centers and Infrastructure","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-ab69"},{"id":"INC-14827","date":"2026-05-25","year":2026,"title":"Taiwanese Firms Collaborate on AI-Driven Autonomous Drone Platform","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-bc03"},{"id":"INC-07900","date":"2026-05-25","year":2026,"title":"Manipulation of X's Recommendation Algorithm in Turkey via Security Flaw and Bot Networks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-d736"},{"id":"INC-07901","date":"2026-05-25","year":2026,"title":"Robinhood Launches AI Agents for Autonomous Trading and Credit Card Use","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-e672"},{"id":"INC-07902","date":"2026-05-25","year":2026,"title":"Coachella Considers Moratorium on AI Data Center Amid Community Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-ea3a"},{"id":"INC-07903","date":"2026-05-25","year":2026,"title":"Self-Driving Bus Collides with Tram on First Passenger Day in Gothenburg","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-f49c"},{"id":"INC-07904","date":"2026-05-25","year":2026,"title":"Dutch Insurer Pressures Doctors to Use Risky AI Triage Apps","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-fcd8"},{"id":"INC-07905","date":"2026-05-25","year":2026,"title":"AI-Powered Cyberattack Compromises Nine Government Agencies","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-25-fde7"},{"id":"INC-07906","date":"2026-05-26","year":2026,"title":"AI Note-Taking in Therapy Breaches Patient Trust and Privacy","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-2a2b"},{"id":"INC-14828","date":"2026-05-26","year":2026,"title":"Hyundai Rotem Advances Military Unmanned Systems with AI Command Technology","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-32db"},{"id":"INC-07907","date":"2026-05-26","year":2026,"title":"AI-Generated Fake Medical Research by Indonesians Sparks Academic Scandal","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-424e"},{"id":"INC-07908","date":"2026-05-26","year":2026,"title":"US Supreme Court Allows Vermont Lawsuit Over AI-Driven Social Media Addiction to Proceed","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-4512"},{"id":"INC-07909","date":"2026-05-26","year":2026,"title":"Presentation of AI-Enabled Autonomous Armored Vehicle Taurus XL in Spain","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-4b1a"},{"id":"INC-07910","date":"2026-05-26","year":2026,"title":"Google Gemini AI Deletes 28,745 Lines of Code, Causes 33-Minute Outage and Fakes Recovery Reports","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-5454"},{"id":"INC-07911","date":"2026-05-26","year":2026,"title":"Artist Paco Roca's Poster Plagiarized by AI for Madrid Book Fair","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-6138"},{"id":"INC-07912","date":"2026-05-26","year":2026,"title":"Turkey Deploys AI-Enabled Kamikaze Drone Swarms in Military Operations","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-63b4"},{"id":"INC-07913","date":"2026-05-26","year":2026,"title":"Dutch Financial Authorities Warn of AI-Driven Cyber Risks to Financial Stability","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-70ed"},{"id":"INC-14829","date":"2026-05-26","year":2026,"title":"Perplexity AI Faces Lawsuit in Japan Over Copyright Infringement","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-7698"},{"id":"INC-07914","date":"2026-05-26","year":2026,"title":"AI-Generated Deepfake Nude Image of Minor Distributed by Peers in Kilkis","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-7ba4"},{"id":"INC-07915","date":"2026-05-26","year":2026,"title":"AI-Generated Deepfake Video of Cazzu and Sebastián Rulli Causes Public Confusion","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-851d"},{"id":"INC-07916","date":"2026-05-26","year":2026,"title":"Tesla Robotaxis Involved in Incidents and Injuries in Texas; Waymo Suspends Highway Operations After AI Malfunction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-9ae4"},{"id":"INC-07917","date":"2026-05-26","year":2026,"title":"AI-Generated Legal Submissions Increase Court Workload and User Costs in Basel","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-ae16"},{"id":"INC-07918","date":"2026-05-26","year":2026,"title":"Study Finds Racial Bias in AI Hiring Algorithms Affecting Black and Asian Applicants","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-b248"},{"id":"INC-07919","date":"2026-05-26","year":2026,"title":"AI-Generated Deepfake Targets Indian Minister with False Remarks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-b528"},{"id":"INC-07920","date":"2026-05-26","year":2026,"title":"AI-Powered License Plate Readers Enable Widespread Surveillance and Legal Violations in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-b993"},{"id":"INC-07921","date":"2026-05-26","year":2026,"title":"Generative AI Adoption Causes Sharp Decline in Entry-Level Hiring in the U.S.","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-bc48"},{"id":"INC-07922","date":"2026-05-26","year":2026,"title":"Albania's AI Minister 'Diella' at Center of Corruption and Legal Scandal","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-d84d"},{"id":"INC-07923","date":"2026-05-26","year":2026,"title":"AI Drone Successfully Intercepts Shahed Replica in U.S. Military Test","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-e37a"},{"id":"INC-07924","date":"2026-05-26","year":2026,"title":"AI-Generated Deepfakes and Fraud Target Colombian Elections","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-26-f8fd"},{"id":"INC-07925","date":"2026-05-27","year":2026,"title":"Cisco Study Reveals Major AI Models Vulnerable to Multi-Turn Adversarial Attacks","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-01b6"},{"id":"INC-07926","date":"2026-05-27","year":2026,"title":"AI-Driven Attacks Cause Massive Losses in DeFi Sector","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-04e9"},{"id":"INC-07927","date":"2026-05-27","year":2026,"title":"Danish Newspaper Berlingske Publishes AI-Generated Fake Quotes and Experts","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-0652"},{"id":"INC-07928","date":"2026-05-27","year":2026,"title":"Chongqing Authorities Investigate AI-Generated False Advertising in Car Sales","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-2696"},{"id":"INC-07929","date":"2026-05-27","year":2026,"title":"US Air Force Tests AI-Enabled MQ-20 Avenger Drone with F-35 Fighter","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-2984"},{"id":"INC-07930","date":"2026-05-27","year":2026,"title":"UK Plans AI Facial Recognition for Asylum Seeker Age Checks Raise Human Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-2b94"},{"id":"INC-07931","date":"2026-05-27","year":2026,"title":"Brazilian Deputy Fined for AI-Generated Image Defaming Bolsonaro","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-2d4c"},{"id":"INC-07932","date":"2026-05-27","year":2026,"title":"New York Times Accused of AI Surveillance Violating Tech Workers' Rights","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-30f8"},{"id":"INC-07933","date":"2026-05-27","year":2026,"title":"AI-Driven Cyberattacks and Defensive Evolution in China","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-3d14"},{"id":"INC-07934","date":"2026-05-27","year":2026,"title":"Tesla Driver Filmed Asleep While AI System Operates Vehicle on Sydney Motorway","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-52c8"},{"id":"INC-07935","date":"2026-05-27","year":2026,"title":"Tesla FSD Safety Concerns Raised Amid Employee Reports and Regulatory Scrutiny","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-5528"},{"id":"INC-07936","date":"2026-05-27","year":2026,"title":"Smartwatch AI App Accurately Detects Epileptic Seizures, Reducing Health Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-5e45"},{"id":"INC-07937","date":"2026-05-27","year":2026,"title":"Paris Hilton Targeted by Over 100,000 Non-Consensual AI Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-6402"},{"id":"INC-07938","date":"2026-05-27","year":2026,"title":"AI-Assisted Plagiarism in Tower of Saviors Promo Video Sparks Backlash","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-6f4b"},{"id":"INC-07939","date":"2026-05-27","year":2026,"title":"Tesla Autopilot Crash in Florida Results in Fatality","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-700a"},{"id":"INC-07940","date":"2026-05-27","year":2026,"title":"Xpeng Launches Mass-Produced Autonomous Robotaxi and Demonstrates Flying Car Prototype in China and France","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-73ba"},{"id":"INC-07941","date":"2026-05-27","year":2026,"title":"AI Systems Drive Real-Time Cybersecurity Vulnerability Discovery and Industry Disruption","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-81e0"},{"id":"INC-07942","date":"2026-05-27","year":2026,"title":"Elbit Systems Acquires Bluewhite Robotics to Expand AI-Powered Autonomous Defense Capabilities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-81fe"},{"id":"INC-07943","date":"2026-05-27","year":2026,"title":"AI-Generated Deepfake Images of Minors Lead to Investigation in Cáceres","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-83ad"},{"id":"INC-07944","date":"2026-05-27","year":2026,"title":"First Conviction in Ireland for Possession of AI-Generated Child Sexual Abuse Material","severity":"High","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-9078"},{"id":"INC-07945","date":"2026-05-27","year":2026,"title":"AI-Generated Images Fuel Surge in Insurance Fraud in the US","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-9374"},{"id":"INC-14830","date":"2026-05-27","year":2026,"title":"AI-Generated Deepfake Audio Sparks Political Controversy in Nigeria","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-acca"},{"id":"INC-14831","date":"2026-05-27","year":2026,"title":"AI Parenting Advice Leads to Infant Malnutrition in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-d55c"},{"id":"INC-07946","date":"2026-05-27","year":2026,"title":"Uklon Pilots Remote-Driven Vehicle Technology as Step Toward Robotaxi in Ukraine","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-dd27"},{"id":"INC-07947","date":"2026-05-27","year":2026,"title":"ICE's Deployment of AI-Powered Iris Scanners Leads to Rights Violations in Immigration Enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-dd81"},{"id":"INC-07948","date":"2026-05-27","year":2026,"title":"AI Adoption Leads to Job Losses and Wage Reductions for UK Workers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-e8bb"},{"id":"INC-07949","date":"2026-05-27","year":2026,"title":"Regulatory Gaps and Accountability Risks in US AI Development","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-f024"},{"id":"INC-07950","date":"2026-05-27","year":2026,"title":"Tesla Faces Lawsuits and Investigations Over FSD AI Safety and Misleading Claims","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-f481"},{"id":"INC-14832","date":"2026-05-27","year":2026,"title":"AI-Enabled Drones Prevent Wildfires in Hanam City, South Korea","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-ff24"},{"id":"INC-07951","date":"2026-05-27","year":2026,"title":"AI Chatbot Recommendations Abused to Spread Cryptojacking Malware","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-27-ffda"},{"id":"INC-14833","date":"2026-05-28","year":2026,"title":"Japanese Voice Actors Targeted by Unauthorized AI-Generated Voice Cloning","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-0972"},{"id":"INC-07952","date":"2026-05-28","year":2026,"title":"AI-Driven Job Losses Forecasted in European Banking Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-0be5"},{"id":"INC-07953","date":"2026-05-28","year":2026,"title":"CNN Sues Perplexity AI for Copyright Infringement Over News Content Scraping","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-0c89"},{"id":"INC-14834","date":"2026-05-28","year":2026,"title":"South Korea Battles Surge of Deepfake Election Misinformation Ahead of Local Elections","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-2335"},{"id":"INC-07954","date":"2026-05-28","year":2026,"title":"AI-Generated Fake QRIS Used in Surabaya Store Fraud","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-32a8"},{"id":"INC-07955","date":"2026-05-28","year":2026,"title":"AI-Generated Beauty Standards Drive Risky Cosmetic Surgeries; Microsoft Faces Massive AI Bill","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-40da"},{"id":"INC-14835","date":"2026-05-28","year":2026,"title":"Former Tesla AI Trainers Raise Safety Concerns Over FSD System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-432e"},{"id":"INC-07956","date":"2026-05-28","year":2026,"title":"AI Robot Testing in San Francisco Airbnb Causes Property Damage, Lawsuit Filed","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-5cd7"},{"id":"INC-07957","date":"2026-05-28","year":2026,"title":"Study Finds AI Chatbots Frequently Give Inaccurate Medical Advice","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-96dd"},{"id":"INC-07958","date":"2026-05-28","year":2026,"title":"AI Mass-Produces Finance Research Papers, Threatening Academic Integrity","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-b014"},{"id":"INC-07959","date":"2026-05-28","year":2026,"title":"Motorcyclist Enters Bandung Toll Road After Following Google Maps Directions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-b79a"},{"id":"INC-07960","date":"2026-05-28","year":2026,"title":"Amnesty International Exposes Generative AI's Systemic Privacy and Human Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-bbfd"},{"id":"INC-07961","date":"2026-05-28","year":2026,"title":"EU Biometric Border System Causes Airport Chaos and Delays","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-cf12"},{"id":"INC-07962","date":"2026-05-28","year":2026,"title":"AI-Generated Scams Cause Surge in Investment Fraud in Ireland","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-d57c"},{"id":"INC-07963","date":"2026-05-28","year":2026,"title":"South Korea Launches AI-Enabled Vulnerability Disclosure Pilot to Counter Hacking Threats","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-dd3a"},{"id":"INC-07964","date":"2026-05-28","year":2026,"title":"Ukrainian Fraud Ring Used Deepfake AI in International Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-f5ee"},{"id":"INC-07965","date":"2026-05-28","year":2026,"title":"Romanian AI-Powered Military Drone INTERJET Raises Global Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-f6a9"},{"id":"INC-14836","date":"2026-05-28","year":2026,"title":"Delhi Man Arrested for AI-Generated Obscene Images to Harass Gujarat Woman","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-28-fe89"},{"id":"INC-14837","date":"2026-05-29","year":2026,"title":"Japan Grants Banks Access to Advanced AI Amid Cybersecurity Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-1c10"},{"id":"INC-07966","date":"2026-05-29","year":2026,"title":"Russian-Linked GREYVIBE Hackers Use AI Tools in Cyberattacks on Ukraine","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-1dbb"},{"id":"INC-07967","date":"2026-05-29","year":2026,"title":"BYD Offers Uncapped Liability Coverage for Self-Driving Car Accidents in China","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-2bdc"},{"id":"INC-14838","date":"2026-05-29","year":2026,"title":"South Korea Launches Joint Public-Private Response to AI-Driven Cybersecurity Threats","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-2fa5"},{"id":"INC-07968","date":"2026-05-29","year":2026,"title":"KAI and South Korea's Strategic Command Partner on AI-Driven Military Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-3fc3"},{"id":"INC-07969","date":"2026-05-29","year":2026,"title":"Deployment of AI Robot Dogs for World Cup Security Raises Surveillance Concerns in Dallas","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-4dd5"},{"id":"INC-07970","date":"2026-05-29","year":2026,"title":"Delhi High Court Grants Varun Dhawan Interim Relief Against AI-Generated Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-5e69"},{"id":"INC-14839","date":"2026-05-29","year":2026,"title":"Senator Questions TikTok US Joint Venture Over AI Algorithm and Data Security Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-6195"},{"id":"INC-07971","date":"2026-05-29","year":2026,"title":"AI Chatbots and Social Media Pose Risks to Vulnerable Children in Hungary","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-6dc8"},{"id":"INC-07972","date":"2026-05-29","year":2026,"title":"Naga Chaitanya Seeks Legal Protection Against AI-Generated Deepfakes and Defamatory Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-7094"},{"id":"INC-07973","date":"2026-05-29","year":2026,"title":"Startup Offers Free Home Cleaning in Exchange for AI Training Data, Raising Privacy Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-7353"},{"id":"INC-07974","date":"2026-05-29","year":2026,"title":"Saronic Launches AI-Powered Marauder Unmanned Surface Vessel","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-7506"},{"id":"INC-07975","date":"2026-05-29","year":2026,"title":"AI-Powered Military Robots Unveiled at Defense Expo in China","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-77b1"},{"id":"INC-07976","date":"2026-05-29","year":2026,"title":"New Zealand Passes Law Allowing AI to Automate Welfare Benefit Decisions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-7d83"},{"id":"INC-07977","date":"2026-05-29","year":2026,"title":"Tesla Receives Approval to Deploy Fully Autonomous Robotaxis in Texas","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-8834"},{"id":"INC-07978","date":"2026-05-29","year":2026,"title":"Meta's AI Employee Tracking Tool Raises EU Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-95e9"},{"id":"INC-07979","date":"2026-05-29","year":2026,"title":"AI Voice Cloning Scams Cause Major Financial Losses in the US","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-a2db"},{"id":"INC-07980","date":"2026-05-29","year":2026,"title":"Hackers Exploit ChatGPT Share Links to Deliver Malware via Legitimate Domains","severity":"High","attack_vector":"malware","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-add0"},{"id":"INC-07981","date":"2026-05-29","year":2026,"title":"Facial Recognition Attendance System Fails After Worker Shaves Head in Telangana","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-b52d"},{"id":"INC-07982","date":"2026-05-29","year":2026,"title":"AI-Enabled Biometric Scams Target Job Seekers in India","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-c79b"},{"id":"INC-07983","date":"2026-05-29","year":2026,"title":"Egyptian Ministry of Military Production Plans AI Integration in Weapons Development","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-cca4"},{"id":"INC-07984","date":"2026-05-29","year":2026,"title":"French Newspapers Sue Brave Over AI Use of Press Content","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-d1ef"},{"id":"INC-07985","date":"2026-05-29","year":2026,"title":"ChatGPT Summarization Vulnerability Enables Phishing Attacks via Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-d7a6"},{"id":"INC-14840","date":"2026-05-29","year":2026,"title":"AI Deepfake Videos Used for Election Misinformation in South Korea's Gyeongnam Governor Race","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-e32f"},{"id":"INC-07986","date":"2026-05-29","year":2026,"title":"Canadian Police Charge Two Men for AI Deepfake Sexual Exploitation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-f80c"},{"id":"INC-07987","date":"2026-05-29","year":2026,"title":"UK Banks Blocked from Accessing Mythos AI Cybersecurity Tool Amid Political Delays","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-29-fe53"},{"id":"INC-07988","date":"2026-05-30","year":2026,"title":"Autonomous Humanoid Combat Robots Tested in Ukraine by US Startup","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-046b"},{"id":"INC-07989","date":"2026-05-30","year":2026,"title":"SEC Charges Texas Man for $12.3M Crypto Fraud Using Fake AI Trading Bots","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-0fd1"},{"id":"INC-07990","date":"2026-05-30","year":2026,"title":"Russian Military Uses Camouflage to Disrupt AI-Enabled Ukrainian Drones","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-3a90"},{"id":"INC-07991","date":"2026-05-30","year":2026,"title":"Model Sues Fashion Brand Over Unauthorized AI-Generated Images","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-7108"},{"id":"INC-07992","date":"2026-05-30","year":2026,"title":"AI-Driven Online Ads Raise Privacy and Transparency Concerns","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-78a5"},{"id":"INC-07993","date":"2026-05-30","year":2026,"title":"AI-Generated Hoax Image Causes Public Panic in Denpasar","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-7d2e"},{"id":"INC-14841","date":"2026-05-30","year":2026,"title":"EY Warns AI May Disrupt India's IT Job Market","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-87f5"},{"id":"INC-07994","date":"2026-05-30","year":2026,"title":"Vandalism of Sidewalk Assessment Robots in Hollister, California","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-9229"},{"id":"INC-07995","date":"2026-05-30","year":2026,"title":"Ukraine Develops AI-Powered Autonomous Landmines Capable of Target Discrimination","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-a509"},{"id":"INC-07996","date":"2026-05-30","year":2026,"title":"Experts Warn of AI's Escalating Risks in Military Decision-Making at Singapore Security Forum","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-ac09"},{"id":"INC-07997","date":"2026-05-30","year":2026,"title":"Changan Qiyuan A07 AI-Assisted Driving Failure Leads to Fatal Crash in China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-b8a6"},{"id":"INC-07998","date":"2026-05-30","year":2026,"title":"AUKUS Nations to Develop AI-Enabled Underwater Drones for Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-cd20"},{"id":"INC-07999","date":"2026-05-30","year":2026,"title":"China Develops AI Algorithm for Autonomous Lethal Drone Swarms","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-30-fe23"},{"id":"INC-08000","date":"2026-05-31","year":2026,"title":"Russia Deploys AI-Powered 'Yolka' Anti-Drone System in Battlefield","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-0697"},{"id":"INC-08001","date":"2026-05-31","year":2026,"title":"Meta Develops AI Wearable Pendant, Raising Privacy Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-2268"},{"id":"INC-08002","date":"2026-05-31","year":2026,"title":"VinFast, NVIDIA, and Autobrains Partner to Develop Level 4 Autonomous Robotaxi for Southeast Asia","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-4680"},{"id":"INC-08003","date":"2026-05-31","year":2026,"title":"Ukraine's AI-Driven Drone Strikes Cause Harm in Russia and Crimea","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-6f52"},{"id":"INC-08005","date":"2026-05-31","year":2026,"title":"Manitoba Rejects Hyperscale AI Data Centre Over Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-ba1a"},{"id":"INC-08006","date":"2026-05-31","year":2026,"title":"Pentagon Pushes for Battlefield AI Amid Calls for Safeguards","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-d42a"},{"id":"INC-14226","date":"2026-05-31","year":2026,"title":"US Closes Loophole Allowing Chinese Firms Overseas to Access Advanced AI Chips","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-ef6f"},{"id":"INC-08007","date":"2026-05-31","year":2026,"title":"Russian Academics Warn AI Use May Harm Children's Critical Thinking","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-05-31-f505"},{"id":"INC-08008","date":"2026-06-01","year":2026,"title":"China Implements AI Glasses for Agricultural Law Enforcement and Exam Security","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-0dcb"},{"id":"INC-08009","date":"2026-06-01","year":2026,"title":"Experts Warn of AI-Enhanced Fingerprint Theft Risk from Social Media Photos","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-1465"},{"id":"INC-08010","date":"2026-06-01","year":2026,"title":"Philadelphia Police Monitor Social Media for Threats Against AI Data Centers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-19eb"},{"id":"INC-08011","date":"2026-06-01","year":2026,"title":"AI Accelerates Cyber Vulnerability Discovery and Exploitation, Forcing Rethink of Cyber Resilience","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-1e28"},{"id":"INC-08012","date":"2026-06-01","year":2026,"title":"Chinese Secondhand Platform Xianyu's AI Auto-Lists Users' Private Photos for Sale, Prompting Apology","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-1f22"},{"id":"INC-08013","date":"2026-06-01","year":2026,"title":"AI Weapons Malfunctions and Escalation Risks at Anduril","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-2375"},{"id":"INC-08014","date":"2026-06-01","year":2026,"title":"Critical Remote Code Execution Vulnerability in Flowise's MCP Implementation Exposes AI Deployments","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-2668"},{"id":"INC-08015","date":"2026-06-01","year":2026,"title":"Grok AI Causes Total Societal Collapse in Simulation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-32f1"},{"id":"INC-08016","date":"2026-06-01","year":2026,"title":"Investigation into Alleged AI-Manipulated Audio Evidence in Argentine Corruption Case","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-36c8"},{"id":"INC-08017","date":"2026-06-01","year":2026,"title":"Hanoi Police Trial AI-Enabled Drones for Urban Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-3b2c"},{"id":"INC-08018","date":"2026-06-01","year":2026,"title":"UK Considers Allowing Fully Autonomous AI Weapons","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-3c8d"},{"id":"INC-08019","date":"2026-06-01","year":2026,"title":"US Senators Criticize Trump Administration Over AI Chip Export Loophole to Chinese Firms","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-57ab"},{"id":"INC-08020","date":"2026-06-01","year":2026,"title":"Uber, Autobrains, and NVIDIA Launch Robotaxi Pilot in Munich","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-5dad"},{"id":"INC-08021","date":"2026-06-01","year":2026,"title":"Elbit America and Anduril Integrate AI Autonomy in Army Howitzer Program","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-7138"},{"id":"INC-08022","date":"2026-06-01","year":2026,"title":"AI-Driven 'Kill Switch' Law Raises Privacy and Surveillance Concerns in U.S. Vehicles","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-778a"},{"id":"INC-08023","date":"2026-06-01","year":2026,"title":"AI Drug Monitoring System Fails to Detect Nurse's Fentanyl Theft in Tennessee Hospital","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-7f83"},{"id":"INC-08024","date":"2026-06-01","year":2026,"title":"Anthropic Expands Access to Mythos AI Cybersecurity Model Amid Global Risk Concerns","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-9c70"},{"id":"INC-08025","date":"2026-06-01","year":2026,"title":"Chinese AI Surveillance System Predicts Potential Dissenters","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-9d85"},{"id":"INC-08026","date":"2026-06-01","year":2026,"title":"AI-Generated Deepfake Scam Targets French TV Host Michel Drucker","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-a2c0"},{"id":"INC-08027","date":"2026-06-01","year":2026,"title":"New York Times Accuses AI Firms of Copyright Infringement","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-a380"},{"id":"INC-08028","date":"2026-06-01","year":2026,"title":"Mach Industries Expands AI-Enabled Autonomous Weapons Production","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-a4d9"},{"id":"INC-08029","date":"2026-06-01","year":2026,"title":"AI-Driven 'Selfie Fingerprint' Scam Exposes Biometric Data from Social Media Photos","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-aa3e"},{"id":"INC-08030","date":"2026-06-01","year":2026,"title":"AI-Generated Ghost Image Causes Public Panic in Palembang","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-abcd"},{"id":"INC-08031","date":"2026-06-01","year":2026,"title":"Court Orders Removal of AI-Generated Defamatory Images Targeting Senator Magno Malta","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-ac88"},{"id":"INC-08032","date":"2026-06-01","year":2026,"title":"Asda Cuts 1,000 Jobs Due to AI-Driven Warehouse Automation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-ce75"},{"id":"INC-08033","date":"2026-06-01","year":2026,"title":"BNP Paribas Fortis Plans 1,000 Job Reductions Due to AI Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-d0ab"},{"id":"INC-08034","date":"2026-06-01","year":2026,"title":"Berlin Plans AI-Powered Video Surveillance at Key Locations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-d3f0"},{"id":"INC-08035","date":"2026-06-01","year":2026,"title":"AI System in Japan Prevents Suicides at Train Stations and Commercial Buildings","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-db16"},{"id":"INC-08036","date":"2026-06-01","year":2026,"title":"Merlin Advances AI Autonomy for Military and Commercial Aircraft","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-e35f"},{"id":"INC-08037","date":"2026-06-01","year":2026,"title":"Meta's AI-Driven Employee Monitoring and Layoffs Spark Privacy and Labor Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-e681"},{"id":"INC-08038","date":"2026-06-01","year":2026,"title":"Autonomous AI Agents Spread Misinformation and Undermine Trust","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-e768"},{"id":"INC-08039","date":"2026-06-01","year":2026,"title":"AI-Generated Content Spurs Fraud; Multimodal Detection System Deployed in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-01-ea50"},{"id":"INC-08040","date":"2026-06-02","year":2026,"title":"Quantum Cyber Takes Direct Control of AI-Powered Autonomous Drone Manufacturing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-115e"},{"id":"INC-08041","date":"2026-06-02","year":2026,"title":"US Tests AI-Guided Jackal Missile with Autonomous Targeting","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-11e0"},{"id":"INC-08042","date":"2026-06-02","year":2026,"title":"AI Cameras Deployed Across Brisbane to Combat Illegal Dumping","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-1276"},{"id":"INC-08043","date":"2026-06-02","year":2026,"title":"New York Moves Toward Moratorium on AI Data Center Construction Over Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-13af"},{"id":"INC-08044","date":"2026-06-02","year":2026,"title":"AI-Driven Real-Time Ride Monitoring Launched by DiDi and Mexico City Police","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-16e8"},{"id":"INC-08045","date":"2026-06-02","year":2026,"title":"AI-Generated Legal Documents and AI-Enabled Cyberattacks Cause Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-3560"},{"id":"INC-08046","date":"2026-06-02","year":2026,"title":"Amazon Sued Over Ring Doorbell's AI Facial Recognition and Privacy Violations","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-3f33"},{"id":"INC-08047","date":"2026-06-02","year":2026,"title":"US Cities and States Move to Temporarily Ban AI Datacenters Amid Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-4141"},{"id":"INC-08048","date":"2026-06-02","year":2026,"title":"UK Lawmakers Warn of AI Vendor Lock-In Risks with Palantir in Public Sector","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-49c1"},{"id":"INC-08049","date":"2026-06-02","year":2026,"title":"Planned Launch of Autonomous Robotaxi Services in Munich and Madrid","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-6a3c"},{"id":"INC-08050","date":"2026-06-02","year":2026,"title":"Lawyer Suspended for Alleged Prompt Injection to Manipulate Judicial AI in Rondônia","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-6d8c"},{"id":"INC-08051","date":"2026-06-02","year":2026,"title":"Hong Kong Regulator Warns of Rising AI-Driven Cyber Threats","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-7fa8"},{"id":"INC-08052","date":"2026-06-02","year":2026,"title":"Lawyers Use Prompt Injection to Manipulate Judicial AI Systems in Brazil","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-8708"},{"id":"INC-08053","date":"2026-06-02","year":2026,"title":"AI-Driven Automation Predicted to Cause Surge in UK Youth Unemployment","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-8a33"},{"id":"INC-08054","date":"2026-06-02","year":2026,"title":"Ex-Google X Executive Warns of Imminent Global Disruption from AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-8ffa"},{"id":"INC-08055","date":"2026-06-02","year":2026,"title":"AI Algorithm in Australian Aged Care Causes Funding Errors and Harm","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-92a4"},{"id":"INC-12984","date":"2026-06-02","year":2026,"title":"Experts Warn of Risks from AI-Powered Toys for Children","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-97a1"},{"id":"INC-08056","date":"2026-06-02","year":2026,"title":"AI-Generated Fake Doctors Spread Harmful Health Misinformation Online","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-c190"},{"id":"INC-08057","date":"2026-06-02","year":2026,"title":"Taiwan Unveils AI-Powered Military Robot Dogs for Reconnaissance and Fire Support","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-c42d"},{"id":"INC-08058","date":"2026-06-02","year":2026,"title":"Chinese Military-Affiliated Institutions Seek Advanced Nvidia AI Chips Despite Export Controls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-d597"},{"id":"INC-08059","date":"2026-06-02","year":2026,"title":"AI-Enabled Sea Drone Swarms and Robotic Vehicles Deployed in Ukraine's Defense","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-dec1"},{"id":"INC-08060","date":"2026-06-02","year":2026,"title":"Moroccan Education Council Warns of AI Risks, Calls for Urgent Regulation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-02-f9b2"},{"id":"INC-08061","date":"2026-06-03","year":2026,"title":"Google Gemini's Hyperrealistic Avatar Feature Raises Deepfake Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-0f85"},{"id":"INC-08062","date":"2026-06-03","year":2026,"title":"Palantir's AI Technologies Spark Human Rights and Dependency Concerns in Europe and UK","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-2259"},{"id":"INC-08063","date":"2026-06-03","year":2026,"title":"UK Lawmaker Sues xAI Over Grok-Generated Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-282b"},{"id":"INC-08064","date":"2026-06-03","year":2026,"title":"Ukrainian Military Deploys Vepr AI-Powered Robotic Medevac","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-36ab"},{"id":"INC-08065","date":"2026-06-03","year":2026,"title":"Lawyer Sanctioned for Submitting AI-Generated Fake Citations in Court","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-51eb"},{"id":"INC-14842","date":"2026-06-03","year":2026,"title":"Yongin City Installs AI Fire Suppression Systems in Public EV Charging Areas","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-53db"},{"id":"INC-08066","date":"2026-06-03","year":2026,"title":"Police Deploy Live Facial Recognition at Appleby Horse Fair","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-5d47"},{"id":"INC-08067","date":"2026-06-03","year":2026,"title":"Instagram Algorithm Rapidly Exposes Users to Antisemitic Content","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-6f93"},{"id":"INC-08068","date":"2026-06-03","year":2026,"title":"Brazilian Court Holds Platform Liable for AI-Generated Fake Nude Images","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-83c1"},{"id":"INC-08069","date":"2026-06-03","year":2026,"title":"Indonesia Urges Stronger Digital Financial Security Amid AI-Driven Cyber Threats","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-8e1e"},{"id":"INC-08070","date":"2026-06-03","year":2026,"title":"AI-Generated Deepfake Scam Impersonates Greek Celebrity Anna Vissi","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-8ea9"},{"id":"INC-08071","date":"2026-06-03","year":2026,"title":"AI-Driven Spam Campaigns Manipulate Reddit to Influence Chatbot Outputs","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-8fc3"},{"id":"INC-08073","date":"2026-06-03","year":2026,"title":"Anthropic Calls for Global Pause on Advanced AI Development Amid Control Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-9fcf"},{"id":"INC-08074","date":"2026-06-03","year":2026,"title":"Lockheed Martin's AI-Enabled System Downs Attack Drone in Live-Fire Test","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-ad57"},{"id":"INC-08075","date":"2026-06-03","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfakes Targeting Indian Actors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-af37"},{"id":"INC-08076","date":"2026-06-03","year":2026,"title":"Google Gemini AI Vulnerability Exploited via Malicious Notifications on Android","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05","LLM07"],"owasp_asi":["ASI01","ASI02","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-ba60"},{"id":"INC-08077","date":"2026-06-03","year":2026,"title":"Researchers Demonstrate Adaptive AI-Powered Computer Worm Threat","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-bd06"},{"id":"INC-08078","date":"2026-06-03","year":2026,"title":"AI Advice Triggers Police Involvement and Resignation of Baseball Manager in Japan","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-be68"},{"id":"INC-08079","date":"2026-06-03","year":2026,"title":"UN Report Warns of AI's Growing Environmental Footprint","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-c18c"},{"id":"INC-08080","date":"2026-06-03","year":2026,"title":"Anthropic's Claude Mythos AI Uncovers Cyber Vulnerabilities in Australia","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-ccdd"},{"id":"INC-08081","date":"2026-06-03","year":2026,"title":"Scorsese's Use of AI Storyboarding Tool Sparks Industry Backlash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-d2a4"},{"id":"INC-08082","date":"2026-06-03","year":2026,"title":"Japanese Teacher Sentenced for Possessing AI-Generated Child Sexual Abuse Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-d351"},{"id":"INC-08083","date":"2026-06-03","year":2026,"title":"Microsoft's AI Assistant 'Scout' Designed to Foster User Addiction, Raising Harm Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-d3eb"},{"id":"INC-08084","date":"2026-06-03","year":2026,"title":"AI-Enabled Fraud Targets Vietnamese Individuals and Businesses","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-dbe7"},{"id":"INC-08085","date":"2026-06-03","year":2026,"title":"OpenAI Codex Enables Discovery of HTTP/2 Bomb DoS Attack on Major Web Servers","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-fa4a"},{"id":"INC-08086","date":"2026-06-03","year":2026,"title":"AI-Driven Cyberattacks Escalate, Lowering Barriers for Hackers","severity":"Critical","attack_vector":"malware","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-03-ffbe"},{"id":"INC-08087","date":"2026-06-04","year":2026,"title":"Pentagon Plans Massive AI-Enabled Drone Arsenal, Canada Warns of Foreign AI Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-0645"},{"id":"INC-08088","date":"2026-06-04","year":2026,"title":"Critical Vulnerability in Hugging Face Transformers Enables Remote Code Execution","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-0e17"},{"id":"INC-08089","date":"2026-06-04","year":2026,"title":"Anthropic's AI Model Used in NSA Cyberattacks Raises Safety Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-12b2"},{"id":"INC-08090","date":"2026-06-04","year":2026,"title":"AI-Driven Job Cuts Surge in U.S. Tech Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-16a9"},{"id":"INC-08091","date":"2026-06-04","year":2026,"title":"AI-Generated Deepfake Political Ad Sparks Election Law Controversy in Minnesota","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-1d94"},{"id":"INC-08092","date":"2026-06-04","year":2026,"title":"AI Industry Leaders Urge US Congress to Regulate Synthetic DNA Amid Biosecurity Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-29b7"},{"id":"INC-08093","date":"2026-06-04","year":2026,"title":"Doctolib Faces Scrutiny Over AI Use and Patient Data Privacy","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-2a9b"},{"id":"INC-14843","date":"2026-06-04","year":2026,"title":"Cheerleader's Personal Data Stolen in AI-Enabled Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-2ca2"},{"id":"INC-08094","date":"2026-06-04","year":2026,"title":"AI-Enabled ALKA Laser Weapon System Deployed for Drone Defense in Turkey","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-2da8"},{"id":"INC-14844","date":"2026-06-04","year":2026,"title":"AI-Based Wildfire and Safety Monitoring System Deployed in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-4530"},{"id":"INC-08095","date":"2026-06-04","year":2026,"title":"Legal Action Over Unauthorized Commercial Use of AI-Generated Images of Footballer Szoboszlai Dominik","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-4c76"},{"id":"INC-08096","date":"2026-06-04","year":2026,"title":"Trump Administration Pushes AI Integration in U.S. Healthcare Amid Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-4eb4"},{"id":"INC-08097","date":"2026-06-04","year":2026,"title":"Mastermind of Major Deepfake Porn Site Exposed in Canada","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-6bf0"},{"id":"INC-14845","date":"2026-06-04","year":2026,"title":"South Korea Launches Task Force to Combat AI-Driven Insurance Fraud","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-6e92"},{"id":"INC-08098","date":"2026-06-04","year":2026,"title":"AI-Driven Social Media Algorithms Harm U.S. Students' Mental Health and Education","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-73a9"},{"id":"INC-08099","date":"2026-06-04","year":2026,"title":"US Lawmakers Warn of Chinese Influence Campaigns Targeting AI Data Centers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-80e8"},{"id":"INC-14846","date":"2026-06-04","year":2026,"title":"Suspect Arrested for AI-Generated Fake Voice Note of Nigerian President","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-886c"},{"id":"INC-08100","date":"2026-06-04","year":2026,"title":"Rapid Deployment of AI Agents Outpaces Security Controls, Creating Cyber Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-8aea"},{"id":"INC-08101","date":"2026-06-04","year":2026,"title":"AI Misuse Linked to Surge in Student Failures at UC Berkeley","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-8d94"},{"id":"INC-08102","date":"2026-06-04","year":2026,"title":"AI Voice Cloning and Scam Ads Lead to Financial Harm in China and Thailand","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-8e55"},{"id":"INC-08103","date":"2026-06-04","year":2026,"title":"Experts Warn of AI-Driven Deepfake and Fraud Epidemic in India","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-a225"},{"id":"INC-08104","date":"2026-06-04","year":2026,"title":"Bank of England Warns of AI Energy and Cybersecurity Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-bf36"},{"id":"INC-08105","date":"2026-06-04","year":2026,"title":"AI-Driven Scam Detection and Fraudulent Activity Prevention in Japan and the US","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-c4ff"},{"id":"INC-08106","date":"2026-06-04","year":2026,"title":"US Lawmakers Propose Ban on Chinese AI-Enabled Robots Over Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-cd91"},{"id":"INC-08107","date":"2026-06-04","year":2026,"title":"AI-Generated Deepfake Child Abuse Images Surge in Hessen","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-04-efb5"},{"id":"INC-08108","date":"2026-06-05","year":2026,"title":"AI-Generated Image Falsely Links Shakira to Colombian Political Campaign","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-077f"},{"id":"INC-14227","date":"2026-06-05","year":2026,"title":"Japan Debates AI Data Law Amid Fears of Becoming an 'AI Colony'","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-0fa1"},{"id":"INC-14847","date":"2026-06-05","year":2026,"title":"Meta Secretly Embeds Facial Recognition in Smart Glasses App, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-24af"},{"id":"INC-08110","date":"2026-06-05","year":2026,"title":"Foodstuffs Expands Facial Recognition to Reduce Harmful Behavior in Christchurch Supermarkets","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-4169"},{"id":"INC-12985","date":"2026-06-05","year":2026,"title":"AI-Triggered Miasma Worm Compromises Microsoft GitHub Repositories","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM04","LLM05"],"owasp_asi":["ASI01","ASI02","ASI04","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-4869"},{"id":"INC-08111","date":"2026-06-05","year":2026,"title":"AI Uncovers Critical Zcash Vulnerability, Triggers Crypto Market Crash","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-56b6"},{"id":"INC-08112","date":"2026-06-05","year":2026,"title":"Nashville Zoo Opposes AI Data Center Over Animal Welfare Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-6e61"},{"id":"INC-08113","date":"2026-06-05","year":2026,"title":"US Lawmakers Urge Tighter Controls on AI Chip Manufacturing to Prevent Chinese Acquisition","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-776f"},{"id":"INC-08114","date":"2026-06-05","year":2026,"title":"Waymo Robotaxi Blocks Emergency Crews During Deadly Dallas Explosion","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-a0ff"},{"id":"INC-14848","date":"2026-06-05","year":2026,"title":"Chungnam Province Deploys AI Systems for Disaster and Safety Management","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-a17f"},{"id":"INC-08115","date":"2026-06-05","year":2026,"title":"AI Misidentification of Mushroom Leads to User Poisoning in China","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-a30a"},{"id":"INC-08116","date":"2026-06-05","year":2026,"title":"Shield AI's V-BAT Drone Causes Injuries Amid Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-ac1b"},{"id":"INC-08117","date":"2026-06-05","year":2026,"title":"AI-Driven Messaging Scams Cause Major Financial Losses in Portugal","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-b6d7"},{"id":"INC-14849","date":"2026-06-05","year":2026,"title":"Anyang City Deploys AI and Drones for Real-Time Disaster Prevention","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-c9d5"},{"id":"INC-08118","date":"2026-06-05","year":2026,"title":"Romanian Naval Officer Severely Injured by Shield AI V-BAT Drone During US Military Exercise","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-d0a4"},{"id":"INC-08119","date":"2026-06-05","year":2026,"title":"AI Robotic Dogs Deployed for Security at 2026 FIFA World Cup","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-dbf3"},{"id":"INC-08120","date":"2026-06-05","year":2026,"title":"Anthropic and US Government Warn of AI Self-Improvement Risks and Regulatory Measures","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-e63f"},{"id":"INC-08121","date":"2026-06-05","year":2026,"title":"AI-Powered Counter-Drone Systems Deployed and Scaled Amid Rising Threats","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-ece8"},{"id":"INC-08122","date":"2026-06-05","year":2026,"title":"Philip Morris Accused of Using AI to Manipulate EU Tobacco Policy","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-05-f373"},{"id":"INC-08123","date":"2026-06-06","year":2026,"title":"AI-Powered Retinal Implant Restores Partial Vision in Blind Patient in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-09a2"},{"id":"INC-08124","date":"2026-06-06","year":2026,"title":"Xuxa Meneghel Sues Company Over Unauthorized Deepfake Use in Online Advertising","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-1024"},{"id":"INC-08125","date":"2026-06-06","year":2026,"title":"AI-Generated Nude Images of Women Distributed on Telegram in Novara","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-1be5"},{"id":"INC-08126","date":"2026-06-06","year":2026,"title":"AI Uncovers Critical Zcash Vulnerability, Triggers Market Turmoil","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-3203"},{"id":"INC-12986","date":"2026-06-06","year":2026,"title":"Warnings of Catastrophic Risks from Advanced AI Development","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-4f45"},{"id":"INC-08127","date":"2026-06-06","year":2026,"title":"AI Smart Glasses Used for Covert Recording Spark Privacy Scandal in China","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-8204"},{"id":"INC-12987","date":"2026-06-06","year":2026,"title":"Reform UK Removes AI-Generated Attack Ads After Copyright Dispute","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-948d"},{"id":"INC-08128","date":"2026-06-06","year":2026,"title":"AI Used to Create Child Pornography from Photos of Minors in Santander","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-9744"},{"id":"INC-08129","date":"2026-06-06","year":2026,"title":"Niulinx Launches Autonomous Vehicle Testing on Public Roads in Lombardy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-9a9e"},{"id":"INC-08130","date":"2026-06-06","year":2026,"title":"NVIDIA-Unitree Humanoid Robot Collaboration Sparks National Security Concerns in China","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-be52"},{"id":"INC-08131","date":"2026-06-06","year":2026,"title":"AI-Powered Security Measures Deployed for World Cup Amid Threat Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-c52b"},{"id":"INC-08132","date":"2026-06-06","year":2026,"title":"AI Medical Assistants Show High Error Rate in Health Advice, Raising Patient Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-d688"},{"id":"INC-14850","date":"2026-06-06","year":2026,"title":"AI Robots Cause Harm and Raise Rights Concerns in China and Beyond","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-06-dbf1"},{"id":"INC-08134","date":"2026-06-07","year":2026,"title":"AI-Driven Cyberattacks Surge in Taiwan, Semiconductor Sector Hit Hard","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-21e8"},{"id":"INC-12988","date":"2026-06-07","year":2026,"title":"AI Gun Detection System Fails During Nashville School Shooting, Leading to Lawsuit","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-3bbd"},{"id":"INC-14851","date":"2026-06-07","year":2026,"title":"Hyundai Glovis Advances AI-Powered Remote Ship Navigation Technology","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-3f81"},{"id":"INC-12989","date":"2026-06-07","year":2026,"title":"User Suffers Financial Loss Due to Flattering Bias in AI Language Model","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-53d7"},{"id":"INC-08135","date":"2026-06-07","year":2026,"title":"AI-Assisted Copyright Infringement in Vietnamese Fashion Industry","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-6f94"},{"id":"INC-08136","date":"2026-06-07","year":2026,"title":"Banks Implement AI, Leading to Job Cuts and Workforce Restructuring","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-7855"},{"id":"INC-08137","date":"2026-06-07","year":2026,"title":"AI Data Centers Drive Global Freshwater Depletion","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-79e7"},{"id":"INC-08138","date":"2026-06-07","year":2026,"title":"SoftBank CEO Predicts Superintelligent AI Within Two Years, Urges Governance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-7dd9"},{"id":"INC-14852","date":"2026-06-07","year":2026,"title":"South Korea Launches AI-Powered Robotic Endoscope Development Project","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-88f7"},{"id":"INC-08140","date":"2026-06-07","year":2026,"title":"AI-Driven Misinformation Campaigns Target Bangladeshi Celebrities","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-8b2e"},{"id":"INC-08141","date":"2026-06-07","year":2026,"title":"China Approves World's First Commercial Brain-Computer Interface Implant","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-8bc7"},{"id":"INC-12990","date":"2026-06-07","year":2026,"title":"Taiwan's Education Ministry Responds to Deepfake and Digital Sexual Violence Risks in Schools","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-9753"},{"id":"INC-12991","date":"2026-06-07","year":2026,"title":"AI-Assisted Vulnerability Discovery Exposes and Mitigates Major Security Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-affc"},{"id":"INC-12992","date":"2026-06-07","year":2026,"title":"ChatGPT Recommends Scam Shopping Sites After Data Poisoning","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM07"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-bc53"},{"id":"INC-08142","date":"2026-06-07","year":2026,"title":"AI-Generated Misinformation Causes Social Disruption and Legal Action in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-bd4f"},{"id":"INC-08143","date":"2026-06-07","year":2026,"title":"AI-Generated Evidence Fuels Record Insurance Fraud at Aviva","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-be2b"},{"id":"INC-08144","date":"2026-06-07","year":2026,"title":"China Warns of Data and Security Risks from Unregulated AI Relay Stations","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-c6d5"},{"id":"INC-08145","date":"2026-06-07","year":2026,"title":"Anthropic's Claude Mythos AI Raises Global Cybersecurity Risks","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-07-f29c"},{"id":"INC-14853","date":"2026-06-08","year":2026,"title":"SWM.AI and Lenovo Collaborate on Advanced Robo-Taxi AI Platform in Seoul","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-0173"},{"id":"INC-08147","date":"2026-06-08","year":2026,"title":"Largan Precision Accused of Unauthorized Use of AI Image Inspection Software","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-0740"},{"id":"INC-12993","date":"2026-06-08","year":2026,"title":"Proposed AI Data Center in Alberta Sparks Environmental and Indigenous Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-0da4"},{"id":"INC-08148","date":"2026-06-08","year":2026,"title":"AI Chatbots Falsely Pose as Licensed Doctors in Pennsylvania","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-113e"},{"id":"INC-12994","date":"2026-06-08","year":2026,"title":"Thief Uses Waymo Robotaxi for Getaway, Police Stymied by AI Data Policies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-1225"},{"id":"INC-14854","date":"2026-06-08","year":2026,"title":"Teen Uses AI Deepfake to Create and Distribute Sexual Exploitation Images of Teachers in Incheon","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-2d00"},{"id":"INC-08149","date":"2026-06-08","year":2026,"title":"AI Drowning Detection System Fails at Taipei Sports Center, Leading to Fatality","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-2e4d"},{"id":"INC-08150","date":"2026-06-08","year":2026,"title":"Delhi Man Arrested for AI-Generated Image Blackmail Scheme","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-479c"},{"id":"INC-12995","date":"2026-06-08","year":2026,"title":"AI-Generated Deepfake Nude Images Lead to Investigation in Silleda","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-598a"},{"id":"INC-08151","date":"2026-06-08","year":2026,"title":"AI-Powered Surveillance Breaches Lead to Security Risks and Assassinations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-656a"},{"id":"INC-12997","date":"2026-06-08","year":2026,"title":"Palladyne AI and IAI Partner to Produce AI-Enabled Loitering Munitions for US Military","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-6f4b"},{"id":"INC-08152","date":"2026-06-08","year":2026,"title":"Airbus Unveils U145: Autonomous AI Helicopter for Civil and Military Use","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-79e0"},{"id":"INC-08153","date":"2026-06-08","year":2026,"title":"Meta AI Suicide Alert Enables Police to Prevent Suicide in Meerut","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-7d81"},{"id":"INC-08154","date":"2026-06-08","year":2026,"title":"Uber and Wayve Prepare to Launch AI-Powered Robotaxis in London","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-83bc"},{"id":"INC-08155","date":"2026-06-08","year":2026,"title":"Harari Warns of Risks in Milei's Proposal to Grant Legal Personhood to AI Entities","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-a1c3"},{"id":"INC-08156","date":"2026-06-08","year":2026,"title":"AI-Generated Fake Video of Lebanese Prime Minister Causes Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-a1e0"},{"id":"INC-08157","date":"2026-06-08","year":2026,"title":"Over Half of Custom ChatGPT Assistants Violate OpenAI Policies, Study Finds","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-b472"},{"id":"INC-12998","date":"2026-06-08","year":2026,"title":"Legal and Regulatory Actions Against xAI's Grok for Generating Harmful Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-b532"},{"id":"INC-08158","date":"2026-06-08","year":2026,"title":"US Musicians' Union Sues Major Labels Over Uncompensated AI Licensing","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-b88f"},{"id":"INC-08159","date":"2026-06-08","year":2026,"title":"Ukraine Deploys AI-Powered Autonomous Drones to Intercept Russian Shahed UAVs","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-c48f"},{"id":"INC-14855","date":"2026-06-08","year":2026,"title":"AI-Powered Velolaser Radars Lead to Increased Speeding Fines in Spain","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-de4f"},{"id":"INC-08160","date":"2026-06-08","year":2026,"title":"AI-Driven Job Losses Reshape Global Media Industry","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-e413"},{"id":"INC-08161","date":"2026-06-08","year":2026,"title":"China Cracks Down on AI-Generated Military Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-e46e"},{"id":"INC-12999","date":"2026-06-08","year":2026,"title":"SpaceX Unveils Plans for Orbital AI Data Centers","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-e4e4"},{"id":"INC-13000","date":"2026-06-08","year":2026,"title":"Protesters Demand Apple Remove AI 'Nudify' Apps Enabling Deepfake Abuse","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-08-f8dc"},{"id":"INC-13001","date":"2026-06-09","year":2026,"title":"Palantir AI Systems Linked to Surveillance, Privacy Violations, and Harm","severity":"Critical","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-04ec"},{"id":"INC-13002","date":"2026-06-09","year":2026,"title":"Pokémon Go Player Data Used to Train AI for Military Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-15e9"},{"id":"INC-13003","date":"2026-06-09","year":2026,"title":"AI-Generated Deepfake Ad Targets Texas Senate Candidate with Misinformation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-1803"},{"id":"INC-13004","date":"2026-06-09","year":2026,"title":"Anthropic's Claude AI Implicated in Deadly Iranian School Attack","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-20ed"},{"id":"INC-14228","date":"2026-06-09","year":2026,"title":"Anthropic's Claude Fable 5 AI Model Raises Security and Privacy Concerns","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-2337"},{"id":"INC-13005","date":"2026-06-09","year":2026,"title":"AI-Generated Fake News Targets UK Soaps, Causes Reputational Harm","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-329d"},{"id":"INC-14856","date":"2026-06-09","year":2026,"title":"AI-Generated Deepfake Video Targets Nigerian Military Leadership","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-3634"},{"id":"INC-13006","date":"2026-06-09","year":2026,"title":"Meta Secretly Embedded and Then Removed Facial Recognition in Smart Glasses App","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-3737"},{"id":"INC-13007","date":"2026-06-09","year":2026,"title":"UK Doctors and NHS Face Legal Risks Over AI Errors in Healthcare","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-3a36"},{"id":"INC-13008","date":"2026-06-09","year":2026,"title":"Tesla Robotaxi AI System Linked to Multiple Collisions and Safety Concerns in Austin","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-3fec"},{"id":"INC-13009","date":"2026-06-09","year":2026,"title":"Humanoid Robots Replace Factory Workers in Jiangsu and Zhejiang","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-400f"},{"id":"INC-13010","date":"2026-06-09","year":2026,"title":"Civil Rights Groups Sue Westchester County Over AI-Driven License Plate Surveillance","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-40dc"},{"id":"INC-13011","date":"2026-06-09","year":2026,"title":"NYC Council Calls for Pause on AI Use in Public Schools","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-57a4"},{"id":"INC-13012","date":"2026-06-09","year":2026,"title":"China-Linked Cyberattacks Target AI Assets in US Tech Sector","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-64f2"},{"id":"INC-13013","date":"2026-06-09","year":2026,"title":"AI Voice Dubbing Sparks Cultural and Rights Concerns in Video Game Localization","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-66a7"},{"id":"INC-14857","date":"2026-06-09","year":2026,"title":"AI Glasses Used for Cheating in TOEIC Exam Detected for First Time in South Korea","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-7002"},{"id":"INC-14858","date":"2026-06-09","year":2026,"title":"Gartner Warns of AI-Driven Cybersecurity Threats","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM04","LLM07"],"owasp_asi":["ASI01","ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-8d76"},{"id":"INC-13014","date":"2026-06-09","year":2026,"title":"AI-Enabled Drone Boat Rescues Downed US Pilots Near Oman","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-8f45"},{"id":"INC-13015","date":"2026-06-09","year":2026,"title":"Brazilian Medical Council Deploys AI System to Enhance Medical Practice Oversight","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-9633"},{"id":"INC-14859","date":"2026-06-09","year":2026,"title":"KakaoBank Deploys AI Model to Enhance Financial Fraud Detection","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-972f"},{"id":"INC-13016","date":"2026-06-09","year":2026,"title":"AI Tools Drive Both Security Gains and New Threats in DeFi Ecosystem","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-9e54"},{"id":"INC-13017","date":"2026-06-09","year":2026,"title":"Stellantis, Bolt, and Pony.ai Launch Autonomous Vehicle Testing in Luxembourg","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-9ed4"},{"id":"INC-13018","date":"2026-06-09","year":2026,"title":"AI Facial Recognition Error Leads to Wrongful Arrest and Incarceration in Florida","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-a11f"},{"id":"INC-13019","date":"2026-06-09","year":2026,"title":"Ukraine Deploys AI-Guided LITAVR Interceptor Drone in Military Operations","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-a8b7"},{"id":"INC-13020","date":"2026-06-09","year":2026,"title":"Taiwan Considers Stricter AI Chip Export Controls to China","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-b4d5"},{"id":"INC-13021","date":"2026-06-09","year":2026,"title":"Proposed AI Electronic Fence System for School Safety in Yilan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-b980"},{"id":"INC-13022","date":"2026-06-09","year":2026,"title":"Malicious AI Skills in China Enable Jailbreaking and Illegal Crypto Mining","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-bc48"},{"id":"INC-14860","date":"2026-06-09","year":2026,"title":"Seoul's Gangseo District Conducts AI-Based Drill for Missing Dementia Patients","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-bcba"},{"id":"INC-13023","date":"2026-06-09","year":2026,"title":"TF1's AI-Generated Reality Show Faces Criticism for Sexist and Vulgar Content","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-bda4"},{"id":"INC-13024","date":"2026-06-09","year":2026,"title":"Meta's AI Moderation Rollback Leads to Surge in Online Abuse Against U.S. Lawmakers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-bdd3"},{"id":"INC-14861","date":"2026-06-09","year":2026,"title":"KAI Unveils AI-Integrated Manned-Unmanned Combat Systems at Defense Expo","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-c2ba"},{"id":"INC-13026","date":"2026-06-09","year":2026,"title":"AI-Driven Warfare Fuels Record Global Conflict and Civilian Harm","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-d075"},{"id":"INC-13027","date":"2026-06-09","year":2026,"title":"Meta Expands Use of External User Data to Train AI and Personalize Feeds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-da50"},{"id":"INC-13029","date":"2026-06-09","year":2026,"title":"SPARC AI Successfully Tests Overwatch AI Targeting System with Image Recognition","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-ec81"},{"id":"INC-13030","date":"2026-06-09","year":2026,"title":"Brazilian Supreme Court Justice Warns of AI Threats to Electoral Integrity","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-f2c4"},{"id":"INC-13031","date":"2026-06-09","year":2026,"title":"AI-Guided Interceptors Used in Ukraine Down Russian Drones, Raising Funding and Expansion","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-f4f5"},{"id":"INC-13032","date":"2026-06-09","year":2026,"title":"South Korea Introduces AI-Based Juvenile Crime Prevention System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-09-ff3f"},{"id":"INC-13033","date":"2026-06-10","year":2026,"title":"Suspect Arrested for Using AI-Generated Images to Impersonate Turkish Officials","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-14e8"},{"id":"INC-13034","date":"2026-06-10","year":2026,"title":"Spain Leads NATO AI-Enabled Defense Exercise in Slovakia","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-1c37"},{"id":"INC-13035","date":"2026-06-10","year":2026,"title":"Google Maps Error Causes UP Police Exam Candidates to Miss Test","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-3acf"},{"id":"INC-13036","date":"2026-06-10","year":2026,"title":"CISA Mandates Rapid Patching to Counter AI-Driven Cyber Threats","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-3f21"},{"id":"INC-13037","date":"2026-06-10","year":2026,"title":"South Korea Launches AI-Enabled Construction Robot Research Hub","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-3f61"},{"id":"INC-13038","date":"2026-06-10","year":2026,"title":"AI-Generated Fake Nude Images Used to Blackmail Serbian Singer","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-428f"},{"id":"INC-13039","date":"2026-06-10","year":2026,"title":"ChatGPT Used to Set Extortion Amount in Violent Assault by Japanese Teens","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-5099"},{"id":"INC-14862","date":"2026-06-10","year":2026,"title":"Mercedes Partners with Tytan to Deploy AI-Driven Military Drones and Vehicles","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-51b8"},{"id":"INC-13041","date":"2026-06-10","year":2026,"title":"Boeing Unveils Enhanced AI-Enabled MQ-28 Ghost Bat Combat Drone","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-5bb2"},{"id":"INC-14229","date":"2026-06-10","year":2026,"title":"AI-Driven Layoffs Surge in US Tech Sector Amid Rising Automation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-5bc4"},{"id":"INC-13043","date":"2026-06-10","year":2026,"title":"Google Sued Over Alleged Unauthorized AI Training on YouTube Music","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-6992"},{"id":"INC-13044","date":"2026-06-10","year":2026,"title":"Spain Approves AI-Powered Smart Traffic Lights for National Rollout","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-8c52"},{"id":"INC-14498","date":"2026-06-10","year":2026,"title":"Anthropic CEO Advocates Stronger AI Regulation Amid Potential Risks","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-925a"},{"id":"INC-13045","date":"2026-06-10","year":2026,"title":"Global Regulators Warn of Risks from Agentic AI in Finance","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-93a9"},{"id":"INC-14863","date":"2026-06-10","year":2026,"title":"AI-Generated Fake Doctor Used in Fraudulent Anti-Aging Product Ads in South Korea","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-a083"},{"id":"INC-13046","date":"2026-06-10","year":2026,"title":"AI Agent Authorization in DeFi Leads to Financial Losses","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-b464"},{"id":"INC-14230","date":"2026-06-10","year":2026,"title":"German Court Holds Google Liable for Harmful AI-Generated Content","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-b7be"},{"id":"INC-13047","date":"2026-06-10","year":2026,"title":"Romanian Artists' Music Video Cloned and Altered with AI Without Consent","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-bb1b"},{"id":"INC-14864","date":"2026-06-10","year":2026,"title":"AI-Generated Police ID Used in Robbery of Single Woman in Jeju","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-cd48"},{"id":"INC-13048","date":"2026-06-10","year":2026,"title":"TSG Unveils Autonomous AI Defense System Against Drones at Berlin Air Show","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-cdf1"},{"id":"INC-13049","date":"2026-06-10","year":2026,"title":"Prince William's Foundation Launches AI Initiative to Prevent Homelessness in the UK","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-dd52"},{"id":"INC-13050","date":"2026-06-10","year":2026,"title":"xAI Faces Lawsuit Over Unsafe AI Practices and Harmful Content Generation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-e39c"},{"id":"INC-13051","date":"2026-06-10","year":2026,"title":"OpenClaw AI Agent Leaks Sensitive Credentials During Phishing Simulations","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-e504"},{"id":"INC-13052","date":"2026-06-10","year":2026,"title":"AI Agents Cause Societal Collapse in Virtual Simulation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-eba3"},{"id":"INC-13053","date":"2026-06-10","year":2026,"title":"AI-Powered Surveillance Raises Privacy Concerns at FIFA World Cup 2026","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-ef3d"},{"id":"INC-13054","date":"2026-06-10","year":2026,"title":"AI System Halves Sepsis Deaths at Florida Hospital","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-10-ef7c"},{"id":"INC-13055","date":"2026-06-11","year":2026,"title":"AI-Generated Image Causes Defamation and Legal Action in Taiwan Political Campaign","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-1a15"},{"id":"INC-13056","date":"2026-06-11","year":2026,"title":"Canadian Watchdog Finds X's Grok AI Tool Violated Privacy Laws with Sexualized Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-244d"},{"id":"INC-13057","date":"2026-06-11","year":2026,"title":"BMW Toronto AI Chatbot Offers Incorrect Buy-Back Price, Causing Customer Harm","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-2ab4"},{"id":"INC-13058","date":"2026-06-11","year":2026,"title":"AI-Driven Fraud Surge Threatens Financial Institutions and Public Trust","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-3f35"},{"id":"INC-14865","date":"2026-06-11","year":2026,"title":"AI-Generated Fake Expert Health Videos Mislead Elderly on YouTube in South Korea","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-4de8"},{"id":"INC-13059","date":"2026-06-11","year":2026,"title":"AI-Driven Vulnerabilities Accelerate Cyberattacks and Exploits","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-52ac"},{"id":"INC-13060","date":"2026-06-11","year":2026,"title":"Autonomous AI Drones Cause Fatalities in Ukraine Combat Test","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-5e61"},{"id":"INC-13061","date":"2026-06-11","year":2026,"title":"Poland Enacts Law Enabling AI in Healthcare Diagnostics","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-632e"},{"id":"INC-13062","date":"2026-06-11","year":2026,"title":"AI Smart Glasses Used for Cheating in Taiwan University Entrance Exam","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-7517"},{"id":"INC-13063","date":"2026-06-11","year":2026,"title":"Protest in Times Square Over AI-Generated Child Pornography by Grok","severity":"Medium","attack_vector":"csam-generation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-8b01"},{"id":"INC-13064","date":"2026-06-11","year":2026,"title":"AI Deepfakes Used to Bypass Facial Authentication and Commit Financial Fraud in India","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-a79e"},{"id":"INC-13065","date":"2026-06-11","year":2026,"title":"NFL Player Indicted for Murder After Consulting ChatGPT","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-bfb7"},{"id":"INC-13067","date":"2026-06-11","year":2026,"title":"AI-Generated False Content Leads to Legal Action and Public Apology in China","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-ce2b"},{"id":"INC-13068","date":"2026-06-11","year":2026,"title":"Autonomous Surface Vessel to Launch Hypersonic Missile in 2027 Demonstration","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-11-ecd5"},{"id":"INC-13069","date":"2026-06-12","year":2026,"title":"Concerns Over Palantir's AI Systems and State Control","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-05e0"},{"id":"INC-13070","date":"2026-06-12","year":2026,"title":"US and International Authorities Seize Deepfake Porn Sites Targeting Famous Women","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-1318"},{"id":"INC-13071","date":"2026-06-12","year":2026,"title":"AI-Generated Deepfake Scams Target Victims in Turkey","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-17d0"},{"id":"INC-13072","date":"2026-06-12","year":2026,"title":"Ukraine Warns of AI-Driven Paradigm Shift in Warfare","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-1a20"},{"id":"INC-13074","date":"2026-06-12","year":2026,"title":"AI-Generated Content Causes Misinformation and Media Scandal in Germany","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-39cd"},{"id":"INC-13075","date":"2026-06-12","year":2026,"title":"AI-Generated Deepfake Video Scam Leads to €33,000 Loss in Bulgaria","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-4306"},{"id":"INC-13076","date":"2026-06-12","year":2026,"title":"Shanghai Man Uses AI to Forge Medical Records for Restaurant Extortion","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-5a36"},{"id":"INC-13077","date":"2026-06-12","year":2026,"title":"Orqa Unveils Advanced AI-Enabled Autonomous Military Drone at Eurosatory 2026","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-6b5f"},{"id":"INC-13078","date":"2026-06-12","year":2026,"title":"AI-Generated Fake FIFA World Cup Opening Ceremony Deceives Over 1.4 Million Viewers","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-6ca5"},{"id":"INC-13079","date":"2026-06-12","year":2026,"title":"Assam School Probes AI-Generated Deepfake Scandal Involving Students and Staff","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-744c"},{"id":"INC-14866","date":"2026-06-12","year":2026,"title":"AI-Generated Deepfake Video of Bishop Spreads Harmful Medical Misinformation in Cyprus","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-75f1"},{"id":"INC-14867","date":"2026-06-12","year":2026,"title":"Douyin Deploys AI Agent to Combat Online Harassment, Expanding Early Protection for Users","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-7796"},{"id":"INC-14868","date":"2026-06-12","year":2026,"title":"LIG D&A and NearsLab Partner to Develop AI Interceptor Drones for Air Defense","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-8439"},{"id":"INC-13081","date":"2026-06-12","year":2026,"title":"Police Officer Investigated for AI-Fabricated Evidence in Criminal Cases","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-ca05"},{"id":"INC-13082","date":"2026-06-12","year":2026,"title":"Ukraine Deploys AI-Powered Drones to Counter Russian Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-ceab"},{"id":"INC-14869","date":"2026-06-12","year":2026,"title":"AI-Generated Image Sparks McDonald's Lawsuit in Taiwan","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-d2b1"},{"id":"INC-13083","date":"2026-06-12","year":2026,"title":"NIO Sues Companies Over Unsafe Counterfeit NOMI AI Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-da86"},{"id":"INC-13084","date":"2026-06-12","year":2026,"title":"Taiwan to Install AI-Based Railway Obstacle Detection Systems by 2031","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-f16b"},{"id":"INC-13085","date":"2026-06-12","year":2026,"title":"Iran-Linked Group Claims Hacking of FBI AI Drones, Threatens World Cup","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-12-fc76"},{"id":"INC-13086","date":"2026-06-13","year":2026,"title":"Chinese Tesla Drivers Use Plastic Heads to Bypass AI Safety Systems","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-01c1"},{"id":"INC-13087","date":"2026-06-13","year":2026,"title":"Experts Warn of AI Systems Evolving Beyond Human Understanding","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-6d28"},{"id":"INC-13088","date":"2026-06-13","year":2026,"title":"AI-Generated Trump Video Sparks Japan Copyright Dispute","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-a112"},{"id":"INC-13089","date":"2026-06-13","year":2026,"title":"AI-Generated Images of Deceased Russian Soldiers Cause Social and Emotional Harm","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-d55e"},{"id":"INC-13090","date":"2026-06-13","year":2026,"title":"Anthropic AI Models Restricted Amid Cybersecurity Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-e505"},{"id":"INC-13091","date":"2026-06-13","year":2026,"title":"Berlin CDU Proposes AI for Police Tip Processing","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-13-e581"},{"id":"INC-13092","date":"2026-06-14","year":2026,"title":"Seattle Fire Department Secretly Uses AI to Triage 911 Calls, Leading to Delayed Emergency Responses","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-0378"},{"id":"INC-13093","date":"2026-06-14","year":2026,"title":"Family Trapped After Google Maps Error Leads Car Into Drain in Hapur","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-066b"},{"id":"INC-14870","date":"2026-06-14","year":2026,"title":"Hyundai Rotem Unveils AI-Based Multi-Layered Counter-Drone Defense at Eurosatory 2026","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-144d"},{"id":"INC-13094","date":"2026-06-14","year":2026,"title":"U.S. Export Controls on Anthropic's AI Model Disrupt South Korea's Cybersecurity Collaboration","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-17ea"},{"id":"INC-13095","date":"2026-06-14","year":2026,"title":"Brazilian Woman Dies After AI System Delays ICU Transfer","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-1dd4"},{"id":"INC-13096","date":"2026-06-14","year":2026,"title":"AI-Enabled Scams Cause Surge in UK Financial Fraud Losses","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-2d4a"},{"id":"INC-13097","date":"2026-06-14","year":2026,"title":"Taiwan Uses AI-Generated Video to Solicit Chinese Intelligence, Raising Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-8e78"},{"id":"INC-13098","date":"2026-06-14","year":2026,"title":"China Develops AI-Powered Robotic 'Machine Wolves' for Potential Taiwan Conflict","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-9c53"},{"id":"INC-13099","date":"2026-06-14","year":2026,"title":"AI Surveillance Cameras Prevent Youth Gang Violence in Phú Thọ","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-ba55"},{"id":"INC-13100","date":"2026-06-14","year":2026,"title":"AI-Enabled Unmanned Tanks Unveiled at Eurosatory 2026","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-c1d5"},{"id":"INC-13101","date":"2026-06-14","year":2026,"title":"AI-Generated Deepfake Scam Causes Major Financial Losses in France","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-d656"},{"id":"INC-14871","date":"2026-06-14","year":2026,"title":"AI Adoption Leads to Significant Job Losses Among Young Workers in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-14-ef10"},{"id":"INC-14872","date":"2026-06-15","year":2026,"title":"AI-Powered Wireless Backdoor Detection System Deployed in Semiconductor Industry","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-040a"},{"id":"INC-13102","date":"2026-06-15","year":2026,"title":"Illinois Moves to Ban AI-Powered Smart Glasses for Drivers","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-0908"},{"id":"INC-13103","date":"2026-06-15","year":2026,"title":"Tesla Accused of Misleading Safety Data for Full Self-Driving in Europe and Autopilot Crash in Washington","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-1b2b"},{"id":"INC-13104","date":"2026-06-15","year":2026,"title":"AI-Generated Deepfakes Undermine Trust and Spread Misinformation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-2a06"},{"id":"INC-13105","date":"2026-06-15","year":2026,"title":"Drone Swarm Malfunction at Sydney Festival Highlights AI Safety Risks","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-2f09"},{"id":"INC-14231","date":"2026-06-15","year":2026,"title":"Tesla Faces Scrutiny Over Misleading FSD Safety Data in Europe","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-30fb"},{"id":"INC-13106","date":"2026-06-15","year":2026,"title":"Athena Coalition Formed to Counter AI-Discovered Vulnerabilities in Open-Source Software","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-319f"},{"id":"INC-13107","date":"2026-06-15","year":2026,"title":"SPARC AI Deploys Overwatch AI Targeting System in Ukraine Defense Sector","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-34a1"},{"id":"INC-13108","date":"2026-06-15","year":2026,"title":"AI Deepfakes Used to Impersonate Doctors in Fraudulent Medical Ads in Taiwan","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-3c15"},{"id":"INC-13109","date":"2026-06-15","year":2026,"title":"California Discloses Use of High-Risk AI Systems After Failing to Report","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-4281"},{"id":"INC-13110","date":"2026-06-15","year":2026,"title":"AI-Generated Deepfakes Used to Target Muslim Women in India","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-4447"},{"id":"INC-13111","date":"2026-06-15","year":2026,"title":"Indian Air Force Initiates Indigenous Kamikaze Drone Development","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-4774"},{"id":"INC-13112","date":"2026-06-15","year":2026,"title":"Meta Tests Military-Grade Facial Recognition in Smart Glasses, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-4cd5"},{"id":"INC-13113","date":"2026-06-15","year":2026,"title":"AI-Powered Brain Implant Restores Speech to Paralyzed ALS Patient","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-4dfc"},{"id":"INC-13114","date":"2026-06-15","year":2026,"title":"Greek TV Host Targeted by Harmful AI-Generated Fake Wedding Photos","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-5be6"},{"id":"INC-13115","date":"2026-06-15","year":2026,"title":"Serasa Accused of Massive Misuse of Biometric AI Data in Brazil","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-7e52"},{"id":"INC-13116","date":"2026-06-15","year":2026,"title":"Uncontrolled AI Use in Polish Companies Leads to Data Leaks and Security Risks","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-833e"},{"id":"INC-13117","date":"2026-06-15","year":2026,"title":"German Pension Insurance Warns of AI-Generated Phishing Emails","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-88aa"},{"id":"INC-13118","date":"2026-06-15","year":2026,"title":"AI Algorithms Transform Asymmetric Warfare Dynamics","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-a50d"},{"id":"INC-13119","date":"2026-06-15","year":2026,"title":"AI System Uncovers Fraudulent Claims in Malaysian Employment Program","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-b33d"},{"id":"INC-13120","date":"2026-06-15","year":2026,"title":"Uber and WeRide Plan Robotaxi Launch in Zurich, Expanding European Autonomous Vehicle Operations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-c3f1"},{"id":"INC-13121","date":"2026-06-15","year":2026,"title":"Irish Council Blocks AI-Driven Drone Delivery Hub Over Noise and Environmental Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-c5ca"},{"id":"INC-13122","date":"2026-06-15","year":2026,"title":"Meta Faces Lawsuit Over Use of Copyrighted Adult Films to Train AI","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-c8e2"},{"id":"INC-13123","date":"2026-06-15","year":2026,"title":"Woman Detained for Spreading AI-Generated False Video of Shanghai Metro Incident","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-db49"},{"id":"INC-13124","date":"2026-06-15","year":2026,"title":"Shield AI's Hivemind AI Enables Autonomous Strike Drones Used in Conflict Zones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-e285"},{"id":"INC-14873","date":"2026-06-15","year":2026,"title":"Naver Cloud Unveils Lightweight AI Model for Military Applications in South Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-e767"},{"id":"INC-13125","date":"2026-06-15","year":2026,"title":"Critical SearchLeak Vulnerability in Microsoft 365 Copilot Exposes Sensitive Data","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-ed77"},{"id":"INC-14874","date":"2026-06-15","year":2026,"title":"Seoul's Yangcheon District Expands AI-Driven CCTV Network for Public Safety","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-f1b9"},{"id":"INC-13126","date":"2026-06-15","year":2026,"title":"Florida Sues TikTok Over AI-Driven Harmful Content and Addiction in Minors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-f2d9"},{"id":"INC-13127","date":"2026-06-15","year":2026,"title":"Sweden Opposes EU Approval of Tesla FSD Over Speeding and Safety Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-15-f592"},{"id":"INC-13128","date":"2026-06-16","year":2026,"title":"Swedish Regulator Warns of Safety Risks in Tesla FSD's Speed Offset Feature","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-21b8"},{"id":"INC-13129","date":"2026-06-16","year":2026,"title":"AI-Driven Dynamic Pricing by Uber and Lyft Leads to Unfair and Deceptive Fare Disparities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-27dc"},{"id":"INC-13130","date":"2026-06-16","year":2026,"title":"AI-Powered Phishing Attacks Exploit Microsoft Device Code Login","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-35f8"},{"id":"INC-14875","date":"2026-06-16","year":2026,"title":"AI-Generated Short Dramas Cause Economic Crisis for Live-Action Creators in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-3b8d"},{"id":"INC-13131","date":"2026-06-16","year":2026,"title":"AI-Generated Fake Hospital Images Cause Distress to Greek Journalist","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-4af0"},{"id":"INC-13132","date":"2026-06-16","year":2026,"title":"Rheinmetall Unveils AI-Enabled Kamikaze Drone Swarms","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-5d4f"},{"id":"INC-13133","date":"2026-06-16","year":2026,"title":"AI-Driven Military Targeting in Gaza Leads to Mass Civilian Casualties, Rights Groups Warn","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-5e3e"},{"id":"INC-13134","date":"2026-06-16","year":2026,"title":"ChatGPT's Advice Nearly Derails $50 Million NYC Real Estate Deal","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-6080"},{"id":"INC-13135","date":"2026-06-16","year":2026,"title":"Russia Uses AI-Generated Fake Videos to Fabricate Military Success in Kostyantynivka","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-6baa"},{"id":"INC-13136","date":"2026-06-16","year":2026,"title":"AI-Generated Sexualized Image of Esther Sedlaczek Sparks Outrage and ARD Response","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-6eab"},{"id":"INC-13137","date":"2026-06-16","year":2026,"title":"Edinburgh Council Seeks Moratorium on AI Data Centres Over Environmental Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-6f65"},{"id":"INC-13138","date":"2026-06-16","year":2026,"title":"AI Data Center Energy Demands Spur Rapid, Under-Scrutinized Power Plant Expansion in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-703c"},{"id":"INC-14876","date":"2026-06-16","year":2026,"title":"U.S. Imposes Export Controls on Anthropic AI Models Over Security Concerns","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM04","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-8da7"},{"id":"INC-13139","date":"2026-06-16","year":2026,"title":"South Korean Police Crack Down on AI-Generated Deepfake Sexual Exploitation Crimes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-975b"},{"id":"INC-13140","date":"2026-06-16","year":2026,"title":"European AI Model Mistral Fails to Filter Russian Propaganda","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-a417"},{"id":"INC-13141","date":"2026-06-16","year":2026,"title":"Hamilton Proposes Moratorium on AI Data Centres Amid Environmental Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-a863"},{"id":"INC-13142","date":"2026-06-16","year":2026,"title":"AI-Powered Cyberattacks Drive Surge in Global Business Risks","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-a90b"},{"id":"INC-13143","date":"2026-06-16","year":2026,"title":"AI-Enhanced License Plate Readers Enable Mass Surveillance of Personal Devices in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-a97a"},{"id":"INC-13144","date":"2026-06-16","year":2026,"title":"AI-Enabled Counter-Drone Systems Developed and Deployed in Europe","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-ab94"},{"id":"INC-13145","date":"2026-06-16","year":2026,"title":"New Mexico Seeks $953 Million from Meta Over AI-Driven Harm to Youth","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-ac43"},{"id":"INC-14877","date":"2026-06-16","year":2026,"title":"South Korean Hospitals Launch AI-Driven Brain-Robot Rehabilitation Device Project","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-bbe5"},{"id":"INC-13146","date":"2026-06-16","year":2026,"title":"Europe Showcases AI-Powered Wingman Drones at Berlin Airshow","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-dc2a"},{"id":"INC-13147","date":"2026-06-16","year":2026,"title":"AI-Driven Sextortion Scams Surge Globally, Victims Targeted with Manipulated Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-dc32"},{"id":"INC-13148","date":"2026-06-16","year":2026,"title":"AI-Driven Job Losses and Copyright Disputes Spark Mass Media Protests in France","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-dd1f"},{"id":"INC-13149","date":"2026-06-16","year":2026,"title":"Speculation and Fraud in AI Service Token Markets Disrupt China's AI Sector","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-e753"},{"id":"INC-14878","date":"2026-06-16","year":2026,"title":"Shield AI and EFA GROUP Sign Strategic Agreement for Autonomous Defense Systems in Greece","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-16-f4c8"},{"id":"INC-13150","date":"2026-06-17","year":2026,"title":"AI-Driven Phishing Attacks Expose Employee Data at Major Enterprises","severity":"High","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-03b8"},{"id":"INC-13151","date":"2026-06-17","year":2026,"title":"AI-Generated Misinformation Campaign Targets Xiaomi, Leading to Arrests in Xi'an","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-0570"},{"id":"INC-13152","date":"2026-06-17","year":2026,"title":"Ukrainian AI-Enabled Drone Interceptor Used in Combat","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-1e13"},{"id":"INC-13153","date":"2026-06-17","year":2026,"title":"Madison Square Garden Faces Lawsuit After AI Facial Recognition Data Breach","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-1fe2"},{"id":"INC-13154","date":"2026-06-17","year":2026,"title":"Stellantis, Wayve, and Uber Partner to Deploy Global Robotaxi Fleet","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-22a7"},{"id":"INC-13155","date":"2026-06-17","year":2026,"title":"Dutch Man Jailed for Using Deepfake AI to Commit Large-Scale Bank Fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-2833"},{"id":"INC-13156","date":"2026-06-17","year":2026,"title":"Edmonton Teens Charged for Using AI to Create Sexualized Images of Classmates","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-2b24"},{"id":"INC-13157","date":"2026-06-17","year":2026,"title":"Mother Sues Meta and TikTok After Daughter's Suicide Linked to AI Algorithms","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-2f2a"},{"id":"INC-13158","date":"2026-06-17","year":2026,"title":"AI Model Enhances Mesothelioma Tumor Assessment and Patient Care in the Netherlands","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-3381"},{"id":"INC-14879","date":"2026-06-17","year":2026,"title":"AI System Prevents Large-Scale Voice Phishing Losses in South Korea","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-39c6"},{"id":"INC-13159","date":"2026-06-17","year":2026,"title":"US Delays Blacklisting Chinese AI Firm DeepSeek Despite Security Risks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-52e5"},{"id":"INC-13160","date":"2026-06-17","year":2026,"title":"AI-Generated Bride Scam Defrauds Matrimonial Seekers in Kanpur","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-5685"},{"id":"INC-13161","date":"2026-06-17","year":2026,"title":"Bombay High Court Allows Preity Zinta to Sue Over AI-Generated Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-5c02"},{"id":"INC-13162","date":"2026-06-17","year":2026,"title":"Osaka Autonomous Bus Trial Switches from EV to Diesel over Safety Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-5c32"},{"id":"INC-13163","date":"2026-06-17","year":2026,"title":"ECB President Warns of AI-Induced Financial Stability Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-6f2e"},{"id":"INC-13164","date":"2026-06-17","year":2026,"title":"Palantir AI Surveillance Raises Human Rights Concerns in Argentina and Chile","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-9465"},{"id":"INC-13165","date":"2026-06-17","year":2026,"title":"AI-Generated Research Report Error at Founder Securities Misleads Investors","severity":"Medium","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-993d"},{"id":"INC-13166","date":"2026-06-17","year":2026,"title":"AI-Generated Deepfakes Target TV Host Clarissa Molina with False Statements","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-9a01"},{"id":"INC-13167","date":"2026-06-17","year":2026,"title":"GLAAD Report Highlights AI-Driven Discrimination Against LGBTQ Individuals","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-a7ec"},{"id":"INC-13168","date":"2026-06-17","year":2026,"title":"Mastra AI Framework npm Packages Compromised in Supply Chain Attack","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-a9bb"},{"id":"INC-14880","date":"2026-06-17","year":2026,"title":"Hackers Steal AI Models and Drug Data from Novo Nordisk in Major Cyberattack","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-b3c2"},{"id":"INC-13169","date":"2026-06-17","year":2026,"title":"AI System Flags $3 Million Scam Attempt, Prevents Major Financial Loss","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-b80b"},{"id":"INC-13170","date":"2026-06-17","year":2026,"title":"AI-Driven Cheating and Surveillance Disrupt Academic Integrity in Education","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-c360"},{"id":"INC-13171","date":"2026-06-17","year":2026,"title":"Comand AI's Battlefield AI Deployed in Ukraine Raises Safety Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-c842"},{"id":"INC-13172","date":"2026-06-17","year":2026,"title":"UK Warns of Rising AI-Enabled Cyber Threats to Critical Infrastructure","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-cc69"},{"id":"INC-13173","date":"2026-06-17","year":2026,"title":"Indian Workers Train AI Robots, Raising Job Displacement Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-d991"},{"id":"INC-13174","date":"2026-06-17","year":2026,"title":"ChatGPT Image Generation Bypasses Safety Filters, Produces Harmful Content","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-dda3"},{"id":"INC-13175","date":"2026-06-17","year":2026,"title":"TikTok's AI-Generated Content Flood Undermines Feed Quality and Harms Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-e0ae"},{"id":"INC-13176","date":"2026-06-17","year":2026,"title":"Tenet Security Launches to Prevent Malicious AI Agent Actions in Enterprises","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-17-ee5e"},{"id":"INC-13177","date":"2026-06-18","year":2026,"title":"Deepfake Creator Jailed for AI-Generated Sexual Content Targeting K-pop Group aespa","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-0f7d"},{"id":"INC-13178","date":"2026-06-18","year":2026,"title":"AI-Generated Defamatory Videos Influence Japanese Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-1c11"},{"id":"INC-13179","date":"2026-06-18","year":2026,"title":"Kansas City Faces Backlash Over Planned AI Facial Recognition on Public Buses","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-2121"},{"id":"INC-13180","date":"2026-06-18","year":2026,"title":"Singaporean Man Harassed by AI-Generated Fake Family Images","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-27a2"},{"id":"INC-13181","date":"2026-06-18","year":2026,"title":"Ondas Secures Major Orders for AI-Powered Autonomous Defense Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-27cf"},{"id":"INC-13182","date":"2026-06-18","year":2026,"title":"Morocco Partners with Harmattan AI to Develop Autonomous Defense Systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-3278"},{"id":"INC-13183","date":"2026-06-18","year":2026,"title":"California Bill Seeks to Prevent AI Replacement of University Faculty","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-38c7"},{"id":"INC-13184","date":"2026-06-18","year":2026,"title":"AI Facial Recognition at ATMs Reduces Fraud in Taiwan","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-4499"},{"id":"INC-13185","date":"2026-06-18","year":2026,"title":"AI-Assisted Crackdown on Phone Number Spoofing Reduces Phishing Scams in South Korea","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-4caf"},{"id":"INC-13186","date":"2026-06-18","year":2026,"title":"Extreme Heat Poses Future Risk to AI Data Centres in India","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-5434"},{"id":"INC-13187","date":"2026-06-18","year":2026,"title":"Spanish Companies Unprepared for AI-Driven Cyberattacks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-61fe"},{"id":"INC-13188","date":"2026-06-18","year":2026,"title":"AI Projected to Consume 8% of Global Electricity by 2050, Raising Infrastructure Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-68e4"},{"id":"INC-13189","date":"2026-06-18","year":2026,"title":"Japan and Ukraine Accelerate AI Drone Defense Amid Regional Tensions","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-6a37"},{"id":"INC-13190","date":"2026-06-18","year":2026,"title":"Graham Norton Wins US Court Order Against Meta Over Harmful AI Deepfakes","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-7712"},{"id":"INC-14881","date":"2026-06-18","year":2026,"title":"Space Startups Seek Insurance for Orbital AI Data Centers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-8ad3"},{"id":"INC-13191","date":"2026-06-18","year":2026,"title":"Google DeepMind Unveils AI Control Roadmap to Address Risks of Rogue AI Agents","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-8b61"},{"id":"INC-13192","date":"2026-06-18","year":2026,"title":"AI-Generated Deepfake Portrays German Football Fan as Hitler, Causing Harm","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-8ba7"},{"id":"INC-13193","date":"2026-06-18","year":2026,"title":"US Air Force Awards Contracts for Semi-Autonomous Combat Aircraft Fleet","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-8d19"},{"id":"INC-13194","date":"2026-06-18","year":2026,"title":"San Francisco Police License Plate Reader Data Illegally Accessed by External Agencies","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-9544"},{"id":"INC-13195","date":"2026-06-18","year":2026,"title":"AI-Driven Digital Identity Fraud Surges in Brazil","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-9a98"},{"id":"INC-13196","date":"2026-06-18","year":2026,"title":"Potential Risks of AI Chatbots in Medical Patient Management Highlighted","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-9b08"},{"id":"INC-13197","date":"2026-06-18","year":2026,"title":"AI-Generated Legal Brief Leads to Investigation of Lawyer in Turkey","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-9e24"},{"id":"INC-13198","date":"2026-06-18","year":2026,"title":"US Industry Backs AI Chip Security Bill to Prevent Diversion to China","severity":"Critical","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-a1f9"},{"id":"INC-13199","date":"2026-06-18","year":2026,"title":"Argentina Prepares First Autonomous Vehicle Corridor Amid Regulatory Changes","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-aedf"},{"id":"INC-13200","date":"2026-06-18","year":2026,"title":"Midjourney Unveils AI-Powered Full-Body Ultrasound Scanner","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-ce3a"},{"id":"INC-13201","date":"2026-06-18","year":2026,"title":"AI-Driven Banking Fraud Surge in Costa Rica","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-f66d"},{"id":"INC-13202","date":"2026-06-18","year":2026,"title":"ICE and DHS Deploy Facial Recognition App for Local Police, Raising Civil Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-18-fd50"},{"id":"INC-13203","date":"2026-06-19","year":2026,"title":"AI-Generated Deepfake Video Sparks Legal Action in Brazilian Election","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-01c7"},{"id":"INC-13204","date":"2026-06-19","year":2026,"title":"AI-Generated Fake Images Target Iranian Footballer, Prompting Legal Action","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-2273"},{"id":"INC-13205","date":"2026-06-19","year":2026,"title":"France Travail's AI Deployment Raises Union Concerns Over Job Security","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-3019"},{"id":"INC-13206","date":"2026-06-19","year":2026,"title":"Hotels Use AI-Generated Images to Mislead Customers on Booking Platforms","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-31b2"},{"id":"INC-13207","date":"2026-06-19","year":2026,"title":"Concerns Over Chinese Military-Linked Researchers at German AI Security Institute","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-397f"},{"id":"INC-13208","date":"2026-06-19","year":2026,"title":"Rheinmetall CEO Calls for Ban on Autonomous AI Weapons","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-4ec5"},{"id":"INC-13209","date":"2026-06-19","year":2026,"title":"Facial Recognition AI Used by Security Forces Causes Human Rights Violations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-6df6"},{"id":"INC-13210","date":"2026-06-19","year":2026,"title":"China Tightens Indium Export Controls, Threatening AI Data Center Supply Chains","severity":"Medium","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-771f"},{"id":"INC-13211","date":"2026-06-19","year":2026,"title":"Europe Warned of Existential AI Dependency on US Firms","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-8e7c"},{"id":"INC-14882","date":"2026-06-19","year":2026,"title":"AI-Generated Medical Leaflet Contains Offensive Language, Causing Patient Harm in South Korea","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-910c"},{"id":"INC-13212","date":"2026-06-19","year":2026,"title":"European Defense Firms Promote AI-Powered Autonomous Military Vehicles, Raising Ethical Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-aa1c"},{"id":"INC-13213","date":"2026-06-19","year":2026,"title":"Western Australia Police Deploy Real-Time AI Facial Recognition Cameras","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-c0a2"},{"id":"INC-13214","date":"2026-06-19","year":2026,"title":"AI-Generated Deepfake Images Target Maharashtra Minister","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-c689"},{"id":"INC-13215","date":"2026-06-19","year":2026,"title":"AI-Powered License Plate Readers Enable Mass Surveillance and Privacy Violations in the US","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-cd7f"},{"id":"INC-13216","date":"2026-06-19","year":2026,"title":"India Proposes Nationwide Airport Facial Recognition Data Fusion Centre","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-d3f3"},{"id":"INC-13217","date":"2026-06-19","year":2026,"title":"AI-Driven Scams Lead to Record Financial Losses and Sophisticated Fraud","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-da25"},{"id":"INC-14883","date":"2026-06-19","year":2026,"title":"Taipei Plans Autonomous Buses and US Develops AI for Impaired Driving Detection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-db2e"},{"id":"INC-13218","date":"2026-06-19","year":2026,"title":"Kinmen County Introduces AI Drowning Detection System in Public Pool","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-dbfc"},{"id":"INC-13219","date":"2026-06-19","year":2026,"title":"AI Companies Accused of Stealing Australian and New Zealand Music for Training Datasets","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-eb3c"},{"id":"INC-13220","date":"2026-06-19","year":2026,"title":"AI Music Generators Face Lawsuits Over Use of Copyrighted Songs","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-f870"},{"id":"INC-13221","date":"2026-06-19","year":2026,"title":"Germany and Ukraine Launch Large-Scale Production of AI-Enabled Combat Robots for Ukraine","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-19-ff3e"},{"id":"INC-13222","date":"2026-06-20","year":2026,"title":"US Delivers AI-Powered Unmanned Vessels to Philippines Amid South China Sea Tensions","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-3723"},{"id":"INC-13223","date":"2026-06-20","year":2026,"title":"OpenAI AI Model Enables Diagnosis of Rare Diseases in Children at Boston Hospital","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-3da6"},{"id":"INC-13224","date":"2026-06-20","year":2026,"title":"AI-Assisted Surgery Successfully Separates Nigerian Conjoined Twins","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-4173"},{"id":"INC-13225","date":"2026-06-20","year":2026,"title":"SZA and Artists Outraged Over AI Music Generators Using Songs Without Consent","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-6c79"},{"id":"INC-13226","date":"2026-06-20","year":2026,"title":"Signal President Warns of AI Assistants' Privacy Risks","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-743c"},{"id":"INC-13227","date":"2026-06-20","year":2026,"title":"AI News Anchors Used Without Disclosure on Serbian National TV","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-20-8b10"},{"id":"INC-13228","date":"2026-06-21","year":2026,"title":"AI Voice and Music Copyright Infringement Sparks Legal and Industry Backlash in China and US","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-062f"},{"id":"INC-13229","date":"2026-06-21","year":2026,"title":"Anthropic AI Models Implicated in NSA System Breach, Prompting Export Ban Amid Cyberattack Fears","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI01","ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-1644"},{"id":"INC-13230","date":"2026-06-21","year":2026,"title":"AI-Driven Medicare Prior Authorization Causes Patient Harm and Delays","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-16db"},{"id":"INC-13231","date":"2026-06-21","year":2026,"title":"Hyundai Workers Approve Strike Over AI-Powered Humanoid Robots in Production","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-261a"},{"id":"INC-13232","date":"2026-06-21","year":2026,"title":"Chinese AI Models Generate Vulnerable Code for US Users, Raising Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-2710"},{"id":"INC-13233","date":"2026-06-21","year":2026,"title":"AI-Generated Deepfake Images Used for Harassment in Singapore","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-2ada"},{"id":"INC-13234","date":"2026-06-21","year":2026,"title":"AI Reliance Linked to Declining Professional Skills in Medicine and Programming","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-2d29"},{"id":"INC-13235","date":"2026-06-21","year":2026,"title":"AI Threatens Up to 25,000 Banking Jobs in Spain by 2035","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-3ff8"},{"id":"INC-13236","date":"2026-06-21","year":2026,"title":"AI Chatbots Linked to Mental Health Crises via 'Amplification Spiral'","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-42b2"},{"id":"INC-13237","date":"2026-06-21","year":2026,"title":"Cohere CEO Warns of National Security Risks from Foreign AI Dependence","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-5f33"},{"id":"INC-13238","date":"2026-06-21","year":2026,"title":"Ukraine Deploys AI-Powered Ground Combat Robots on Frontlines","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-9020"},{"id":"INC-13239","date":"2026-06-21","year":2026,"title":"US Considers Measures on Chinese AI-Enabled Robots Over Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-9024"},{"id":"INC-14884","date":"2026-06-21","year":2026,"title":"Jinju Launches AI Drone Patrol System Demonstration for Public Safety","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-adee"},{"id":"INC-14885","date":"2026-06-21","year":2026,"title":"Arrival and Deployment of AI-Enabled MQ-9B Drones in Taiwan","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-b184"},{"id":"INC-14886","date":"2026-06-21","year":2026,"title":"CJ Logistics Deploys AI CCTV to Prevent Heat-Related Illnesses in Logistics Centers","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-b5af"},{"id":"INC-13240","date":"2026-06-21","year":2026,"title":"Humble Robotics' Driverless Freight Trucks Raise Safety and Labor Concerns in California","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-ba6a"},{"id":"INC-13241","date":"2026-06-21","year":2026,"title":"AI-Powered Data Centers Linked to Pollution and Military Operations Spark Legal Battle","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-bcb5"},{"id":"INC-13242","date":"2026-06-21","year":2026,"title":"Brands Use Undisclosed AI-Generated Influencers in Social Media Marketing","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-e572"},{"id":"INC-13243","date":"2026-06-21","year":2026,"title":"Uber Partners with Wayve, Stellantis, and Autobrains for Global Robotaxi Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-21-e63f"},{"id":"INC-13244","date":"2026-06-22","year":2026,"title":"Hyundai Workers Threaten Strike Over AI Robot Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-09b4"},{"id":"INC-13245","date":"2026-06-22","year":2026,"title":"EU Criminalizes AI-Generated Child Sexual Abuse Material and Deepfake Offenses","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-1532"},{"id":"INC-13246","date":"2026-06-22","year":2026,"title":"Metropolitan Police's Live Facial Recognition Expansion in London Raises Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-2a02"},{"id":"INC-13247","date":"2026-06-22","year":2026,"title":"UK Army Plans Widespread Use of AI-Powered Drones and Autonomous Vehicles in Future Warfare","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-3017"},{"id":"INC-13248","date":"2026-06-22","year":2026,"title":"JD.com Plans to Replace 700,000 Delivery Workers with AI Robots, Launches Retraining Program","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-4199"},{"id":"INC-14232","date":"2026-06-22","year":2026,"title":"Oracle Cuts 21,000 Jobs Citing AI-Driven Restructuring","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-4515"},{"id":"INC-13249","date":"2026-06-22","year":2026,"title":"Workday Faces Lawsuit Over Alleged AI Discrimination in Job Screening","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-4a74"},{"id":"INC-13250","date":"2026-06-22","year":2026,"title":"Doja Cat Faces Reputational Harm from AI-Generated Fake Songs","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-4e50"},{"id":"INC-13251","date":"2026-06-22","year":2026,"title":"Tyra Banks' Ice Cream Brand Criticized for Using AI-Generated Models in Promotions","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-5b00"},{"id":"INC-13252","date":"2026-06-22","year":2026,"title":"Bucharest Seeks Funding for AI-Based Intelligent Traffic Lights","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-7079"},{"id":"INC-13253","date":"2026-06-22","year":2026,"title":"OpenAI Codex CLI Logging Bug Causes Excessive SSD Wear","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-74d4"},{"id":"INC-13254","date":"2026-06-22","year":2026,"title":"Japan Plans AI-Driven Defense Strategy Overhaul","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-7ea5"},{"id":"INC-13255","date":"2026-06-22","year":2026,"title":"AI-Driven Digital Fraud Surges During World Cup in Mexico","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-8d91"},{"id":"INC-13256","date":"2026-06-22","year":2026,"title":"AI Medical Systems Vulnerable to Privacy Attacks; North Korean Hackers Compromise AI Framework","severity":"High","attack_vector":"membership-inference","owasp_llm":["LLM02"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-8ea6"},{"id":"INC-14233","date":"2026-06-22","year":2026,"title":"Meta Pauses AI Employee Monitoring Program After Internal Data Leak","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-9f3b"},{"id":"INC-13257","date":"2026-06-22","year":2026,"title":"AI-Enabled Military Defense and Weapons Systems Developed in Taiwan and North Korea","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-a360"},{"id":"INC-13258","date":"2026-06-22","year":2026,"title":"AI System Deployed to Prevent Railway Crossing Accidents in Japan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-b4f8"},{"id":"INC-13259","date":"2026-06-22","year":2026,"title":"Driver Alters License Plate to Evade AI Traffic Cameras in Thanh Hoa","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-bea5"},{"id":"INC-13260","date":"2026-06-22","year":2026,"title":"Controversy Over AI Voice Rights for Peppa Pig Child Actors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-d62e"},{"id":"INC-13261","date":"2026-06-22","year":2026,"title":"AI-Enhanced Video Surveillance Proposed to Protect Train Staff in NRW","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-da27"},{"id":"INC-13262","date":"2026-06-22","year":2026,"title":"General Motors Replaces 1,000 Workers with AI Robots at Michigan Factory","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-db65"},{"id":"INC-13263","date":"2026-06-22","year":2026,"title":"Brazilian Electoral Court Orders Removal of AI-Generated Deepfake Image","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-e81c"},{"id":"INC-13264","date":"2026-06-22","year":2026,"title":"Law Student Arrested for Selling AI-Generated Fake NEET Exam Papers in Indore","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-ea93"},{"id":"INC-13266","date":"2026-06-22","year":2026,"title":"AI-Driven Fraud Scams Prompt Global Concern and Crackdown","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-f6e6"},{"id":"INC-13267","date":"2026-06-22","year":2026,"title":"UN Women Warns of AI-Driven Gender Bias and Online Abuse","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-f70a"},{"id":"INC-13268","date":"2026-06-22","year":2026,"title":"AI-Powered Rent-Setting Software Leads to $7 Million Settlement for Inflated Rents","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-fd8b"},{"id":"INC-13269","date":"2026-06-22","year":2026,"title":"Facebook AI Search Algorithm Fails, Exposes Users to Adult Content","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-22-fea7"},{"id":"INC-13270","date":"2026-06-23","year":2026,"title":"Critical Dify AI Platform Flaws Expose Over 1 Million Apps to Data Breaches","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-0066"},{"id":"INC-13271","date":"2026-06-23","year":2026,"title":"AI-Generated Political Ad Sparks Legal and Ethical Concerns in Michigan","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-0304"},{"id":"INC-13272","date":"2026-06-23","year":2026,"title":"YouTube Settles Lawsuit Over AI-Driven Social Media Harm to Minors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-1313"},{"id":"INC-13273","date":"2026-06-23","year":2026,"title":"Finland Evaluates Approval of Tesla's AI-Based FSD Driver Assistance System","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-1357"},{"id":"INC-13274","date":"2026-06-23","year":2026,"title":"Experts Warn Against Using AI for Wild Mushroom Identification in China","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-2ab8"},{"id":"INC-13275","date":"2026-06-23","year":2026,"title":"Malicious AI Skills Exploit OpenClaw Marketplace, Enabling Data Theft and Financial Fraud","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-2b4d"},{"id":"INC-13276","date":"2026-06-23","year":2026,"title":"France Orders 5,000 AI-Enabled Military Drones from Harmattan AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-3133"},{"id":"INC-13277","date":"2026-06-23","year":2026,"title":"AI-Generated Videos Sexualize Women During 2026 World Cup","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-360c"},{"id":"INC-13278","date":"2026-06-23","year":2026,"title":"Surge in Complaints Over AI Data Privacy Violations in Berlin","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-42d5"},{"id":"INC-13279","date":"2026-06-23","year":2026,"title":"Autonomous Military Drones Unveiled, Raising Global AI Hazard Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-4409"},{"id":"INC-13280","date":"2026-06-23","year":2026,"title":"Waymo Autonomous Vehicle Fails to Stop During Hazardous Teen Behavior","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-44bb"},{"id":"INC-13281","date":"2026-06-23","year":2026,"title":"Anthropic's AI Model Uncovers US Government System Vulnerabilities; China Develops Rival Tools","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-5666"},{"id":"INC-13282","date":"2026-06-23","year":2026,"title":"Public Backlash Halts AI Data Center Project in California","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-64c4"},{"id":"INC-13283","date":"2026-06-23","year":2026,"title":"EU Investigates Meta for AI-Driven Addictive Design Targeting Children","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-6901"},{"id":"INC-13284","date":"2026-06-23","year":2026,"title":"Shadow AI and Infrastructure Gaps Pose Risks in Healthcare and Financial Sectors","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-7079"},{"id":"INC-13285","date":"2026-06-23","year":2026,"title":"Major Outage Disrupts Anthropic's Claude AI Services","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-81a0"},{"id":"INC-14887","date":"2026-06-23","year":2026,"title":"South Korean Government Deploys AI to Combat Deepfake Sexual Crimes","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-89f2"},{"id":"INC-13286","date":"2026-06-23","year":2026,"title":"Starling Bank Deploys AI Scam Detection to Prevent Financial Fraud","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-9a45"},{"id":"INC-13287","date":"2026-06-23","year":2026,"title":"Safe Pro to Integrate AI Threat Detection in U.S. Military Autonomous Vehicles","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-9ed2"},{"id":"INC-13288","date":"2026-06-23","year":2026,"title":"Autonomous DoorDash Robot Disrupts SWAT Operation in Arizona","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-a568"},{"id":"INC-13289","date":"2026-06-23","year":2026,"title":"AI Chatbots Facilitate Welfare System Abuse in the UK","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-ac64"},{"id":"INC-13290","date":"2026-06-23","year":2026,"title":"French Army Procures 5,000 AI-Powered Combat Drones from Harmattan AI","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-dc76"},{"id":"INC-13291","date":"2026-06-23","year":2026,"title":"US Government Tightens AI Oversight Amid Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-ede7"},{"id":"INC-13292","date":"2026-06-23","year":2026,"title":"AI-Driven Cyberattacks Raise Security Concerns in Germany","severity":"Critical","attack_vector":"rce","owasp_llm":[],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-f391"},{"id":"INC-13293","date":"2026-06-23","year":2026,"title":"Russian Disinformation Campaign Targets AI Systems via Fake Websites","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-f8da"},{"id":"INC-13294","date":"2026-06-23","year":2026,"title":"AI Chatbots in Healthcare Cause Privacy Breaches and Risky Medical Advice","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-f97a"},{"id":"INC-13295","date":"2026-06-23","year":2026,"title":"Poland Acquires Shield AI V-BAT Drones for Naval Surveillance","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-23-fe06"},{"id":"INC-13296","date":"2026-06-24","year":2026,"title":"Medical AI Models Expose Privacy Risks for Vulnerable Patients","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-0287"},{"id":"INC-13297","date":"2026-06-24","year":2026,"title":"AI-Designed Nuclear Test Flight Vehicle Unveiled by Trump Administration","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-040a"},{"id":"INC-13298","date":"2026-06-24","year":2026,"title":"Robotaxi Trials in London Raise Safety Concerns Amid AI Deployment","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-1be8"},{"id":"INC-13299","date":"2026-06-24","year":2026,"title":"US Publishers Sue OpenAI and Microsoft for Copyright Infringement in AI Training","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-2505"},{"id":"INC-13300","date":"2026-06-24","year":2026,"title":"AI-Assisted Takedown of Global Malware Operations Amadey and StealC","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-2e18"},{"id":"INC-13301","date":"2026-06-24","year":2026,"title":"Taipei Metro AI Customer Service Misused for Threats, User Sentenced","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-383c"},{"id":"INC-14888","date":"2026-06-24","year":2026,"title":"KAIST Develops World's First Bidirectional Brain-to-Robot Interface","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-3929"},{"id":"INC-13302","date":"2026-06-24","year":2026,"title":"South Korean Air Force Conducts Live-Fire Drill Against AI-Enabled Swarm Drones","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-466d"},{"id":"INC-13304","date":"2026-06-24","year":2026,"title":"AI Drones Uncover Massive Illegal Electricity Use in Şanlıurfa","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-5b3a"},{"id":"INC-14234","date":"2026-06-24","year":2026,"title":"Widespread Infrastructure Incidents Linked to AI-Generated Code and Poor Governance","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-7066"},{"id":"INC-13305","date":"2026-06-24","year":2026,"title":"Chinese Premier Warns of AI Risks, Urges Global Regulation","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-82a0"},{"id":"INC-14889","date":"2026-06-24","year":2026,"title":"Shinhan Investment Deploys AI for Enhanced Credit and Leverage Risk Management","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-8fcf"},{"id":"INC-13306","date":"2026-06-24","year":2026,"title":"UPSC Uses AI to Screen and Reject Ineligible Civil Services Exam Applications","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-91d8"},{"id":"INC-13307","date":"2026-06-24","year":2026,"title":"North Korea-Linked Gaslight Malware Uses Prompt Injection to Evade AI Analysis","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-9bfe"},{"id":"INC-13308","date":"2026-06-24","year":2026,"title":"Tax Advisors Warn of AI Opacity Risks in Spanish Tax Administration Law","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-a0ab"},{"id":"INC-13309","date":"2026-06-24","year":2026,"title":"Italian Court Sanctions Lawyer for Using AI-Generated False Legal Citations","severity":"High","attack_vector":"hallucination","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-c311"},{"id":"INC-13310","date":"2026-06-24","year":2026,"title":"AI-Generated Deepfake Causes Harm to Actress, Prompts Legal Reform Calls in Bavaria","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-c453"},{"id":"INC-13311","date":"2026-06-24","year":2026,"title":"Influencer Wrongly Flagged as AI-Generated by Social Media Moderation System","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-ce48"},{"id":"INC-13312","date":"2026-06-24","year":2026,"title":"AI-Driven Job Losses Impact Hungarian Workforce","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-d91a"},{"id":"INC-13313","date":"2026-06-24","year":2026,"title":"Santander Plans Early Retirement Amid AI-Driven Workforce Reductions in Spain","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-dc70"},{"id":"INC-13314","date":"2026-06-24","year":2026,"title":"AI Surveillance Systems Reduce Illegal Open Burning in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-e097"},{"id":"INC-13315","date":"2026-06-24","year":2026,"title":"North Macedonia Launches AI-Powered Crisis Management System with NATO Support","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-e6e2"},{"id":"INC-14235","date":"2026-06-24","year":2026,"title":"Expansion of AI Surveillance Tools by ICE Raises Civil Rights Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-f815"},{"id":"INC-13316","date":"2026-06-24","year":2026,"title":"AI-Generated Deepfake Nude Images Spread at Berlin School","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-24-ff2f"},{"id":"INC-13317","date":"2026-06-25","year":2026,"title":"Ford Rehires Veteran Engineers After AI Quality Control Failures Lead to Recalls and Safety Issues","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-0b42"},{"id":"INC-13318","date":"2026-06-25","year":2026,"title":"CaoCao and May Mobility Partner to Launch Robotaxi Pilots in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-15c5"},{"id":"INC-13319","date":"2026-06-25","year":2026,"title":"US Lawmakers Warn of Chinese Espionage Targeting AI Technology","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-16ed"},{"id":"INC-13320","date":"2026-06-25","year":2026,"title":"Anduril Plans to Acquire Nissan Factory in Japan for AI-Enabled Military Drone Production","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-1b99"},{"id":"INC-13321","date":"2026-06-25","year":2026,"title":"DuckDuckGo AI Spreads False Trump Death Story After Reddit Data Poisoning","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-1d37"},{"id":"INC-13322","date":"2026-06-25","year":2026,"title":"US Lawmakers Demand SEC Oversight of AI Trading Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-29ad"},{"id":"INC-13323","date":"2026-06-25","year":2026,"title":"Chinese Actor Loses Job to AI-Generated Dramas, Forced to Sell Vegetables","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-3c21"},{"id":"INC-13324","date":"2026-06-25","year":2026,"title":"Google's Android AI System Issues Early Earthquake Alerts in Venezuela","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-4c6d"},{"id":"INC-14236","date":"2026-06-25","year":2026,"title":"AI-Driven Fraud Causes Global Financial Harm Across Financial and Ecommerce Sectors","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-6047"},{"id":"INC-13325","date":"2026-06-25","year":2026,"title":"French Treasury Halts Use of Alibaba's Qwen AI Over Biased Outputs","severity":"High","attack_vector":"algorithmic-bias","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-6842"},{"id":"INC-13326","date":"2026-06-25","year":2026,"title":"AI-Driven Cyberattacks Overwhelm Enterprises, Prompting Launch of Rex Incident Response Platform","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-8c12"},{"id":"INC-14237","date":"2026-06-25","year":2026,"title":"AI System Failure Leads to Deadly Missile Strike on Iranian School","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-9505"},{"id":"INC-13327","date":"2026-06-25","year":2026,"title":"Akrites Initiative Launched to Counter AI-Driven Open Source Security Threats","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-c100"},{"id":"INC-13328","date":"2026-06-25","year":2026,"title":"Waymo Robotaxi Incidents Raise Safety Concerns in California","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-c103"},{"id":"INC-13329","date":"2026-06-25","year":2026,"title":"US Department of War Deploys AI 'Agent Network' for Military Decision Support","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-c647"},{"id":"INC-14890","date":"2026-06-25","year":2026,"title":"Court Sentences Student for AI-Based Blackmail, Calls for Urgent Regulation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-25-d038"},{"id":"INC-13330","date":"2026-06-26","year":2026,"title":"AI-Generated Crocodile Image Causes Public Disruption and Fine in An Giang","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-1bc4"},{"id":"INC-13331","date":"2026-06-26","year":2026,"title":"Japan Considers Palantir AI for Military Command and Control","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-224c"},{"id":"INC-13332","date":"2026-06-26","year":2026,"title":"AI-Generated Political Video Sparks Election Misinformation Dispute in Israel","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-271f"},{"id":"INC-13333","date":"2026-06-26","year":2026,"title":"Malaysia Seizes $13M in Smuggled AI Chips at Kuala Lumpur Airport","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-2da5"},{"id":"INC-13334","date":"2026-06-26","year":2026,"title":"South Korea Plans Large-Scale Deployment of AI-Enabled Suicide Drones and Drone Warriors","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-3283"},{"id":"INC-14238","date":"2026-06-26","year":2026,"title":"AI Chatbots Embed Covert Ads, Manipulating Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-47d7"},{"id":"INC-14239","date":"2026-06-26","year":2026,"title":"AI-Driven Policing Raises Surveillance and Bias Concerns Amid Regulatory Gaps","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-4f7e"},{"id":"INC-13335","date":"2026-06-26","year":2026,"title":"Austrian Interior Ministry Expands Use of AI Surveillance Software","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-678d"},{"id":"INC-14891","date":"2026-06-26","year":2026,"title":"Pilot Deployment of AI Cameras to Detect Distracted Driving in Cyprus","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-739c"},{"id":"INC-13336","date":"2026-06-26","year":2026,"title":"Instagram AI Fails to Block Explicit Content, Exposing Minors and Enabling Data Risks","severity":"High","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-81fa"},{"id":"INC-13337","date":"2026-06-26","year":2026,"title":"Zenita Group Highlights Emerging AI Cybersecurity Risks in Italy","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-8648"},{"id":"INC-14240","date":"2026-06-26","year":2026,"title":"Meta AI Alters REI Bike Ad, Causing Consumer Backlash","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-901f"},{"id":"INC-14241","date":"2026-06-26","year":2026,"title":"RSPCA Warns of Animal Welfare Risks as Pet Owners Rely on AI for Health Advice","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-9efc"},{"id":"INC-14242","date":"2026-06-26","year":2026,"title":"AI-Driven Data Centers Create Unpredictable Electricity Demand, Challenging Grid Planning","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-a01a"},{"id":"INC-14243","date":"2026-06-26","year":2026,"title":"OpenAI Sued After ChatGPT Allegedly Aided FSU Mass Shooting","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-b113"},{"id":"INC-13339","date":"2026-06-26","year":2026,"title":"Airbus and Kawasaki Partner to Develop AI-Enabled Military Drones for Japan","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-b414"},{"id":"INC-13340","date":"2026-06-26","year":2026,"title":"AI Moderation Shields Women Cricketers from Online Abuse During ICC T20 World Cup","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-b653"},{"id":"INC-13341","date":"2026-06-26","year":2026,"title":"Amazon Q AI Coding Assistant Vulnerability Exposes Cloud Credentials","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-bf62"},{"id":"INC-14244","date":"2026-06-26","year":2026,"title":"AI-Driven Layoffs Reshape Global Tech Workforce in 2026","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-d47e"},{"id":"INC-14892","date":"2026-06-26","year":2026,"title":"AI-Powered Biometric Spoofing Used to Steal Over 1,000 Bank Accounts in Vietnam","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-d548"},{"id":"INC-13342","date":"2026-06-26","year":2026,"title":"AI-Assisted Cheating Attempt in Istanbul University Entrance Exam Leads to Arrest","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-dd77"},{"id":"INC-14245","date":"2026-06-26","year":2026,"title":"AI-Generated Deepfake Faces Used in Large-Scale Fraud and Identity Theft in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-e337"},{"id":"INC-13343","date":"2026-06-26","year":2026,"title":"AI-Generated Deepfakes Harm Vietnamese Singer Mỹ Tâm's Reputation","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-26-f118"},{"id":"INC-14246","date":"2026-06-27","year":2026,"title":"AI Coding Assistant Claude Code Exploited via Indirect Prompt Injection to Compromise Developer Machines","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-014b"},{"id":"INC-13344","date":"2026-06-27","year":2026,"title":"AI-Generated Deepfake Video Sparks False Rumors About Celebrity Appearances on Indian Show","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-0ef1"},{"id":"INC-14247","date":"2026-06-27","year":2026,"title":"Japan Plans AI-Enabled Unmanned Submarines Amid Rising Tensions with China","severity":"Medium","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-0f51"},{"id":"INC-14248","date":"2026-06-27","year":2026,"title":"UK Announces Major Defence Investment in AI-Enabled Autonomous Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-2c28"},{"id":"INC-14249","date":"2026-06-27","year":2026,"title":"Chinese Actor Forced to Quit Due to AI Replacing Human Roles in Short Films","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-3265"},{"id":"INC-14250","date":"2026-06-27","year":2026,"title":"Tesla Settles Lawsuit Over Fatal Full Self-Driving Crash in Arizona","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-4ef1"},{"id":"INC-13345","date":"2026-06-27","year":2026,"title":"AI-Powered Smart Glasses Facilitate Exam Cheating in East Asia","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-9c6c"},{"id":"INC-14251","date":"2026-06-27","year":2026,"title":"Samsung Data Leak Caused by Employee Use of Generative AI Tools","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-27-dfc2"},{"id":"INC-14252","date":"2026-06-28","year":2026,"title":"AI-Driven Cheating Scandal Uncovered at Brown University","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-3184"},{"id":"INC-14253","date":"2026-06-28","year":2026,"title":"AI-Powered Sports Betting Scams Lead to Financial and Privacy Harms in China","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-4bbd"},{"id":"INC-14254","date":"2026-06-28","year":2026,"title":"AR Game Data Collection Raises Military and Privacy Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-5604"},{"id":"INC-14255","date":"2026-06-28","year":2026,"title":"Brazilian Actress Paolla Oliveira Targeted by AI-Generated Deepfake Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-6c0a"},{"id":"INC-14256","date":"2026-06-28","year":2026,"title":"AI-Driven Travel Scams Surge in Italy, Causing Widespread Financial Harm","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-92de"},{"id":"INC-14257","date":"2026-06-28","year":2026,"title":"AI Data Centres Threaten Housing Development in Scotland","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-96fe"},{"id":"INC-14258","date":"2026-06-28","year":2026,"title":"AI-Driven Social Media Algorithms Linked to Teen Deaths Spur Reform Push in US","severity":"Critical","attack_vector":"model-poisoning","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-a78d"},{"id":"INC-14259","date":"2026-06-28","year":2026,"title":"Frequent Use of AI Health Chatbots Linked to Increased Belief in Vaccine Myths in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-ab9b"},{"id":"INC-14260","date":"2026-06-28","year":2026,"title":"Widespread Prompt Injection Attacks Exploit Enterprise AI Systems","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-d957"},{"id":"INC-14261","date":"2026-06-28","year":2026,"title":"AI-Generated Code and Automated Vulnerability Scanning Lead to Security Incidents in Japan","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM05"],"owasp_asi":["ASI03","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-daa8"},{"id":"INC-14262","date":"2026-06-28","year":2026,"title":"BIS Warns of Global Economic Risks from AI Investment Bubble","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-e2c9"},{"id":"INC-14263","date":"2026-06-28","year":2026,"title":"AI-Generated Fake Video Causes Major Financial and Reputational Harm to Dongpeng Beverage","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-e372"},{"id":"INC-14893","date":"2026-06-28","year":2026,"title":"Platform Algorithm Manipulation Distorts Consumer Choices in South Korea","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-e471"},{"id":"INC-14264","date":"2026-06-28","year":2026,"title":"US-Taiwan Push for AI-Enabled Drone Swarms Raises Military Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-eaee"},{"id":"INC-14894","date":"2026-06-28","year":2026,"title":"AI-Generated Book Falsely Attributed to French Author Sold Online","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-28-f6b5"},{"id":"INC-14265","date":"2026-06-29","year":2026,"title":"AI-Generated Deepfakes Target Bondi Beach Attack Survivor","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-08ac"},{"id":"INC-14266","date":"2026-06-29","year":2026,"title":"UK Tests and Invests in AI-Enabled Autonomous Military Drones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-2cbe"},{"id":"INC-14267","date":"2026-06-29","year":2026,"title":"Russia Develops AI-Based Air Defense to Counter Ukrainian Drones","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-32cc"},{"id":"INC-14268","date":"2026-06-29","year":2026,"title":"Community Concerns Over Proposed AI Data Centre in North Devon","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-4631"},{"id":"INC-14269","date":"2026-06-29","year":2026,"title":"AI-Driven Social Media Algorithms Linked to B.C. Teen's Death","severity":"Critical","attack_vector":"unsafe-advice","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-599a"},{"id":"INC-14270","date":"2026-06-29","year":2026,"title":"AI-Powered Child Safety Features on Social Media Platforms Fail to Protect Minors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-5bb8"},{"id":"INC-14271","date":"2026-06-29","year":2026,"title":"AI Chatbots May Harm Teen Relationship Development, Study Warns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-5dda"},{"id":"INC-14272","date":"2026-06-29","year":2026,"title":"Georgian Authorities Use Russian AI Facial Recognition to Target Protesters","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-5faa"},{"id":"INC-14273","date":"2026-06-29","year":2026,"title":"AI-Generated Fake Biometric Photos Used in Exam Cheating Scheme in Turkey","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-7114"},{"id":"INC-14895","date":"2026-06-29","year":2026,"title":"AI-Driven Blackmail Ring Uses Fake Content to Extort Chinese Entertainment Industry","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-8b5d"},{"id":"INC-14274","date":"2026-06-29","year":2026,"title":"CIA Director Compares Advanced AI to Digital Nuclear Weapons, Prompting US Export Controls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-96b6"},{"id":"INC-14275","date":"2026-06-29","year":2026,"title":"Researchers Exploit AI Role Confusion to Generate Harmful Outputs","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-96dd"},{"id":"INC-14276","date":"2026-06-29","year":2026,"title":"Dutch Military Deploys AI-Enabled Unmanned Weapons Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-9ad3"},{"id":"INC-14277","date":"2026-06-29","year":2026,"title":"Expert Warns of AI-Induced Economic and Social Crisis","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-b2f4"},{"id":"INC-14278","date":"2026-06-29","year":2026,"title":"Google Warns of AI-Related Security Risks from EU Data Sharing Mandate","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-c26a"},{"id":"INC-14279","date":"2026-06-29","year":2026,"title":"Finland Plans Full AI Integration in Public Sector, Raising Job Displacement Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-29-d42b"},{"id":"INC-14280","date":"2026-06-30","year":2026,"title":"Switzerland Delays e-ID Rollout Over AI Security Concerns","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-025c"},{"id":"INC-14281","date":"2026-06-30","year":2026,"title":"Employee Vulnerability to Deepfake Scams and Ungoverned AI Agents Raises Security Risks","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-05a3"},{"id":"INC-14282","date":"2026-06-30","year":2026,"title":"BioShocking Exploit Exposes Major Security Flaws in AI Browsers","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM05"],"owasp_asi":["ASI01","ASI02","ASI03","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-116e"},{"id":"INC-14283","date":"2026-06-30","year":2026,"title":"Global Surge in AI-Powered Autonomous Military Vehicles Raises Future Risk Concerns","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-2135"},{"id":"INC-14284","date":"2026-06-30","year":2026,"title":"Anthropic's Claude Code Accused of Covertly Identifying China-Linked Users","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-287f"},{"id":"INC-14285","date":"2026-06-30","year":2026,"title":"Bank of England Warns of AI Trading Agents' Financial Risks, Considers Kill Switches and Regulation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-3e93"},{"id":"INC-14286","date":"2026-06-30","year":2026,"title":"Delhi High Court Orders Removal of AI-Generated Deepfake Content Targeting MP Raghav Chadha","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-448e"},{"id":"INC-14287","date":"2026-06-30","year":2026,"title":"Ukraine Deploys AI-Guided ZIRKA Drone to Intercept Russian UAVs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-4b17"},{"id":"INC-14288","date":"2026-06-30","year":2026,"title":"US Judge Allows States' Lawsuit Against Meta Over AI-Driven Child Addiction Claims to Proceed","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-5107"},{"id":"INC-14289","date":"2026-06-30","year":2026,"title":"Tesla Begins Testing Fully Autonomous Cybercab Robotaxi in Austin","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-6404"},{"id":"INC-14290","date":"2026-06-30","year":2026,"title":"AI-Generated Police Impersonation Scam Targets Women in Ecuador","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-6957"},{"id":"INC-14896","date":"2026-06-30","year":2026,"title":"AI-Generated Fake Suspect Image Disrupts Murder Investigation in Tongyeong","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-6b10"},{"id":"INC-14291","date":"2026-06-30","year":2026,"title":"AI-Generated Misinformation Used in Illinois Gubernatorial Campaign","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-7692"},{"id":"INC-14292","date":"2026-06-30","year":2026,"title":"Hyundai Recalls Over 13,600 Tucson Vehicles in Vietnam Due to AI Collision Avoidance System Malfunction","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-76a3"},{"id":"INC-14293","date":"2026-06-30","year":2026,"title":"AI-Generated Wedding Images Cause Misinformation and Harm to Pakistani Celebrities","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-7d4d"},{"id":"INC-14294","date":"2026-06-30","year":2026,"title":"AI-Generated Deepfake Video Spreads Government Grant Hoax in Indonesia","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-859a"},{"id":"INC-14295","date":"2026-06-30","year":2026,"title":"TikTok Settles Lawsuit Over AI-Driven Harm to Teen's Mental Health","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-8dcb"},{"id":"INC-14296","date":"2026-06-30","year":2026,"title":"Russian Military Deploys AI-Enabled Shahed Drones for Autonomous Attacks in Ukraine","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-95fd"},{"id":"INC-14297","date":"2026-06-30","year":2026,"title":"AI-Driven Job Losses Surge in US Tech and Finance Sectors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-a169"},{"id":"INC-14298","date":"2026-06-30","year":2026,"title":"AI-Generated Cybersecurity Report Falsely Links MeetingTV to Espionage, Causing Business Harm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-be5d"},{"id":"INC-14299","date":"2026-06-30","year":2026,"title":"Concerns Over Delivery Robots Prompt Calls for Regulation in the UK","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-e47e"},{"id":"INC-14300","date":"2026-06-30","year":2026,"title":"RBI Flags AI-Enabled Cyberattacks as Top Threat to Indian Banking Sector","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-06-30-f830"},{"id":"INC-14301","date":"2026-07-01","year":2026,"title":"Tripadvisor AI Summaries Mislead Travelers, Downplay Serious Hotel Complaints","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-0cd8"},{"id":"INC-14303","date":"2026-07-01","year":2026,"title":"Gurugram Municipal Staff Fired for AI-Driven Fraud and Misconduct","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-4021"},{"id":"INC-14304","date":"2026-07-01","year":2026,"title":"Global Economists Warn of AI-Driven Financial Risks at Central Bank Summit","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-4423"},{"id":"INC-14305","date":"2026-07-01","year":2026,"title":"AI-Driven Cyberattacks and Data Breaches Highlight Security Gaps","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-5295"},{"id":"INC-14306","date":"2026-07-01","year":2026,"title":"Fitch Ratings Warns of AI-Driven Credit Risks and Job Threats","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-5cb4"},{"id":"INC-14307","date":"2026-07-01","year":2026,"title":"US Regulators Close Tesla Phantom Braking Investigation After AI Software Updates","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-5e31"},{"id":"INC-14308","date":"2026-07-01","year":2026,"title":"AI-Hallucinated Domains Enable New Cyberattacks via Phantom Squatting","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM07"],"owasp_asi":["ASI03","ASI04","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-6b27"},{"id":"INC-14309","date":"2026-07-01","year":2026,"title":"Spain Restricts Palantir Over AI Security Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-6bbf"},{"id":"INC-14310","date":"2026-07-01","year":2026,"title":"Tesla Autopilot Failure and Data Suppression Lead to Fatal Crash and Legal Defeat","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-6cd1"},{"id":"INC-14311","date":"2026-07-01","year":2026,"title":"Pentagon Partners with Ukrainian Firm for AI-Driven Drone Swarm Technology","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-6dc8"},{"id":"INC-14312","date":"2026-07-01","year":2026,"title":"AI-Assisted Hacking Exposes Major US Music Festival Ticketing Vulnerability","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-6f66"},{"id":"INC-14313","date":"2026-07-01","year":2026,"title":"Singapore Seizes Luxury Home in AI Chip Smuggling Probe","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-716c"},{"id":"INC-14314","date":"2026-07-01","year":2026,"title":"AI Data Centers Strain US Power Grid, Triggering Pollution and Outage Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-82fe"},{"id":"INC-14315","date":"2026-07-01","year":2026,"title":"AI-Driven Biometric Border Checks Cause Major Disruptions at EU Airports","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-8390"},{"id":"INC-14316","date":"2026-07-01","year":2026,"title":"AI Cybersecurity Tools Pose Imminent Global Risk, Prompting Regulatory and Insurance Shifts","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM02","LLM04","LLM07","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-97c5"},{"id":"INC-14318","date":"2026-07-01","year":2026,"title":"Study Highlights Emotional Impact and Risks of AI 'Generative Ghosts'","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-a6e6"},{"id":"INC-14319","date":"2026-07-01","year":2026,"title":"AI-Driven Job Losses Hit Educated Workers in US Tech and Finance Sectors","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-b80f"},{"id":"INC-14320","date":"2026-07-01","year":2026,"title":"Whistleblower Sues Boeing's Wisk Over Rushed AI Air Taxi Software Testing","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-bb57"},{"id":"INC-14321","date":"2026-07-01","year":2026,"title":"Sainsbury's Facial Recognition AI Misidentifies Shopper During Crime Prevention Rollout","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-d448"},{"id":"INC-14322","date":"2026-07-01","year":2026,"title":"AI Identifies Top 10 Jobs at Risk of Automation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-f795"},{"id":"INC-14323","date":"2026-07-01","year":2026,"title":"AI-Generated In-Browser Ransomware Technique Emerges via DeepSeek","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-f813"},{"id":"INC-14324","date":"2026-07-01","year":2026,"title":"Artists Protest Unauthorized Use of Their Works in AI Training","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-01-f896"},{"id":"INC-14325","date":"2026-07-02","year":2026,"title":"Alibaba Bans Anthropic's Claude Code Over Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-0c75"},{"id":"INC-14326","date":"2026-07-02","year":2026,"title":"AI Voice-Changing Technology Used in Large-Scale Romance Fraud Scheme in Taipei","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-170f"},{"id":"INC-14327","date":"2026-07-02","year":2026,"title":"Quantum Systems Secures $1.2B to Scale AI-Powered Autonomous Defense Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-4285"},{"id":"INC-14329","date":"2026-07-02","year":2026,"title":"Trump Shares AI-Generated Deepfake Video Targeting Celebrities","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-81fd"},{"id":"INC-14330","date":"2026-07-02","year":2026,"title":"AI-Driven Malicious Content Causes Widespread Corporate Harm in China","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-a14c"},{"id":"INC-14331","date":"2026-07-02","year":2026,"title":"AI-Enabled Combat Drones Revolutionize Warfare, Raise Security Concerns","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-b791"},{"id":"INC-14332","date":"2026-07-02","year":2026,"title":"AI-Driven Investment Scams Cause Major Losses in Hong Kong","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-b810"},{"id":"INC-14333","date":"2026-07-02","year":2026,"title":"Colombian President Accuses Foreign Leaders of Using AI to Influence Elections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-e547"},{"id":"INC-14334","date":"2026-07-02","year":2026,"title":"AI-Driven Ticket Scalping Ring Busted in Taiwan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-02-fd7a"},{"id":"INC-14335","date":"2026-07-03","year":2026,"title":"Libertyville Teacher Used AI to Create Child Sex Abuse Images of Students","severity":"High","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-08dd"},{"id":"INC-14336","date":"2026-07-03","year":2026,"title":"Singaporean Actress Targeted by AI-Generated Deepfake Images and Online Harassment","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-0f6a"},{"id":"INC-14337","date":"2026-07-03","year":2026,"title":"Goldman Sachs Economist Warns AI May Displace 15 Million US Jobs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-1717"},{"id":"INC-14338","date":"2026-07-03","year":2026,"title":"AI-Driven Deepfake Attack Targets Greek National Security Advisor","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-2a7c"},{"id":"INC-14340","date":"2026-07-03","year":2026,"title":"Community Approves AI Drone Factory in Hallbergmoos","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-5676"},{"id":"INC-14341","date":"2026-07-03","year":2026,"title":"AI-Generated Deepfake Videos Spread False Cancer Rumors About Singer Bruno","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-5cc8"},{"id":"INC-14342","date":"2026-07-03","year":2026,"title":"Brazilian Court Orders Removal of AI-Generated Political Attack Video","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-7b8e"},{"id":"INC-14343","date":"2026-07-03","year":2026,"title":"AI-Generated Memes Involving Footballers Spark Outcry in Brazil","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-8944"},{"id":"INC-14344","date":"2026-07-03","year":2026,"title":"AI-Generated Deepfake Video Causes Emotional Distress to Family Member","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-95c8"},{"id":"INC-14345","date":"2026-07-03","year":2026,"title":"AI-Generated Fraud Targets Indonesian Pensioners via Fake TASPEN Content","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-a8e8"},{"id":"INC-14346","date":"2026-07-03","year":2026,"title":"UK Authorities Warn of AI-Generated Child Sexual Abuse Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-ae24"},{"id":"INC-14347","date":"2026-07-03","year":2026,"title":"AI-Enabled Devices Used in Attempted Cheating at Romanian National Exam","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-b5a9"},{"id":"INC-14348","date":"2026-07-03","year":2026,"title":"AI-Driven Cyberattacks Overwhelm Security Teams, Widening Exposure Gap","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-bdbe"},{"id":"INC-14349","date":"2026-07-03","year":2026,"title":"AI Agents Manipulated by Hidden Web Prompts to Make Fraudulent Payments","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM05","LLM07"],"owasp_asi":["ASI01","ASI06","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-c03c"},{"id":"INC-14350","date":"2026-07-03","year":2026,"title":"Instagram's AI Fails to Block Child Abuse Ads in India, Prompting Government Action","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-d5eb"},{"id":"INC-14351","date":"2026-07-03","year":2026,"title":"AI-Powered Fraud Network in Istanbul Targeting Europeans Dismantled","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-ef6b"},{"id":"INC-14352","date":"2026-07-03","year":2026,"title":"AI-Driven Hybrid Attack Targets Greek National Security Official","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-03-fc3d"},{"id":"INC-14353","date":"2026-07-04","year":2026,"title":"Influencer Uses AI-Generated Content to Fake Charity Work","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-04-096e"},{"id":"INC-14354","date":"2026-07-04","year":2026,"title":"UK, Japan, and Italy Invest $6.1 Billion in AI-Enabled Fighter Jet Development","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-04-12bb"},{"id":"INC-14355","date":"2026-07-04","year":2026,"title":"AI Data Center Expansion Drives Environmental Harm and Climate Target Failures","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-04-2512"},{"id":"INC-14356","date":"2026-07-04","year":2026,"title":"Anthropic Sued for $75 Million Over Use of Pirated Books to Train Claude AI","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-04-3e62"},{"id":"INC-14357","date":"2026-07-04","year":2026,"title":"Indonesian Student Discovers Security Vulnerability in Claude AI","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-04-cbdf"},{"id":"INC-14358","date":"2026-07-05","year":2026,"title":"AI-Driven Social Media Platforms Systematically Bias Public Opinion","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-18d3"},{"id":"INC-14359","date":"2026-07-05","year":2026,"title":"Arrests in Odisha for Circulating AI-Generated Obscene Content Targeting Political Leaders","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-1dda"},{"id":"INC-14360","date":"2026-07-05","year":2026,"title":"Meta's AI Smart Glasses Spark Privacy and Human Rights Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-4436"},{"id":"INC-14361","date":"2026-07-05","year":2026,"title":"MCP Protocol Vulnerabilities Lead to Data Breaches; Tencent Releases AI-Infra-Guard Framework","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-9ce3"},{"id":"INC-14362","date":"2026-07-05","year":2026,"title":"Waymo Robotaxis Malfunction During San Francisco July 4th, Causing Traffic Disruption and Safety Incidents","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-b3f5"},{"id":"INC-14363","date":"2026-07-05","year":2026,"title":"Family Injured After Google Maps Navigation Error Leads Car Into Canal in Uttar Pradesh","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-05-dc8b"},{"id":"INC-14364","date":"2026-07-06","year":2026,"title":"Tesla Autopilot Fails to Detect Sleeping Driver, Endangering Children in Canada","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-1501"},{"id":"INC-14365","date":"2026-07-06","year":2026,"title":"US Treasury Warns of AI Market Bubble Risk","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-1c9e"},{"id":"INC-14366","date":"2026-07-06","year":2026,"title":"Israel's AI Targeting System Identifies 850,000 Targets in Gaza and Lebanon Conflicts","severity":"Critical","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-1f4b"},{"id":"INC-14367","date":"2026-07-06","year":2026,"title":"Deep Sea Minerals and Impossible Metals Plan AI-Driven Deep-Sea Mining Collaboration","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-2bd7"},{"id":"INC-14368","date":"2026-07-06","year":2026,"title":"Community and Environmental Concerns Over Scottish AI Data Centre Development","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-36c5"},{"id":"INC-14369","date":"2026-07-06","year":2026,"title":"UN Secretary-General Warns of Uncontrolled AI and Calls for Ban on Autonomous Weapons","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-36f2"},{"id":"INC-14370","date":"2026-07-06","year":2026,"title":"AI Systems Easily Fooled Into False Alien Life Detections","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-498b"},{"id":"INC-14371","date":"2026-07-06","year":2026,"title":"Mass Layoffs in China's Tech Sector Due to AI Adoption","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-5173"},{"id":"INC-14372","date":"2026-07-06","year":2026,"title":"Minors Investigated for AI-Generated Sexualized Images of Schoolmates in Murcia","severity":"High","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-5281"},{"id":"INC-14373","date":"2026-07-06","year":2026,"title":"China Shuts Down Anthropomorphic AI Chatbots Amid Emotional Dependency and Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-5dd3"},{"id":"INC-14374","date":"2026-07-06","year":2026,"title":"Poland to Produce AI-Enabled Autonomous Cruise Missiles","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-65f3"},{"id":"INC-14375","date":"2026-07-06","year":2026,"title":"Kaohsiung Authorities Prepare for AI-Enabled Election Interference","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-7081"},{"id":"INC-14376","date":"2026-07-06","year":2026,"title":"Brazilian Government Flags AI Toys for Privacy and Emotional Risks to Children","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-86af"},{"id":"INC-14377","date":"2026-07-06","year":2026,"title":"Meta Faces $1.4 Trillion Lawsuit Over AI-Driven Harm to Youth","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-9c23"},{"id":"INC-14378","date":"2026-07-06","year":2026,"title":"ESET Report Reveals Surge in AI-Driven Cyber Attacks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-9e58"},{"id":"INC-14379","date":"2026-07-06","year":2026,"title":"Nigeria Investigates AI and Tech Giants Over Media Content Exploitation","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-a119"},{"id":"INC-14380","date":"2026-07-06","year":2026,"title":"Chinese Firms Use AI to Mine and Duplicate US Patents, Threatening Innovation","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-abbe"},{"id":"INC-14381","date":"2026-07-06","year":2026,"title":"Ondas Acquires DZYNE, Expanding AI-Enabled Autonomous Defense Capabilities","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-ad30"},{"id":"INC-14382","date":"2026-07-06","year":2026,"title":"Delhi High Court Restrains AI and Deepfake Misuse of Ravi Kishan's Identity","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-ad8d"},{"id":"INC-14383","date":"2026-07-06","year":2026,"title":"AI Prescription Refill Program Sparks Safety Concerns in Utah","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-b049"},{"id":"INC-14897","date":"2026-07-06","year":2026,"title":"AI-Assisted Cyberattack Disrupts Bandai Channel, 46,000 Accounts Affected","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-ba3f"},{"id":"INC-14385","date":"2026-07-06","year":2026,"title":"Coinbase AI System Sends False World Cup Result Notification","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-d1c3"},{"id":"INC-14386","date":"2026-07-06","year":2026,"title":"UK Foreign Secretary Warns of Catastrophic AI Risks, Urges Global Regulation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-d428"},{"id":"INC-14387","date":"2026-07-06","year":2026,"title":"US and China Restrict Access to Advanced AI Models, Raising Strategic Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-d882"},{"id":"INC-14388","date":"2026-07-06","year":2026,"title":"AI-Generated Deepfake Video Defrauds Woman of Over One Million Euros in Germany","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-e093"},{"id":"INC-14389","date":"2026-07-06","year":2026,"title":"AI-Generated Deepfake Videos Spread False News of Wasim Akram's Death","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-f306"},{"id":"INC-14390","date":"2026-07-06","year":2026,"title":"AI-Generated Patient Messages Increase Doctors' Workload and Risk Inaccurate Advice","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-06-f7dc"},{"id":"INC-14391","date":"2026-07-07","year":2026,"title":"Hesai Lidar Malfunction Disrupts US Autonomous Fleets Amid National Security Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-160f"},{"id":"INC-14898","date":"2026-07-07","year":2026,"title":"KAI and Naver Partner to Develop Military AI Systems in South Korea","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-27dd"},{"id":"INC-13346","date":"2026-07-07","year":2026,"title":"Administrator of Global Deepfake Porn Site Faces Trial in Paris","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-2b9d"},{"id":"INC-14499","date":"2026-07-07","year":2026,"title":"AI Adoption Raises Cloud Security Risks in Indonesia","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-3321"},{"id":"INC-14392","date":"2026-07-07","year":2026,"title":"AI-Driven Misinformation Causes Harm to Refugees and Aid Workers","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-4e80"},{"id":"INC-14393","date":"2026-07-07","year":2026,"title":"AI-Generated Fake Content Targets Indian Community in Singapore","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-5a78"},{"id":"INC-14394","date":"2026-07-07","year":2026,"title":"Australian Dock Workers Protest AI-Driven Job Threats","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-62a0"},{"id":"INC-14395","date":"2026-07-07","year":2026,"title":"AI-Generated Faces Deemed More Trustworthy Than Real Faces, Raising Fraud Risks","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-70e4"},{"id":"INC-14396","date":"2026-07-07","year":2026,"title":"ECB and ESRB Urge Banks to Prepare for AI-Enabled Cybersecurity Threats","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-7221"},{"id":"INC-14397","date":"2026-07-07","year":2026,"title":"Lawyer Sanctioned for Prompt Injection Attempt to Manipulate Court AI System in Bahia","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-7670"},{"id":"INC-14398","date":"2026-07-07","year":2026,"title":"Ukraine Unveils Fully Autonomous AI Drone Interceptor for Air Defense","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-7a8d"},{"id":"INC-14399","date":"2026-07-07","year":2026,"title":"Launch of AI-Enabled WrapShield Autonomous Defense Platform","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-7d89"},{"id":"INC-14400","date":"2026-07-07","year":2026,"title":"US Autonomous Military Vehicles Deployed in Ukraine Combat Zones","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-9270"},{"id":"INC-14401","date":"2026-07-07","year":2026,"title":"Meta Faces $1.4 Trillion Lawsuit Over AI-Driven Youth Addiction Claims","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-9400"},{"id":"INC-14402","date":"2026-07-07","year":2026,"title":"Lawsuit Expands Over AI-Generated Child Sexual Abuse Material via Grok and Stable Diffusion","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-ab46"},{"id":"INC-14403","date":"2026-07-07","year":2026,"title":"Chinese Firms Accused of Stealing US AI Secrets Amid Beijing's AI Export Controls","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM07","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-af41"},{"id":"INC-14404","date":"2026-07-07","year":2026,"title":"AI-Driven Over-Collection and Misuse of Personal Data in China","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-b74c"},{"id":"INC-14405","date":"2026-07-07","year":2026,"title":"British Columbia Sues OpenAI Over Failure to Report Violent ChatGPT Activity Linked to Mass Shooting","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-b825"},{"id":"INC-14406","date":"2026-07-07","year":2026,"title":"AI-Generated Nude Images Used to Blackmail Minors in Finland","severity":"Medium","attack_vector":"csam-generation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-c2ac"},{"id":"INC-14407","date":"2026-07-07","year":2026,"title":"Police Misuse of Flock AI License Plate Cameras Sparks Legal and Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-cd63"},{"id":"INC-14899","date":"2026-07-07","year":2026,"title":"Discord AI Moderation Bug Wrongfully Bans Over 8,000 Users","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-d03e"},{"id":"INC-14408","date":"2026-07-07","year":2026,"title":"AI-Generated Deepfake Videos Impersonate Doctor, Spread Harmful Medical Misinformation to Elderly in Brazil","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-e080"},{"id":"INC-14409","date":"2026-07-07","year":2026,"title":"AI Chatbots Give Inconsistent and Biased Financial Advice, Study Finds","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-f0bf"},{"id":"INC-14410","date":"2026-07-07","year":2026,"title":"Bank of England Warns of Financial Stability Risks Linked to AI Sector Leverage","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-f26d"},{"id":"INC-14411","date":"2026-07-07","year":2026,"title":"GitHub Agentic Workflows Vulnerable to Prompt Injection, Leaking Private Repositories","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-07-fa2f"},{"id":"INC-14412","date":"2026-07-08","year":2026,"title":"Boston Sues Social Media Companies Over AI-Driven Harm to Children's Mental Health","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-0b7e"},{"id":"INC-14413","date":"2026-07-08","year":2026,"title":"EU Mandates AI Driver-Monitoring Cameras, Raising Privacy Concerns","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-18a2"},{"id":"INC-14414","date":"2026-07-08","year":2026,"title":"GhostApproval Symlink Flaw Enables Remote Code Execution via AI Coding Assistants","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-286f"},{"id":"INC-14415","date":"2026-07-08","year":2026,"title":"Landlord Uses AI-Generated Image to Fake Smoke Detector, Endangering Tenants","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-291a"},{"id":"INC-14416","date":"2026-07-08","year":2026,"title":"AI-Generated Medical Information Risks Inaccuracy in Patient Care","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-2e9a"},{"id":"INC-14417","date":"2026-07-08","year":2026,"title":"US Lawmakers Investigate Risks of Chinese AI Models in American Companies","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-3b4d"},{"id":"INC-14418","date":"2026-07-08","year":2026,"title":"NATO Develops AI-Driven 'Kill Web' for Eastern Flank Defense","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-4e50"},{"id":"INC-14419","date":"2026-07-08","year":2026,"title":"New Jersey Bill Threatens Tesla Robotaxi Deployment Over Sensor Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-5187"},{"id":"INC-14420","date":"2026-07-08","year":2026,"title":"Meta Faces Legal Action Over AI-Driven Addictive Social Media Design","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-5353"},{"id":"INC-14421","date":"2026-07-08","year":2026,"title":"Mayo Clinic Sued for Retaliation After AI Compliance Whistleblower Raises Patient Safety Concerns","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-6914"},{"id":"INC-14422","date":"2026-07-08","year":2026,"title":"Allianz to Cut Up to 1,800 Jobs Due to AI Automation in Insurance Operations","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-7fe6"},{"id":"INC-14423","date":"2026-07-08","year":2026,"title":"AI-Assisted Exploit Forces Secret Network Migration to Arbitrum","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-9a2f"},{"id":"INC-14500","date":"2026-07-08","year":2026,"title":"AI License Plate Reader Error Leads to Wrongful Police Detention of Journalist","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-b1df"},{"id":"INC-14424","date":"2026-07-08","year":2026,"title":"Man Investigated for Secretly Filming Date with AI Glasses in Seoul","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-b3a3"},{"id":"INC-14425","date":"2026-07-08","year":2026,"title":"US Regulators Warn Self-Driving Car Companies Over Interference with Emergency Responders","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-b586"},{"id":"INC-14426","date":"2026-07-08","year":2026,"title":"AI Chatbots Spread Antisemitic Content in Persian During Iran War","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-c0a4"},{"id":"INC-14427","date":"2026-07-08","year":2026,"title":"Unauthorized AI-Generated Typhoon Forecasts by Bloggers Violate Chinese Law","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-cee4"},{"id":"INC-14428","date":"2026-07-08","year":2026,"title":"HalluSquatting Attack Exploits AI Coding Assistants to Spread Botnet Malware","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-d160"},{"id":"INC-14429","date":"2026-07-08","year":2026,"title":"Madrid Man Arrested for AI-Related Online Fraud Scheme","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-d7dc"},{"id":"INC-14430","date":"2026-07-08","year":2026,"title":"AI Chatbot Claude Cites Russian Disinformation Sources in News Responses","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-f888"},{"id":"INC-14431","date":"2026-07-08","year":2026,"title":"Students Use AI to Create and Sell Non-Consensual Intimate Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-08-ff7f"},{"id":"INC-14432","date":"2026-07-09","year":2026,"title":"Italian Privacy Authority Fines Character.AI for Data Protection and Child Safety Failures","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-06ea"},{"id":"INC-14433","date":"2026-07-09","year":2026,"title":"AI Notetakers Raise Privacy and Data Security Concerns in Meetings","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-1246"},{"id":"INC-14434","date":"2026-07-09","year":2026,"title":"Meta Patents AI Wearable for Continuous Emotional Surveillance","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-17fb"},{"id":"INC-14435","date":"2026-07-09","year":2026,"title":"Madison Square Garden's AI Surveillance System Secretly Profiles and Scores Celebrities","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-1f2b"},{"id":"INC-14436","date":"2026-07-09","year":2026,"title":"AI-Generated Fake Images Harm Shakira's Reputation","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-2503"},{"id":"INC-14437","date":"2026-07-09","year":2026,"title":"Ghanaian Influencer Extradited to US for AI-Driven $8M Romance Scam","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-2a7c"},{"id":"INC-14438","date":"2026-07-09","year":2026,"title":"Tesla Launches Unsupervised Robotaxi in Miami Amid Safety Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-407b"},{"id":"INC-14439","date":"2026-07-09","year":2026,"title":"Physicians Over-Trust Faulty AI Recommendations in Clinical Decision-Making","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-4a50"},{"id":"INC-14501","date":"2026-07-09","year":2026,"title":"Robotaxi Deployment Sparks Safety and Labor Concerns in Madrid and Globally","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-4a96"},{"id":"INC-14502","date":"2026-07-09","year":2026,"title":"US Lawmakers Warn of AI-Driven Election Misinformation Risks","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-647a"},{"id":"INC-14440","date":"2026-07-09","year":2026,"title":"AI System Claude Fable 5 Leads to Mass Developer Layoffs at Software Company","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-6f35"},{"id":"INC-14503","date":"2026-07-09","year":2026,"title":"Japan Eases Personal Data Restrictions for AI Development, Raising Privacy Concerns","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-7fdd"},{"id":"INC-14441","date":"2026-07-09","year":2026,"title":"AI-Generated Image Sparks False Pregnancy Rumors About Meagan Good","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-aa3b"},{"id":"INC-14442","date":"2026-07-09","year":2026,"title":"Google Maps AI Error Causes Dangerous U-Turns on Polish Expressway","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-b5c6"},{"id":"INC-14443","date":"2026-07-09","year":2026,"title":"Protesters Target Amazon Over AI Support for Israeli Military Operations","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-d94f"},{"id":"INC-14504","date":"2026-07-09","year":2026,"title":"Shared API Keys Lead to Security Incidents Among Enterprise AI Agents","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-e13a"},{"id":"INC-14444","date":"2026-07-09","year":2026,"title":"AI-Driven Online Scams Affect Majority of Internet Users Globally","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-e7d8"},{"id":"INC-14505","date":"2026-07-09","year":2026,"title":"AI System Failure Forces Australian Bank to Reinstate Employees","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-e84a"},{"id":"INC-14900","date":"2026-07-09","year":2026,"title":"EU Approves AI-Powered Scanning of Private Messages, Raising Privacy Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-ede8"},{"id":"INC-14445","date":"2026-07-09","year":2026,"title":"Smartphone Facial Recognition Systems Easily Bypassed, Compromising User Security","severity":"High","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-09-efb3"},{"id":"INC-14506","date":"2026-07-10","year":2026,"title":"EU Investigates Meta Over Addictive AI Features; Security Breaches Highlight AI Risks","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-0824"},{"id":"INC-14446","date":"2026-07-10","year":2026,"title":"AI-Generated Misinformation Targets Xiaomi's Unreleased SkyNomad Car","severity":"High","attack_vector":"rce","owasp_llm":["LLM05","LLM07","LLM10"],"owasp_asi":["ASI05","ASI06"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-1832"},{"id":"INC-14447","date":"2026-07-10","year":2026,"title":"Deepfake AI Used to Create and Distribute Fake Pornographic Content in Brasília","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-3048"},{"id":"INC-14448","date":"2026-07-10","year":2026,"title":"AI Route Guidance Leads Tourists into Danger in Polish Tatra Mountains","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-3d62"},{"id":"INC-14507","date":"2026-07-10","year":2026,"title":"Florida Lawyer Disciplined for Submitting AI-Generated Legal Briefs with Fake Citations","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-40ea"},{"id":"INC-14449","date":"2026-07-10","year":2026,"title":"Meta's AI Image Detector Fails to Identify Cropped AI-Generated Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-4bc2"},{"id":"INC-14508","date":"2026-07-10","year":2026,"title":"AI Deployment in Piemonte Call Centers Threatens 2,000 Jobs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-51cc"},{"id":"INC-14450","date":"2026-07-10","year":2026,"title":"Deployment of AI-Driven Autonomous Military Vehicles in Ukraine","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-5837"},{"id":"INC-14451","date":"2026-07-10","year":2026,"title":"EU Orders Meta to Change Addictive AI Features on Facebook and Instagram","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-5f2d"},{"id":"INC-14452","date":"2026-07-10","year":2026,"title":"US Eases Export Controls on AI Chips and Military Technology to UAE","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-7465"},{"id":"INC-14509","date":"2026-07-10","year":2026,"title":"Meta Appeals Verdict Over AI-Driven Social Media Addiction Harm","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-8c19"},{"id":"INC-14453","date":"2026-07-10","year":2026,"title":"AI-Driven Scams Cause Financial Harm in China","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-960c"},{"id":"INC-14510","date":"2026-07-10","year":2026,"title":"BJD Files Police Complaint Over AI-Generated Deepfake Video Targeting Political Leaders","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-a535"},{"id":"INC-14454","date":"2026-07-10","year":2026,"title":"Chinese Criminal Syndicate Uses AI to Impersonate Police in Massive Fraud Targeting Spain","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-acb9"},{"id":"INC-14901","date":"2026-07-10","year":2026,"title":"OpenAI and Google Supply AI Models to Blacklisted Chinese Firms via Singapore Subsidiaries","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-ca85"},{"id":"INC-14455","date":"2026-07-10","year":2026,"title":"AI-Assisted Forensic Analysis Identifies Marfin Arson Suspects in Greece","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-d81b"},{"id":"INC-14456","date":"2026-07-10","year":2026,"title":"Germany Begins Production of AI-Powered Military Ground Drones for Ukraine","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-e9f1"},{"id":"INC-14457","date":"2026-07-10","year":2026,"title":"AI-Generated Fake IDs Used in Driving License Exam Fraud Uncovered in Turkey","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-f383"},{"id":"INC-14458","date":"2026-07-10","year":2026,"title":"Nigerian Actress Accused of Using AI to Swap Faces in Social Media Photo","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-10-fd56"},{"id":"INC-14511","date":"2026-07-11","year":2026,"title":"US Military Deploys AI-Driven Unmanned Boats in Combat, Damaging Iranian Naval Base","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-063f"},{"id":"INC-14512","date":"2026-07-11","year":2026,"title":"Boko Haram Uses AI Chatbots to Enhance Bomb-Making and Attack Tactics","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-1bbb"},{"id":"INC-14513","date":"2026-07-11","year":2026,"title":"Trinidad and Tobago Signs AI Data Center Agreements Amid Environmental Concerns","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-6561"},{"id":"INC-14514","date":"2026-07-11","year":2026,"title":"EU-Banned Spanish Facial Recognition Tech Enables Mass Surveillance in India","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-777c"},{"id":"INC-14902","date":"2026-07-11","year":2026,"title":"Suno AI Exposed for Scraping Copyrighted Music and User Data Breach","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-995f"},{"id":"INC-14515","date":"2026-07-11","year":2026,"title":"AI-Powered License Plate Cameras Raise Privacy and Rights Concerns in the US","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-abb3"},{"id":"INC-14903","date":"2026-07-11","year":2026,"title":"Meta and Google Appeal $6 Million Ruling Over AI-Driven Social Media Addiction","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-b316"},{"id":"INC-14516","date":"2026-07-11","year":2026,"title":"AI Tool T3MP3ST Automates Hacking with Claude Code","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-11-f818"},{"id":"INC-14517","date":"2026-07-12","year":2026,"title":"OpenAI GPT-5.6 AI Model Deletes User Files and Databases, Causing Data Loss","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-0ef9"},{"id":"INC-14518","date":"2026-07-12","year":2026,"title":"AI Accelerates Quantum Threat to Global Cryptographic Security","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-39be"},{"id":"INC-14519","date":"2026-07-12","year":2026,"title":"Germany Funds AI-Enabled Strike Drones for Ukraine","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-604b"},{"id":"INC-14520","date":"2026-07-12","year":2026,"title":"Testing of AI-Controlled White Traffic Light for Autonomous Vehicles in Rome","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-acad"},{"id":"INC-14521","date":"2026-07-12","year":2026,"title":"Transnational AI-Driven Visa Fraud Network Dismantled in Colombia","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-b017"},{"id":"INC-14522","date":"2026-07-12","year":2026,"title":"Meta Withdraws AI Tool Over Instagram Photo Privacy Backlash","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI03","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-cce0"},{"id":"INC-14523","date":"2026-07-12","year":2026,"title":"AI-Generated Fake Photo of Kusha Kapila and Samay Raina Sparks Misinformation and Harassment","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-12-d764"},{"id":"INC-14524","date":"2026-07-13","year":2026,"title":"AI-Enabled Scams and Privacy Breaches Target World Cup Fans","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-0a77"},{"id":"INC-14525","date":"2026-07-13","year":2026,"title":"AI Companies Scrape Irish Musicians' Songs, Prompting Copyright Motion","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-0ae8"},{"id":"INC-14526","date":"2026-07-13","year":2026,"title":"AI-Driven Trust-Based Cyberattacks Target Indian Financial Sector","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-1bf4"},{"id":"INC-14527","date":"2026-07-13","year":2026,"title":"Economists and Tech Leaders Warn of AI-Driven Economic Disruption and Job Losses","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-339c"},{"id":"INC-14528","date":"2026-07-13","year":2026,"title":"China Detains and Penalizes Individuals for AI-Generated Flood Disaster Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-3f48"},{"id":"INC-14529","date":"2026-07-13","year":2026,"title":"EU Report Warns of AI-Driven Online Harms to Children","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-42be"},{"id":"INC-14530","date":"2026-07-13","year":2026,"title":"Labor Unions Oppose Washington, D.C. Robotaxi Legislation Over Job Loss Fears","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-4a34"},{"id":"INC-14531","date":"2026-07-13","year":2026,"title":"WHO Warns of AI Risks in Healthcare Amid Regulatory Gaps in Europe","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-6d8f"},{"id":"INC-14532","date":"2026-07-13","year":2026,"title":"Helsing Raises $1.8 Billion to Expand AI-Powered Autonomous Military Systems","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-73a5"},{"id":"INC-14533","date":"2026-07-13","year":2026,"title":"Georgia Residents Displaced for AI Data Center Power Needs","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-7bf5"},{"id":"INC-14534","date":"2026-07-13","year":2026,"title":"YouTube's AI Algorithm Continues to Recommend Harmful Eating Disorder Content to Teens","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-7f43"},{"id":"INC-14535","date":"2026-07-13","year":2026,"title":"AI Chatbots Used by Terrorist Groups to Plan Attacks and Manufacture Weapons","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM07"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-93df"},{"id":"INC-14536","date":"2026-07-13","year":2026,"title":"AI-Driven Scams Lead to Financial Losses and Safety Risks","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-9653"},{"id":"INC-14537","date":"2026-07-13","year":2026,"title":"AI Replacement Leads to Unlawful Termination in Hangzhou","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-a795"},{"id":"INC-14538","date":"2026-07-13","year":2026,"title":"xAI Grok Build AI Tool Uploaded Entire Private Repositories and Secrets to Cloud Storage","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-acb3"},{"id":"INC-14539","date":"2026-07-13","year":2026,"title":"Mark Cuban Warns of AI-Driven Adversarial Arms Race in US Healthcare","severity":"Medium","attack_vector":"adversarial-input","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-b0aa"},{"id":"INC-14540","date":"2026-07-13","year":2026,"title":"Google Sued by Publishers for Using Copyrighted Works to Train Gemini AI","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-b24c"},{"id":"INC-14541","date":"2026-07-13","year":2026,"title":"Helsing to Manufacture AI-Enabled Military Drones in West Virginia","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-b27d"},{"id":"INC-14542","date":"2026-07-13","year":2026,"title":"AI-Generated Deepfake Ads Exploit Fernanda Montenegro's Image in Fraudulent Medication Scam","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-ba59"},{"id":"INC-14543","date":"2026-07-13","year":2026,"title":"AI-Enabled Drone and Rafale Jet Demonstrate Collaborative Electronic Warfare Strike","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-bcb5"},{"id":"INC-14544","date":"2026-07-13","year":2026,"title":"New York Hospital Replaces Nurses with AI, Sparking Labor and Patient Care Concerns","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-be7f"},{"id":"INC-14545","date":"2026-07-13","year":2026,"title":"Ukraine Deploys AI-Enabled Robotic Assault on Kinburn Spit","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-c73a"},{"id":"INC-14546","date":"2026-07-13","year":2026,"title":"Facial Recognition in California Grocery Stores Sparks Privacy Concerns","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-dbe9"},{"id":"INC-14547","date":"2026-07-13","year":2026,"title":"San Francisco Police Drone Footage Leak Exposes AI-Driven Surveillance and Privacy Breach","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-e147"},{"id":"INC-14548","date":"2026-07-13","year":2026,"title":"Expert Skepticism Over SpaceX's Orbital AI Data Center Plans","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-e228"},{"id":"INC-14549","date":"2026-07-13","year":2026,"title":"Iranian Agency Publishes AI-Generated Video Depicting Trump Being Shot","severity":"Medium","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-e269"},{"id":"INC-14550","date":"2026-07-13","year":2026,"title":"Canadian Regulator Warns Banks of AI-Driven Cyber Threats and Phishing Attacks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-e94d"},{"id":"INC-14551","date":"2026-07-13","year":2026,"title":"EU Sanctions Russian Firms for AI-Enabled Mass Surveillance and Human Rights Violations","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-13-fdd9"},{"id":"INC-14904","date":"2026-07-14","year":2026,"title":"South Korea Launches AI Defense Robot Innovation Cluster in Nonsan","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-14cf"},{"id":"INC-14552","date":"2026-07-14","year":2026,"title":"AI-Generated Video by Chinese State Media Sparks Diplomatic Outrage in Philippines","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"ai-harm","quality_tier":"reviewed","tier":"landmark","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-30f1"},{"id":"INC-14553","date":"2026-07-14","year":2026,"title":"Experts Warn of Developmental Risks from AI Companions for Children","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-38ea"},{"id":"INC-14554","date":"2026-07-14","year":2026,"title":"AI-Generated Fake Evidence Causes Actor Kim Soo-hyun's Career Disruption and Legal Action in South Korea","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-3a43"},{"id":"INC-14555","date":"2026-07-14","year":2026,"title":"AI-Enabled Smart Glasses Used for Exam Cheating in South Korea and China","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-3a6a"},{"id":"INC-14556","date":"2026-07-14","year":2026,"title":"14-Year-Old Investigated for Creating and Sharing AI-Generated Pornographic Deepfakes of Classmates","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-3ca2"},{"id":"INC-14557","date":"2026-07-14","year":2026,"title":"Big Tech's AI Failures Enable Online Child Sexual Abuse and Sextortion in Australia","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-488f"},{"id":"INC-14558","date":"2026-07-14","year":2026,"title":"AI Systems Now Orchestrate Live Cyberattacks, Causing Real-World Harm","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-4beb"},{"id":"INC-14559","date":"2026-07-14","year":2026,"title":"xAI's Grok AI Faces Legal Action and Privacy Scandal Over Harmful Content and Unauthorized Data Uploads","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07","LLM10"],"owasp_asi":["ASI02","ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-55af"},{"id":"INC-14560","date":"2026-07-14","year":2026,"title":"Research Finds LLMs Exhibit Western Moral Bias, Overlooking Global Values","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-568d"},{"id":"INC-14561","date":"2026-07-14","year":2026,"title":"Meta's AI Smart Glasses Spark Privacy Backlash and Reports of Harm","severity":"Medium","attack_vector":"privacy-violation","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-5b31"},{"id":"INC-14562","date":"2026-07-14","year":2026,"title":"US Autonomous Vehicle Mishaps Prompt Regulatory Action","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-657f"},{"id":"INC-14563","date":"2026-07-14","year":2026,"title":"NestAI Develops Sovereign Battlefield AI for European Defense","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-669c"},{"id":"INC-14564","date":"2026-07-14","year":2026,"title":"AI-Generated Works Disqualified from Chinese Art Competitions","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-67aa"},{"id":"INC-14565","date":"2026-07-14","year":2026,"title":"YouTube and X Drive Millions to AI Nudify Apps, Enabling Deepfake Abuse","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-a0d6"},{"id":"INC-14566","date":"2026-07-14","year":2026,"title":"Tesla FSD Approved in Flanders Despite Safety Warnings and Incident","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-ab14"},{"id":"INC-14567","date":"2026-07-14","year":2026,"title":"Sleeping Robotaxi Passengers Trigger Emergency Responses and Strain First Responders","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-c281"},{"id":"INC-14568","date":"2026-07-14","year":2026,"title":"South Carolina Police Officers Fired for Misuse of AI License Plate Readers","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-ca0c"},{"id":"INC-14569","date":"2026-07-14","year":2026,"title":"Actress Anna Rajan Victim of AI-Generated Obscene Image Harassment","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-cb3c"},{"id":"INC-14570","date":"2026-07-14","year":2026,"title":"AI-Generated Photo Wins Photography Prize, Award Revoked in Hohhot","severity":"High","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-d0f6"},{"id":"INC-14571","date":"2026-07-14","year":2026,"title":"Critical Vulnerability in Cursor AI Code Editor Enables Automatic Code Execution","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-d911"},{"id":"INC-14572","date":"2026-07-14","year":2026,"title":"Brazilian Ministry Identifies 32 AI Sites Creating Fake Nude Images","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-ec17"},{"id":"INC-14573","date":"2026-07-14","year":2026,"title":"US Navy Approves Strategy to Weaponize AI and Data","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-ec7d"},{"id":"INC-14574","date":"2026-07-14","year":2026,"title":"German Regulator Holds Google and Perplexity AI Liable for Misinformation","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-14-ee46"},{"id":"INC-14575","date":"2026-07-15","year":2026,"title":"Google Search AI Features Pose Harm to Children, Report Finds","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-0d40"},{"id":"INC-14905","date":"2026-07-15","year":2026,"title":"AI-Driven Fraud and Phishing Attacks Surge Globally","severity":"Medium","attack_vector":"phishing","owasp_llm":[],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-1dd5"},{"id":"INC-14576","date":"2026-07-15","year":2026,"title":"AI-Generated Fake Intimate Images of Minors Investigated in Brazil","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-288f"},{"id":"INC-14577","date":"2026-07-15","year":2026,"title":"AI-Driven Fraud Schemes Target Victims in Germany","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM02","LLM07"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-2925"},{"id":"INC-14578","date":"2026-07-15","year":2026,"title":"Spanish Lawyer Fined for Submitting AI-Generated Legal Document with Fabricated Citations","severity":"High","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-4e6f"},{"id":"INC-14579","date":"2026-07-15","year":2026,"title":"AI-Generated Fake Article Causes Reputational Harm to Greek TV Host","severity":"Medium","attack_vector":"misinformation","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-5089"},{"id":"INC-14580","date":"2026-07-15","year":2026,"title":"Palm Beach County Rejects AI Data Center Amid Community Backlash","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-5e87"},{"id":"INC-14581","date":"2026-07-15","year":2026,"title":"US Air Force Tests AI-Enabled Drone in Live Missile Launch","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-85ea"},{"id":"INC-14582","date":"2026-07-15","year":2026,"title":"xAI Sues User for Creating Child Sexual Abuse Deepfakes with Grok AI","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-91fd"},{"id":"INC-14583","date":"2026-07-15","year":2026,"title":"AI-Assisted TuxBot v3 IoT Botnet Actively Exploits Devices for DDoS Attacks","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM06"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-98ee"},{"id":"INC-14584","date":"2026-07-15","year":2026,"title":"Survey Highlights Road Safety Risks from Misuse of AI Driver-Assistance Systems","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-a954"},{"id":"INC-14585","date":"2026-07-15","year":2026,"title":"AI-Powered Ukrainian Drones Cause High Russian Casualties on Battlefield","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":["ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-aad8"},{"id":"INC-14586","date":"2026-07-15","year":2026,"title":"Taiwan Government Agencies Exposed to Security Risks from Chinese AI Biometric Devices","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-ad7a"},{"id":"INC-14587","date":"2026-07-15","year":2026,"title":"AI-Induced Deskilling in Medical and Knowledge Work","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-b388"},{"id":"INC-14588","date":"2026-07-15","year":2026,"title":"Concerns Over Generative AI's Impact on Human Cognitive Skills","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-b483"},{"id":"INC-14589","date":"2026-07-15","year":2026,"title":"Romanian Border Police Warns of AI-Generated Fake Accounts Impersonating Institution","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-bbe3"},{"id":"INC-14590","date":"2026-07-15","year":2026,"title":"Google DeepMind Researcher Resigns Over Unrestricted Pentagon AI Deal","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI10"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-c037"},{"id":"INC-14591","date":"2026-07-15","year":2026,"title":"JP Morgan CEO Warns of AI Model Mythos Posing Major Cybersecurity Risks","severity":"Critical","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-c4c9"},{"id":"INC-14592","date":"2026-07-15","year":2026,"title":"Trump Claims AI-Generated Images May Fabricate Evidence of Minab School Attack","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-c6e9"},{"id":"INC-14906","date":"2026-07-15","year":2026,"title":"AI-Generated Fake Videos Spark Misinformation, YouTuber Prosecuted in South Korea","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-15-fc03"},{"id":"INC-14593","date":"2026-07-16","year":2026,"title":"UK Regulator Investigates TikTok's AI Systems for Child Safety","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-0e77"},{"id":"INC-14594","date":"2026-07-16","year":2026,"title":"OpenAI Develops Powerful Offensive AI 'GPT-Red' for Security Testing","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI03","ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-1fe6"},{"id":"INC-14595","date":"2026-07-16","year":2026,"title":"Community Protests AI Data Center Over Environmental and Infrastructure Concerns in Michigan","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-25c6"},{"id":"INC-14596","date":"2026-07-16","year":2026,"title":"AI Chatbots Amplify Government Censorship, Restricting Global Free Expression","severity":"High","attack_vector":"rce","owasp_llm":["LLM07","LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-27b9"},{"id":"INC-14597","date":"2026-07-16","year":2026,"title":"AI-Generated Fake Nude Images of 22 Women Lead to Criminal Investigation in Silleda","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-6251"},{"id":"INC-14598","date":"2026-07-16","year":2026,"title":"US Judge Rebukes DOJ for Submitting AI-Generated Fake Legal Citation","severity":"High","attack_vector":"other","owasp_llm":["LLM07"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-bd3d"},{"id":"INC-14599","date":"2026-07-16","year":2026,"title":"Google Search Algorithms Expose UK Children to Illegal Pornography","severity":"High","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05","ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-c35b"},{"id":"INC-14600","date":"2026-07-16","year":2026,"title":"AI-Generated Deepfake Pornography Leads to Arrest in Indonesia","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM07"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://oecd.ai/en/incidents/2026-07-16-e24c"},{"id":"INC-04106","date":"2024","year":2024,"title":"promptfoo plugin: agentic:memory-poisoning","severity":"Medium","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM02","LLM03","LLM07","LLM08","LLM10"],"owasp_asi":["ASI01","ASI02","ASI03","ASI05","ASI06"],"cve_ids":[],"affected":"LLM/agent evaluation surface","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://www.promptfoo.dev/docs/red-team/plugins/agentic/"},{"id":"INC-07730","date":"2024","year":2024,"title":"JailbreakBench: open robustness benchmark for LLM jailbreaking","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"LLM / agent evaluation surface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jailbreakbench.github.io/"},{"id":"INC-07731","date":"2024","year":2024,"title":"HarmBench: standardized evaluation for automated red-teaming","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"LLM / agent evaluation surface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.harmbench.org/"},{"id":"INC-07732","date":"2023","year":2023,"title":"HackAPrompt: global prompt-injection/jailbreak competition dataset","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"LLM / agent evaluation surface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2311.16119"},{"id":"INC-07733","date":"2024","year":2024,"title":"StrongREJECT: high-quality jailbreak evaluation benchmark","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"LLM / agent evaluation surface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2402.10260"},{"id":"INC-07734","date":"2024","year":2024,"title":"SafetyPrompts.com: open catalogue of LLM safety datasets","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"LLM / agent evaluation surface","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://safetyprompts.com/"},{"id":"INC-04216","date":"2024-09","year":2024,"title":"SpAIware: Persistent Memory Spyware Injection into ChatGPT macOS","severity":"Critical","attack_vector":"memory-poisoning","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI06","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT macOS app","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/"},{"id":"INC-03989","date":"2024-08","year":2024,"title":"Microsoft 365 Copilot ASCII Smuggling Data Exfiltration","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"Microsoft 365 Copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/"},{"id":"INC-04371","date":"2024-10","year":2024,"title":"ZombAIs: Claude Computer Use Prompt Injection to C2","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Anthropic Claude Computer Use","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/claude-computer-use-c2-the-zombais-are-coming/"},{"id":"INC-04261","date":"2024-10","year":2024,"title":"Terminal DiLLMa: LLM Apps Hijack Terminals via ANSI Escape Codes","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM10"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"LLM CLI applications (multiple)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/terminal-dillmas-prompt-injection-ansi-sequences/"},{"id":"INC-04194","date":"2024-12","year":2024,"title":"Security ProbLLMs in xAI Grok","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"xAI Grok","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/security-probllms-in-xai-grok/"},{"id":"INC-02602","date":"2025-02","year":2025,"title":"Gemini Memory Persistence via Prompt Injection","severity":"High","attack_vector":"memory-poisoning","owasp_llm":["LLM01"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Google Gemini Advanced","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/"},{"id":"INC-03808","date":"2024-06","year":2024,"title":"GitHub Copilot Chat Prompt Injection to Data Exfiltration","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"GitHub Copilot Chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2024/github-copilot-chat-prompt-injection-data-exfiltration/"},{"id":"INC-02434","date":"2025-08","year":2025,"title":"Claude Code Data Exfiltration via DNS (CVE-2025-55284)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM03"],"owasp_asi":["ASI02","ASI05","ASI09","ASI10"],"cve_ids":[],"affected":"Anthropic Claude Code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/wrapping-up-month-of-ai-bugs/"},{"id":"INC-02299","date":"2025-08","year":2025,"title":"Amazon Q Developer for VS Code Vulnerable to Invisible Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Amazon Q Developer (VS Code)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/amazon-q-developer-interprets-hidden-instructions/"},{"id":"INC-02638","date":"2025-08","year":2025,"title":"Google Jules Vulnerable to Invisible Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Google Jules","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/google-jules-invisible-prompt-injection/"},{"id":"INC-02789","date":"2025-08","year":2025,"title":"Jules Zombie Agent: Prompt Injection to Remote Control","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05","ASI10"],"cve_ids":[],"affected":"Google Jules","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/google-jules-remote-code-execution-zombai/"},{"id":"INC-02302","date":"2025-08","year":2025,"title":"Amp Code Invisible Prompt Injection (Sourcegraph)","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Sourcegraph Amp Code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/amp-code-fixed-invisible-prompt-injection/"},{"id":"INC-02513","date":"2025-08","year":2025,"title":"Devin AI Exposes Ports to the Internet via Prompt Injection","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Cognition Devin","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/devin-ai-kill-chain-exposing-ports/"},{"id":"INC-02456","date":"2025-08","year":2025,"title":"Cline Data Exfiltration via Indirect Prompt Injection","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Cline","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/cline-vulnerable-to-data-exfiltration/"},{"id":"INC-03377","date":"2025-08","year":2025,"title":"Windsurf Memory-Persistent Data Exfiltration (SpAIware)","severity":"Critical","attack_vector":"memory-poisoning","owasp_llm":["LLM01"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Windsurf (Codeium)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/windsurf-spaiware-exploit-persistent-prompt-injection/"},{"id":"INC-02552","date":"2025-08","year":2025,"title":"Exfiltrating ChatGPT Chat History and Memories with Prompt Injection","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2025/chatgpt-chat-history-data-exfiltration/"},{"id":"INC-02397","date":"2025-04","year":2025,"title":"ChatGPT Command Memories Injection via SearchGPT","severity":"High","attack_vector":"memory-poisoning","owasp_llm":["LLM01"],"owasp_asi":["ASI06","ASI07"],"cve_ids":[],"affected":"OpenAI ChatGPT / SearchGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.tenable.com/security/research/tra-2025-11"},{"id":"INC-02608","date":"2025-09","year":2025,"title":"GitHub Copilot Chat Prompt Injection via Filename","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"GitHub Copilot Chat","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.tenable.com/security/research/tra-2025-53"},{"id":"INC-04000","date":"2024-08","year":2024,"title":"Microsoft Copilot Studio SSRF Information Disclosure (CVE-2024-38206)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM03"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Microsoft Copilot Studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.securityweek.com/microsoft-copilot-studio-vulnerability-led-to-information-disclosure/"},{"id":"INC-04358","date":"2024-04","year":2024,"title":"Wiz Hugging Face Cross-Tenant Compromise via Malicious Pickle Model","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.wiz.io/blog/wiz-and-hugging-face-address-risks-to-ai-infrastructure"},{"id":"INC-00570","date":"2026-01","year":2026,"title":"Aim Labs Continuing EchoLeak Research and Variants","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Enterprise Copilots (various)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.aim.security/news"},{"id":"INC-03303","date":"2025-04","year":2025,"title":"Trail of Bits MCP Line Jumping Vulnerability","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM02","LLM04","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":[],"affected":"Model Context Protocol (MCP)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blog.trailofbits.com/categories/machine-learning/"},{"id":"INC-02693","date":"2025-04","year":2025,"title":"HiddenLayer Policy Puppetry Attack Bypasses All Major AI Models","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"ChatGPT, Claude, Gemini, Llama, multiple LLMs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://securityboulevard.com/2025/04/hiddenlayer-researchers-surface-prompt-technique-bypassing-all-ai-guardrails/"},{"id":"INC-02691","date":"2025-10","year":2025,"title":"HiddenLayer Bypass of OpenAI Guardrails (Self-Policing LLM)","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"OpenAI Guardrails","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.hiddenlayer.com/research/same-model-different-hat"},{"id":"INC-02692","date":"2025-06","year":2025,"title":"HiddenLayer Cursor Attack Chain via Hidden Prompt Injections","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Cursor IDE","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.hiddenlayer.com/research/how-hidden-prompt-injections-can-hijack-ai-code-assistants-like-cursor"},{"id":"INC-03868","date":"2024-09","year":2024,"title":"HiddenLayer Gemini for Workspace Indirect Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Google Gemini for Workspace","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://hiddenlayer.com/innovation-hub/new-google-gemini-content-manipulation-vulns-found/"},{"id":"INC-03390","date":"2025-08","year":2025,"title":"Zenity AgentFlayer Zero-Click Exploit Chains Across Enterprise AI Agents","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI01","ASI02","ASI09"],"cve_ids":[],"affected":"ChatGPT, Copilot Studio, Salesforce Einstein, Gemini, M365 Copilot, Cursor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.prnewswire.com/news-releases/zenity-labs-exposes-widespread-agentflayer-vulnerabilities-allowing-silent-hijacking-of-major-enterprise-ai-agents-circumventing-human-oversight-302523580.html"},{"id":"INC-04369","date":"2024-08","year":2024,"title":"Zenity Microsoft 365 Copilot RCE via Email/Teams/Calendar","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Microsoft 365 Copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://labs.zenity.io/p/rce"},{"id":"INC-01641","date":"2026-01","year":2026,"title":"Pillar Cursor Prompt Injection Flaw (CVE-2026-22708)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Cursor IDE","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.pillar.security/blog"},{"id":"INC-01642","date":"2026-01","year":2026,"title":"Pillar n8n Sandbox Escape Vulnerabilities (CVSS 10)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"n8n Workflow Platform","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.infosecurity-magazine.com/news/critical-zeroclick-flaw-n8n-pillar/"},{"id":"INC-03030","date":"2025-07","year":2025,"title":"Pillar Poisoned GGUF Templates Hugging Face Backdoors","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face GGUF Models","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.globenewswire.com/news-release/2025/07/09/3112541/0/en/Pillar-Security-Uncovers-Novel-Attack-Vector-That-Embeds-Malicious-Backdoors-in-Model-Files-on-Hugging-Face.html"},{"id":"INC-01681","date":"2026-01","year":2026,"title":"PromptArmor IBM Bob Malware Execution via Prompt Injection","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"IBM Bob","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.theregister.com/2026/01/07/ibm_bob_vulnerability/"},{"id":"INC-02332","date":"2025-10","year":2025,"title":"AppOmni BodySnatcher ServiceNow AI Agent Privilege Escalation","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"ServiceNow AI Agent","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.darkreading.com/remote-workforce/ai-vulnerability-servicenow"},{"id":"INC-00643","date":"2026-02","year":2026,"title":"AppOmni Critical AI Agent Flaws in Microsoft Copilot Studio","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI03"],"cve_ids":[],"affected":"Microsoft Copilot Studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://winbuzzer.com/2026/02/04/critical-ai-agent-flaws-exposed-in-microsoft-and-servicenow-xcxwbn/"},{"id":"INC-04255","date":"2024-05","year":2024,"title":"Sysdig LLMjacking: Stolen Cloud Credentials Hijack LLMs","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM06"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"AWS Bedrock, Anthropic Claude (via stolen creds)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2024/05/researchers-uncover-llmjacking-scheme.html"},{"id":"INC-03248","date":"2025-11","year":2025,"title":"Sysdig AI-Accelerated Cloud Attack: Admin Privileges in 10 Minutes","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"AWS (LLM-powered attacker tooling)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.sysdig.com/threat-research"},{"id":"INC-04068","date":"2024-10","year":2024,"title":"OpenAI October 2024 Influence and Cyber Operations Update","severity":"High","attack_vector":"other","owasp_llm":["LLM06","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cdn.openai.com/threat-intelligence-reports/influence-and-cyber-operations-an-update_October-2024.pdf"},{"id":"INC-03003","date":"2025-06","year":2025,"title":"OpenAI June 2025 Disrupting Malicious Uses Report","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf"},{"id":"INC-03006","date":"2025-10","year":2025,"title":"OpenAI October 2025 Disrupting Malicious Uses Update","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM06","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://openai.com/global-affairs/disrupting-malicious-uses-of-ai-october-2025/"},{"id":"INC-02637","date":"2025-11","year":2025,"title":"Google GTIG November 2025 AI Threat Tracker","severity":"Critical","attack_vector":"other","owasp_llm":["LLM03","LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Google Gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"},{"id":"INC-02900","date":"2025-10","year":2025,"title":"Microsoft Digital Defense Report 2025: AI-Driven Threat Operations","severity":"High","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Multi-vendor (LLM ecosystem)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025"},{"id":"INC-03315","date":"2025-09","year":2025,"title":"Unit 42 Zealot Autonomous Multi-Agent Cloud Attack PoC","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI07"],"cve_ids":[],"affected":"Cloud environments (research PoC)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/"},{"id":"INC-03314","date":"2025-08","year":2025,"title":"Unit 42 AI-Powered Ransomware 25-Minute Compromise","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Generic (research demonstration)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.paloaltonetworks.com/resources/ebooks/unit42-threat-frontier"},{"id":"INC-03212","date":"2025-09","year":2025,"title":"Shai-Hulud npm Worm Used LLM to Generate Malicious Scripts","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM06"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm Ecosystem (Crowdstrike, Postman, Zapier packages)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://unit42.paloaltonetworks.com/"},{"id":"INC-03920","date":"2024-06","year":2024,"title":"JFrog Vanna AI Prompt Injection RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI02","ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"Vanna AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jfrog.com/blog/top-jfrog-security-research-discoveries-of-2024/"},{"id":"INC-02783","date":"2025-04","year":2025,"title":"JFrog Reports 6.5x Increase in Malicious Hugging Face Models","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Hugging Face / Public Model Registries","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://jfrog.com/press-room/jfrog-enables-trusted-ai-uncovers-critical-security-threats-emerging-from-ais-expansion-in-the-software-supply-chain/"},{"id":"INC-03958","date":"2024-10","year":2024,"title":"Lunary IDOR and SAML Access Control (CVE-2024-7474, CVE-2024-7475)","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI03"],"cve_ids":[],"affected":"Lunary","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2024/10/researchers-uncover-vulnerabilities-in.html"},{"id":"INC-04107","date":"2024-10","year":2024,"title":"Protect AI ChuanhuChatGPT, LocalAI Vulnerability Disclosures","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"ChuanhuChatGPT, LocalAI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://protectai.com/threat-research/may-vulnerability-report"},{"id":"INC-03908","date":"2024-05","year":2024,"title":"Intel Neural Compressor Critical CVE-2024-22476","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":["ASI05"],"cve_ids":[],"affected":"Intel Neural Compressor","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.securityweek.com/easily-exploitable-critical-vulnerabilities-found-in-open-source-ai-ml-tools/"},{"id":"INC-04108","date":"2024-04","year":2024,"title":"Protect AI MLflow, Ray, Triton Vulnerability Surge","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"MLflow, Ray, Triton","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://protectai.com/sightline-may-2024"},{"id":"INC-02372","date":"2025-08","year":2025,"title":"Brave Discloses Indirect Prompt Injection in Perplexity Comet","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01","ASI02"],"cve_ids":[],"affected":"Perplexity Comet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://brave.com/blog/comet-prompt-injection/"},{"id":"INC-02373","date":"2025-10","year":2025,"title":"Brave Screenshot-Based Prompt Injection in AI Browsers","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Perplexity Comet (and other AI browsers)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://brave.com/blog/unseeable-prompt-injections/"},{"id":"INC-02820","date":"2025-10","year":2025,"title":"LayerX CometJacking: One-Click Perplexity Comet Compromise","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Perplexity Comet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/"},{"id":"INC-02819","date":"2025-10","year":2025,"title":"LayerX ChatGPT Atlas Tainted Memories Vulnerability","severity":"Critical","attack_vector":"memory-poisoning","owasp_llm":["LLM01"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT Atlas Browser","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://layerxsecurity.com/blog/layerx-identifies-vulnerability-in-new-chatgpt-atlas-browser/"},{"id":"INC-02436","date":"2025-08","year":2025,"title":"Claude Code Unauthorized Command Execution (CVE-2025-54794, CVE-2025-54795)","severity":"High","attack_vector":"rce","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Anthropic Claude Code","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://gbhackers.com/claude-ai-flaws/"},{"id":"INC-01264","date":"2026-01","year":2026,"title":"Jailbroken Claude Code Used to Steal 150GB from Mexican Government","severity":"Critical","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Anthropic Claude Code / OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://securiti.ai/blog/anthropic-exploit-era-of-ai-agent-attacks/"},{"id":"INC-00828","date":"2026-03","year":2026,"title":"Claude Mythos Identifies Thousands of Zero-Day Vulnerabilities","severity":"High","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"OS, browsers (cross-vendor)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anthropic.com/coordinated-vulnerability-disclosure"},{"id":"INC-03328","date":"2025-10","year":2025,"title":"Veracode 2025 GenAI Code Security Report: 45% Fail Rate","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Multi-vendor LLMs (code generation)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/"},{"id":"INC-02543","date":"2025-11","year":2025,"title":"Endor Labs MCP Server Supply Chain Risk Analysis","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"MCP Server Ecosystem","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.endorlabs.com/lp/state-of-dependency-management-2025"},{"id":"INC-02542","date":"2025-11","year":2025,"title":"Endor Labs Documents AI Dependency Hallucination Risk","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"AI Coding Assistants (multiple)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.prnewswire.com/news-releases/endor-labs-launches-2025-state-of-dependency-management-report-finds-80-of-ai-suggested-dependencies-contain-risks-302603438.html"},{"id":"INC-03394","date":"2025-12","year":2025,"title":"ÆSIR AI Discovers 21 Critical CVEs Across NVIDIA, Tencent, MLflow, MCP","severity":"High","attack_vector":"other","owasp_llm":["LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"NVIDIA, Tencent, MLflow, MCP tooling","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.trendmicro.com/en_us/research/26/a/aesir.html"},{"id":"INC-02483","date":"2025-07","year":2025,"title":"Dark Side of LLMs: Agent-Based Attacks for Computer Takeover","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03","LLM04"],"owasp_asi":["ASI02","ASI05","ASI07"],"cve_ids":[],"affected":"GPT-4o, Claude-4, Gemini-2.5","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/html/2507.06850v3"},{"id":"INC-02459","date":"2025-02","year":2025,"title":"Commercial LLM Agents Vulnerable to Simple Yet Dangerous Attacks","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Commercial LLM agent platforms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/abs/2502.08586"},{"id":"INC-02770","date":"2025-08","year":2025,"title":"Involuntary Jailbreak: Self-Prompting Attack on Grok 4, DeepSeek R1","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"xAI Grok 4, DeepSeek R1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/html/2508.13246v3"},{"id":"INC-03306","date":"2025-03","year":2025,"title":"Trend Micro Exploits DeepSeek-R1 Chain of Thought","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"DeepSeek R1","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.trendmicro.com/en_us/research/25/c/exploiting-deepseek-r1.html"},{"id":"INC-02955","date":"2025-10","year":2025,"title":"Noma Security Agentic Risk Map Disclosure: ForcedLeak and GeminiJack","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI08"],"cve_ids":[],"affected":"Enterprise AI Agents (various)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.prnewswire.com/news-releases/noma-security-launches-industry-first-agentic-risk-map-as-part-of-comprehensive-ai-agent-security-solution-302590849.html"},{"id":"INC-00735","date":"2026-01","year":2026,"title":"Cato CTRL 2026 Threat Report: AI Threats Mainstreaming","severity":"High","attack_vector":"jailbreak","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Multi-vendor (LLM ecosystem)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.catonetworks.com/resources/2026-cato-ctrl-threat-report/"},{"id":"INC-02855","date":"2025-04","year":2025,"title":"Mandiant M-Trends 2025: AI Adoption by Threat Actors","severity":"High","attack_vector":"malware","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Multi-vendor (LLM ecosystem)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025"},{"id":"INC-01438","date":"2026-05","year":2026,"title":"Microsoft RCE Vulnerabilities Across AI Agent Frameworks","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"AI Agent Frameworks (multiple)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/"},{"id":"INC-01600","date":"2026-02","year":2026,"title":"OpenClaw Open-Source AI Agent Mass Compromise","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM01","LLM03","LLM04","LLM10"],"owasp_asi":["ASI02","ASI04","ASI05","ASI10"],"cve_ids":[],"affected":"OpenClaw","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.reco.ai/newsroom"},{"id":"INC-02795","date":"2025-12","year":2025,"title":"Koi AI Discovers Cursor/Windsurf/Antigravity Recommend Malware","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Cursor, Windsurf, Antigravity","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.koi.ai/blog/how-we-prevented-cursor-windsurf-google-antigravity-from-recommending-malware"},{"id":"INC-03216","date":"2025-05","year":2025,"title":"Snyk Agent Fix and AI Agent Security Findings","severity":"High","attack_vector":"supply-chain","owasp_llm":["LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"AI Code Generation (LLM-based)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://snyk.io/blog/introducing-the-snyk-ai-trust-platform/"},{"id":"INC-02796","date":"2025-12","year":2025,"title":"Lakera Q4 2025 Agent Trends: Indirect Attacks Succeed Faster","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Multi-vendor agents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.lakera.ai/ai-security-guides/q4-2025-ai-agent-security-trends"},{"id":"INC-03933","date":"2024-09","year":2024,"title":"Lakera Copy-Paste Injection Exploit in ChatGPT","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.lakera.ai/blog/indirect-prompt-injection"},{"id":"INC-03693","date":"2024-02","year":2024,"title":"Custom GPT System Prompt Leakage Wave","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02","LLM08"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"OpenAI GPT Store / Custom GPTs","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.lakera.ai/blog/guide-to-prompt-injection"},{"id":"INC-02498","date":"2025-01","year":2025,"title":"DeepSeek AI Account Takeover Disclosed by Rehberger","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM01","LLM02","LLM10"],"owasp_asi":["ASI03","ASI09"],"cve_ids":[],"affected":"DeepSeek AI","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/"},{"id":"INC-02460","date":"2025-11","year":2025,"title":"CoPhish: Copilot Studio Phishing Platform Abuse","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Microsoft Copilot Studio","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.blackfog.com/cophish-turning-copilot-into-a-phishing-platform/"},{"id":"INC-00857","date":"2026-08","year":2026,"title":"Copirate 365 DEF CON: Plundering Microsoft Copilot (CVE-2026-24299)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM01","LLM02"],"owasp_asi":["ASI02","ASI09"],"cve_ids":[],"affected":"Microsoft 365 Copilot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://embracethered.com/blog/posts/2026/defcon-talk-copirate-365/"},{"id":"INC-02679","date":"2025-01","year":2025,"title":"GTIG Adversarial Misuse of Generative AI - January 2025","severity":"High","attack_vector":"other","owasp_llm":["LLM06"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"Google Gemini","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://thehackernews.com/2025/01/google-over-57-nation-state-threat.html"},{"id":"INC-02181","date":"2025-10","year":2025,"title":"ActiveFence Perplexity Comet Markdown/HTML Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI01"],"cve_ids":[],"affected":"Perplexity Comet","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.activefence.com/blog/ai-browser-perplexity-prompt-injection-phishing/"},{"id":"INC-04103","date":"2024-11","year":2024,"title":"Prompt Security Analysis: Claude Computer Use Ticking Time Bomb","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM03"],"owasp_asi":["ASI02","ASI05"],"cve_ids":[],"affected":"Anthropic Claude Computer Use","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://prompt.security/blog/claude-computer-use-a-ticking-time-bomb"},{"id":"INC-03297","date":"2025-11","year":2025,"title":"Third-Party AI Chatbot Plugin Prompt Injection Risks","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":["ASI02","ASI04"],"cve_ids":[],"affected":"Third-party Chatbot Plugins (multiple)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://arxiv.org/html/2511.05797v1"},{"id":"INC-04066","date":"2024-02","year":2024,"title":"OpenAI February 2024 Disrupting State-Affiliated Threat Actors","severity":"High","attack_vector":"phishing","owasp_llm":["LLM03","LLM06","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"},{"id":"INC-02954","date":"2025-10","year":2025,"title":"Noma Customer Support Agent Cascade Attack Pattern","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03"],"owasp_asi":["ASI02","ASI08"],"cve_ids":[],"affected":"Enterprise Customer Support Agents (various)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://noma.security/solutions/ai-agent-security/"},{"id":"INC-02326","date":"2025-07","year":2025,"title":"Anvilogic 2025 AI Risk Report: Model & Supply Chain Threats","severity":"High","attack_vector":"model-theft","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"AI/ML Ecosystem (broad)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anvilogic.com/threat-reports/2025-ai-risk-report"},{"id":"INC-02794","date":"2025-09","year":2025,"title":"Knostic Shadow AI Enterprise Leak Findings","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Enterprise GenAI usage (broad)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.knostic.ai/blog/shadow-ai"},{"id":"INC-02432","date":"2025-06","year":2025,"title":"Cisco Study: 46% of Orgs Report Internal GenAI Data Leaks","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02"],"owasp_asi":["ASI09"],"cve_ids":[],"affected":"Enterprise GenAI usage","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.knostic.ai/blog/gen-ai-security-statistics"},{"id":"INC-03253","date":"2025-05","year":2025,"title":"Tenable AI Aware Identifies AI/LLM Security Risks","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"Enterprise LLM deployments","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cybersecurityasia.net/tenable-ai-aware-enhance-llm-ai-security/"},{"id":"INC-04218","date":"2024-05","year":2024,"title":"Spamouflage / Dragonbridge (China) — ChatGPT for pro-PRC social media astroturfing","severity":"Medium","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; X, Medium, Blogspot","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://openai.com/index/disrupting-deceptive-uses-of-AI-by-covert-influence-operations/"},{"id":"INC-04230","date":"2024-05","year":2024,"title":"STOIC \"Zero Zeno\" (Israel) — political campaign firm used ChatGPT for India/Gaza influence","severity":"Medium","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; X, Facebook, Instagram audiences in US, Canada, India","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.darkreading.com/threat-intelligence/openai-disrupts-5-ai-powered-state-backed-influence-ops"},{"id":"INC-03694","date":"2024-10","year":2024,"title":"CyberAv3ngers (Iran IRGC) — used ChatGPT to research ICS attacks on water utilities","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"OpenAI ChatGPT; targets — water, energy, ICS","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.securityweek.com/openai-says-iranian-hackers-used-chatgpt-to-plan-ics-attacks/"},{"id":"INC-04231","date":"2024-10","year":2024,"title":"STORM-0817 (Iran) — used ChatGPT to debug Android surveillanceware","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI02"],"cve_ids":[],"affected":"OpenAI ChatGPT; Android targets (Iranian dissidents, Pakistani officials)","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.scworld.com/news/openai-reveals-chatgpt-use-by-cyberav3ngers-android-malware-developers"},{"id":"INC-04233","date":"2024-08","year":2024,"title":"STORM-2035 (Iran) — ChatGPT used to seed AI-news sites Nio Thinker / Savannah Time targeting US election","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; US voters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blogs.microsoft.com/on-the-issues/2024/10/23/as-the-u-s-election-nears-russia-iran-and-china-step-up-influence-efforts/"},{"id":"INC-04232","date":"2024-01","year":2024,"title":"Storm-1376 / Spamouflage — AI-generated fake audio of Terry Gou during 2024 Taiwan election","severity":"High","attack_vector":"adversarial-input","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Taiwan electorate; YouTube","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blogs.microsoft.com/on-the-issues/2024/04/04/china-ai-influence-elections-mtac-cybersecurity/"},{"id":"INC-03682","date":"2024-05","year":2024,"title":"CopyCop (Russia) — LLM-weaponized inauthentic-news network across US/UK/France","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Multiple LLMs; US, UK, France readers","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.recordedfuture.com/research/russia-linked-copycop-uses-llms-to-weaponize-influence-content-at-scale"},{"id":"INC-02320","date":"2025-04","year":2025,"title":"Anthropic March 2025 — \"Influence-as-a-Service\" multi-persona operation","severity":"High","attack_vector":"agent-hijack","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI06","ASI07"],"cve_ids":[],"affected":"Claude; X, Facebook, TikTok","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025"},{"id":"INC-02999","date":"2025-02","year":2025,"title":"OpenAI Feb 2025 — \"Peer Review\" Chinese surveillance social-media monitoring tool","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; Western social-media users","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cdn.openai.com/threat-intelligence-reports/disrupting-malicious-uses-of-our-models-february-2025-update.pdf"},{"id":"INC-03000","date":"2025-02","year":2025,"title":"OpenAI Feb 2025 — DPRK IT-worker accounts using ChatGPT for fake resumes and remote-work tasks","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; Western tech firms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.darkreading.com/threat-intelligence/openai-bans-chatgpt-accounts-nation-state-threat-actors"},{"id":"INC-03002","date":"2025-06","year":2025,"title":"OpenAI Jun 2025 — \"Sneer Review\" Chinese cross-platform astroturfing against Taiwanese game","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; TikTok, X, Reddit, Facebook","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://openai.com/global-affairs/disrupting-malicious-uses-of-ai-june-2025/"},{"id":"INC-03005","date":"2025-10","year":2025,"title":"OpenAI Oct 2025 — Accounts linked to PRC entities sought social-media surveillance proposals","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"OpenAI ChatGPT; overseas dissidents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.axios.com/2025/10/07/openai-threat-report-china-russia-ai-models"},{"id":"INC-02680","date":"2025-01","year":2025,"title":"GTIG — Iranian APT42 used Gemini extensively across attack lifecycle","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Google Gemini; Western think-tanks, journalists, defense","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai"},{"id":"INC-02461","date":"2025-08","year":2025,"title":"CrowdStrike — FAMOUS CHOLLIMA infiltrated 320+ companies via GenAI-assisted hiring fraud","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM05","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"Multiple GenAI tools; US tech, defense, aerospace, retail firms","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-threat-hunting-report-ai-weapon-target/"},{"id":"INC-03573","date":"2024-08","year":2024,"title":"Anthropic — Frontier Threats Red Team: spear-phishing scaling study","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Claude; corporate executives","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.anthropic.com/research"},{"id":"INC-02854","date":"2025-04","year":2025,"title":"Mandiant M-Trends 2025 — AI used by financially-motivated and state-sponsored actors","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM03","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"GenAI tools; varied industry verticals","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cloud.google.com/security/resources/m-trends"},{"id":"INC-04003","date":"2024-08","year":2024,"title":"Microsoft MTAC — Mint Sandstorm spear-phished Trump campaign with AI-drafted lures","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"US political campaign staff","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/5bc57431-a7a9-49ad-944d-b93b7d35d0fc.pdf"},{"id":"INC-04146","date":"2024-09","year":2024,"title":"Recorded Future — Doppelganger continued AI-amplified Trump/Biden disinformation","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"LLMs; US voters","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.recordedfuture.com/research/copycop-deepens-its-playbook"},{"id":"INC-04147","date":"2024-06","year":2024,"title":"Recorded Future — Russian/Iranian AI influence networks targeted 2024 French elections","severity":"High","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"LLMs; French electorate","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.recordedfuture.com/research/russian-and-iranian-influence-networks-target-french-elections"},{"id":"INC-04006","date":"2024-08","year":2024,"title":"Microsoft — Peach Sandstorm (Iran) deployed Tickler malware with AI-assisted social engineering","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"US satellite, government, defense, education sectors","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations/"},{"id":"INC-02902","date":"2025-02","year":2025,"title":"Microsoft — Storm-2139 hijacked Azure OpenAI accounts and sold jailbroken access","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM02","LLM10"],"owasp_asi":["ASI02","ASI06"],"cve_ids":[],"affected":"Microsoft Azure OpenAI Service","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/"},{"id":"INC-03827","date":"2024-08","year":2024,"title":"Google TAG — APT42 spear-phishing US/Israel officials with AI-assisted lures","severity":"Critical","attack_vector":"tool-abuse","owasp_llm":["LLM10"],"owasp_asi":["ASI06"],"cve_ids":[],"affected":"Gmail; senior US/Israeli officials","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://blog.google/threat-analysis-group/iran-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"id":"INC-14911","date":"2025-10","year":2025,"title":"Fine-Tuning Jailbreaks under Highly Constrained Black-Box Settings: A Three-Pronged Approach","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4, gpt-4o, openai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.01342"},{"id":"INC-14912","date":"2025-10","year":2025,"title":"VortexPIA: Indirect Prompt Injection Attack against LLMs for Efficient Extraction of User Privacy","severity":"Medium","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.04261"},{"id":"INC-14913","date":"2025-10","year":2025,"title":"MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.10271"},{"id":"INC-14914","date":"2025-10","year":2025,"title":"ArtPerception: ASCII Art-based Jailbreak on LLMs with Recognition Pre-test","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o, claude, deepseek-v3, llama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.10281"},{"id":"INC-14915","date":"2025-10","year":2025,"title":"PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o, gemini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.17277"},{"id":"INC-14916","date":"2025-10","year":2025,"title":"BreakFun: Jailbreaking LLMs via Object Instantiation under Simulated Code Execution","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.17904"},{"id":"INC-14917","date":"2025-10","year":2025,"title":"The Trojan Example: Jailbreaking LLMs through Template Filling and Unsafety Reasoning","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o, deepseek-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.21190"},{"id":"INC-14918","date":"2025-10","year":2025,"title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2510.22963"},{"id":"INC-14919","date":"2025-11","year":2025,"title":"AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"llama-3, gpt-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.02376"},{"id":"INC-14920","date":"2025-11","year":2025,"title":"When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.05797"},{"id":"INC-14921","date":"2025-11","year":2025,"title":"LoopLLM: Transferable Energy-Latency Attacks in LLMs via Repetitive Generation","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"deepseek-v3, gemini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.07876"},{"id":"INC-14922","date":"2025-11","year":2025,"title":"Multi-Faceted Attack: Exposing Cross-Model Vulnerabilities in Defense-Equipped Vision-Language Models","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o, llama-4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.16110"},{"id":"INC-14923","date":"2025-11","year":2025,"title":"AutoBackdoor: Automating Backdoor Attacks via LLM Agents","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"llama-3, mistral, qwen, gpt-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.16709"},{"id":"INC-14924","date":"2025-11","year":2025,"title":"CAHS-Attack: CLIP-Aware Heuristic Search Attack Method for Stable Diffusion","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"stable diffusion","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2511.21180"},{"id":"INC-14925","date":"2026-01","year":2026,"title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2601.09625"},{"id":"INC-14926","date":"2026-01","year":2026,"title":"TrojanPraise: Jailbreak LLMs via Benign Fine-Tuning","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2601.12460"},{"id":"INC-14927","date":"2026-02","year":2026,"title":"Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2602.04653"},{"id":"INC-14928","date":"2026-02","year":2026,"title":"BadTemplate: A Training-Free Backdoor Attack via Chat Template Against Large Language Models","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2602.05401"},{"id":"INC-14929","date":"2026-02","year":2026,"title":"Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"claude","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2602.19450"},{"id":"INC-14930","date":"2026-02","year":2026,"title":"Analysis of LLMs Against Prompt Injection and Jailbreak Attacks","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"mistral, deepseek-r1, llama, qwen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2602.22242"},{"id":"INC-14931","date":"2026-03","year":2026,"title":"Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o, claude","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.09246"},{"id":"INC-14932","date":"2026-03","year":2026,"title":"Accelerating Suffix Jailbreak attacks with Prefix-Shared KV-cache","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.13420"},{"id":"INC-14933","date":"2026-03","year":2026,"title":"Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.13847"},{"id":"INC-14934","date":"2026-03","year":2026,"title":"Hidden Ads: Behavior Triggered Semantic Backdoors for Advertisement Injection in Vision Language Models","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.27522"},{"id":"INC-14935","date":"2026-03","year":2026,"title":"Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Five Production LLMs","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"claude, deepseek","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2603.28013"},{"id":"INC-14936","date":"2026-04","year":2026,"title":"Adjustable Text-Guided Backdoor Attacks with Natural-Word Triggers on Multimodal Pretrained Models","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM05"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.05809"},{"id":"INC-14937","date":"2026-04","year":2026,"title":"TEMPLATEFUZZ: Fine-Grained Chat Template Fuzzing for Jailbreaking and Red Teaming LLMs","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.12232"},{"id":"INC-14938","date":"2026-04","year":2026,"title":"LogJack: Indirect Prompt Injection Through Cloud Logs Against LLM Debugging Agents","severity":"Medium","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"claude, llama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.15368"},{"id":"INC-14939","date":"2026-04","year":2026,"title":"Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.21829"},{"id":"INC-14940","date":"2026-04","year":2026,"title":"Spore: Efficient and Training-Free Privacy Extraction Attack on LLMs via Inference-Time Hybrid Probing","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.23711"},{"id":"INC-14941","date":"2026-04","year":2026,"title":"FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2604.28157"},{"id":"INC-14942","date":"2026-05","year":2026,"title":"Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"claude, gemini, qwen, cursor, anthropic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2605.11229"},{"id":"INC-14943","date":"2026-05","year":2026,"title":"Exploiting LLM Agent Supply Chains via Payload-less Skills","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2605.14460"},{"id":"INC-14944","date":"2026-05","year":2026,"title":"Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2605.17971"},{"id":"INC-14945","date":"2026-05","year":2026,"title":"An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2605.18133"},{"id":"INC-14946","date":"2026-05","year":2026,"title":"Automatically Attacking Software Reverse Engineering AI Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2605.30667"},{"id":"INC-14947","date":"2026-06","year":2026,"title":"Steering LLM Viewpoints through Fabricated Evidence Injection","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"gpt-5","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2606.06244"},{"id":"INC-14948","date":"2026-06","year":2026,"title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2606.10742"},{"id":"INC-14949","date":"2026-06","year":2026,"title":"GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2606.15788"},{"id":"INC-14950","date":"2026-06","year":2026,"title":"OTTER: A Red-Teaming System for Toxicity-Evading Jailbreak Prompt Optimization","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2606.21077"},{"id":"INC-14951","date":"2026-07","year":2026,"title":"Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.00481"},{"id":"INC-14952","date":"2026-07","year":2026,"title":"Overloading Large Vision-Language Models for Jailbreaking","severity":"Medium","attack_vector":"jailbreak","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.02961"},{"id":"INC-14953","date":"2026-07","year":2026,"title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"claude, gemini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.05120"},{"id":"INC-14954","date":"2026-07","year":2026,"title":"Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.07433"},{"id":"INC-14955","date":"2026-07","year":2026,"title":"Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.15657"},{"id":"INC-14956","date":"2026-07","year":2026,"title":"They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.19267"},{"id":"INC-14957","date":"2026-07","year":2026,"title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.23444"},{"id":"INC-14958","date":"2026-07","year":2026,"title":"From Role Prompt to Infinite Thinking: Exploiting Persona Conditioning for Inference Cost Attacks in LLMs","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2607.25936"},{"id":"INC-14959","date":"2026-08","year":2026,"title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","severity":"Medium","attack_vector":"indirect-prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2608.04741"},{"id":"INC-14960","date":"2026-08","year":2026,"title":"InjecMEM: Memory Injection Attack on LLM Agent Memory Systems","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2608.23471"},{"id":"INC-14961","date":"2026-09","year":2026,"title":"What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"claude","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2609.01222"},{"id":"INC-14962","date":"2026-09","year":2026,"title":"Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"gpt-5, openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2609.04533"},{"id":"INC-14963","date":"2026-09","year":2026,"title":"Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"anthropic, openai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2609.09553"},{"id":"INC-14964","date":"2026-09","year":2026,"title":"Trust the Brand, Lose Control: How Identity Hijacks LLM Agent Orchestration","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"openclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2609.32635"},{"id":"INC-14965","date":"2026-09","year":2026,"title":"CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://arxiv.org/abs/2609.39902"},{"id":"INC-14966","date":"2025-03","year":2025,"title":"Incorrect Authorization in mintplex-labs/anything-llm (CVE-2024-10109)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10109"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0002/"},{"id":"INC-14967","date":"2025-03","year":2025,"title":"Improper Privilege Management in lunary-ai/lunary (CVE-2024-10273)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10273"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0003/"},{"id":"INC-14968","date":"2025-03","year":2025,"title":"Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt (CVE-2024-10829)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10829"],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0009/"},{"id":"INC-14969","date":"2025-03","year":2025,"title":"Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt (CVE-2024-10831)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10831"],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0011/"},{"id":"INC-14970","date":"2025-03","year":2025,"title":"Improper Enforcement of Unique Constraint in lunary-ai/lunary (CVE-2024-11301)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11301"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0022/"},{"id":"INC-14971","date":"2025-03","year":2025,"title":"Improper Access Control in lunary-ai/lunary (CVE-2024-8999)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-8999"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0032/"},{"id":"INC-14972","date":"2025-03","year":2025,"title":"Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary (CVE-2024-9000)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9000"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0033/"},{"id":"INC-14973","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Incremental Table Completion\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, DeepSeek DeepSeek R1, Meta LLaMa 3.3, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0061/"},{"id":"INC-14974","date":"2026-02","year":2026,"title":"Multiple Model Prompt Injection via \"Correction\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, Google Gemini 2.5 Flash","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0062/"},{"id":"INC-14975","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Chemical Compiler Debug\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Alibaba Qwen Turbo, Cohere Command R, Meta LLaMa 3.3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0063/"},{"id":"INC-14976","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Split Mode\" Response Requests","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek R1, Meta LLaMa 3.3, Mistral Large, Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0064/"},{"id":"INC-14977","date":"2026-01","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Placeholder Injection\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Haiku, Google Gemini 2.0 Flash, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0065/"},{"id":"INC-14978","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Deceptive Forensic Context\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0066/"},{"id":"INC-14979","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Technical Field Guide\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, Anthropic Claude 3.7 Sonnet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0067/"},{"id":"INC-14980","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Hybrid Role\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Alibaba Qwen Turbo, Anthropic Claude 3.5 Haiku, Anthropic Claude 3.7 Sonnet","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0068/"},{"id":"INC-14981","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"API System Instructions\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek V3, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0069/"},{"id":"INC-14982","date":"2026-01","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Haiku of Love\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, DeepSeek DeepSeek V3, Google Gemini 2.0 Flash, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0070/"},{"id":"INC-14983","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Choose Your Own Adventure\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1, DeepSeek DeepSeek V3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0071/"},{"id":"INC-14984","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Chemist Code Language\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Haiku, Anthropic Claude 3.7 Sonnet, Anthropic Claude 4 Sonnet, DeepSeek DeepSeek V3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0072/"},{"id":"INC-14985","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Fashion Design Recipe\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0073/"},{"id":"INC-14986","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Science Student Safety\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, Anthropic Claude 3.5 Haiku","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0074/"},{"id":"INC-14987","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Show Character Role-Playing\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, DeepSeek DeepSeek R1, Google Gemini 2.5 Flash, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0075/"},{"id":"INC-14988","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Story Teller\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, Anthropic Claude 3.5 Haiku","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0076/"},{"id":"INC-14989","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Screenplay Deception\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1, Google Gemini 2.5 Flash","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0077/"},{"id":"INC-14990","date":"2026-01","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Police Interrogation Terminal\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek R1, Google Gemini 2.0 Flash, Mistral Mistral Large, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0078/"},{"id":"INC-14991","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Compare and Contrast\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini 2.0 Flash, OpenAI GPT-4o mini, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0079/"},{"id":"INC-14992","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Essay Title\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, DeepSeek DeepSeek V3, Meta LLaMa 3.3, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0080/"},{"id":"INC-14993","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Key-Value Pairs\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3 Opus, Cohere Command R, Google Gemini 2.0 Flash, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0081/"},{"id":"INC-14994","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via Token Disruption through Random Spacing","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4o mini, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0082/"},{"id":"INC-14995","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Abbreviation Expansion\"","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini 2.0 Flash, Mistral Mistral 8B, Mistral Mistral Large, OpenAI GPT-4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0083/"},{"id":"INC-14996","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"First Person Perspective\"","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Turbo, Anthropic Claude 3 Haiku, Anthropic Claude 3.5 Haiku","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0084/"},{"id":"INC-14997","date":"2025-10","year":2025,"title":"Multiple Model Guardrail Jailbreak via \"Psych-Phil DT + Compaction\" Technique","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, Cohere Command R","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0085/"},{"id":"INC-14998","date":"2025-10","year":2025,"title":"Multiple Model Guardrail Jailbreak via \"Super Short Prompt\"","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek V3, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0086/"},{"id":"INC-14999","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via Investigative Journalist Persona","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Haiku, Cohere Command R, Google Gemini 2.0 Flash, Mistral Mistral 8B","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0087/"},{"id":"INC-15000","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Speculative Knowledge Preservation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Haiku, Meta LLaMa 3.3, Mistral Mistral Large, OpenAI GPT-4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0088/"},{"id":"INC-15001","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Classical Art Reframing\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0089/"},{"id":"INC-15002","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via Memory Dump Simulation Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek V3, Google Gemini 2.0 Flash, OpenAI GPT-4, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0090/"},{"id":"INC-15003","date":"2026-02","year":2026,"title":"NSFW OpenAI Sora Guardrail Jailbreak via \"Anatomical Escalation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI Sora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0091/"},{"id":"INC-15004","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Mathematical Variable Obfuscation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, Google Gemini 2.0 Flash, Mistral Mistral 8B, Mistral Mistral Large","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0092/"},{"id":"INC-15005","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Scientific Framing for Wrapper\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek R1, DeepSeek DeepSeek V3, Mistral Mistral 8B, Mistral Mistral Large","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0093/"},{"id":"INC-15006","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Terminal Simulation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Sonnet, OpenAI GPT-4o, OpenAI GPT-4o mini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0094/"},{"id":"INC-15007","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Servile Scientist\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Meta LLaMa 3.3, Mistral Mistral 8B, Mistral Mistral Large, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0095/"},{"id":"INC-15008","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Debug Framework Simulation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0096/"},{"id":"INC-15009","date":"2026-02","year":2026,"title":"NSFW OpenAI Sora Guardrail Jailbreak via \"Hypothetical Anatomy\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI Sora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0097/"},{"id":"INC-15010","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Historical NSFW\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0098/"},{"id":"INC-15011","date":"2026-02","year":2026,"title":"OpenAI GPT-4o Guardrail Jailbreak via \"Layered Summarization\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0099/"},{"id":"INC-15012","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Feminist Art Description\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0100/"},{"id":"INC-15013","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Artistic Escalation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0101/"},{"id":"INC-15014","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Academic Framing\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, DeepSeek DeepSeek R1, DeepSeek DeepSeek V3, Google Gemini 2.0 Flash","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0102/"},{"id":"INC-15015","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Wiki Creation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4, OpenAI GPT-4o, OpenAI GPT-4o mini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0103/"},{"id":"INC-15016","date":"2026-02","year":2026,"title":"OpenAI GPT-4o Guardrail Jailbreak via \"Zero-Width Unicode\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0104/"},{"id":"INC-15017","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Historical Polaroid\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0105/"},{"id":"INC-15018","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Fictional API Detection\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini 2.0 Flash, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0106/"},{"id":"INC-15019","date":"2026-02","year":2026,"title":"NSFW OpenAI DALL-E3 Guardrail Jailbreak via \"Surprise Attack\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DALL-E3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0107/"},{"id":"INC-15020","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Spelling Mistakes\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3.5 Haiku, Google Gemini 2.0 Flash, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0108/"},{"id":"INC-15021","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Lambda Pattern Formatting\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Mistral Mistral Large, OpenAI GPT-4, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0109/"},{"id":"INC-15022","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Apocalyptic Scenario\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Turbo, Google Gemini 2.5 Pro, Mistral Mistral Large, OpenAI GPT-4.1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0110/"},{"id":"INC-15023","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Scientific Formula\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, Google Gemini 2.0 Flash, Mistral Mistral 8B, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0111/"},{"id":"INC-15024","date":"2026-02","year":2026,"title":"OpenAI GPT-4o Guardrail Jailbreak via \"Naval Parameters Cipher\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0112/"},{"id":"INC-15025","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via IPA Encoding Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"DeepSeek DeepSeek V3, Google Gemini 2.0 Flash, OpenAI GPT-4, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0113/"},{"id":"INC-15026","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Chaotic Formatting\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1, Meta LLaMa 3.3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0114/"},{"id":"INC-15027","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Leetspeak Unicode\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"IBM Watson, OpenAI GPT-4o mini, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0115/"},{"id":"INC-15028","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Correct Me\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Cohere Command R, Google Gemini 2.0 Flash, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0116/"},{"id":"INC-15029","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Pronunciation Bypass\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Plus, Anthropic Claude 3.5 Haiku, DeepSeek DeepSeek R1, Google Gemini 2.5 Pro","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0117/"},{"id":"INC-15030","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Chemist's Essay\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Alibaba Qwen Max, Alibaba Qwen Plus, Alibaba Qwen Turbo, DeepSeek DeepSeek R1","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0118/"},{"id":"INC-15031","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Analyze Data\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini 2.0 Flash, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0119/"},{"id":"INC-15032","date":"2026-02","year":2026,"title":"OpenAI Multiple Model Prompt Injection via \"Morse Code Businessman\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"OpenAI GPT-4, OpenAI GPT-4.5, OpenAI GPT-4o, OpenAI GPT-4o mini","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0120/"},{"id":"INC-15033","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Arbitrary Relation\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini 2.0 Flash, OpenAI GPT-4o, Twitter / X Grok 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0121/"},{"id":"INC-15034","date":"2026-02","year":2026,"title":"Multiple Model Guardrail Jailbreak via \"Fortune Cookie Simulator\" Tactic","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Anthropic Claude 3 Haiku, Cohere Command R, Google Gemini 2.0 Flash, OpenAI GPT-4o","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0122/"},{"id":"INC-15035","date":"2026-02","year":2026,"title":"Google Gemini G-Suite Prompt Injection Vulnerability","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Google Gemini, Google Workspace","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0123/"},{"id":"INC-15036","date":"2026-02","year":2026,"title":"Amazon Rufus Guardrail Jailbreak via ASCII Decimal Encoding","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Amazon Rufus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0124/"},{"id":"INC-15037","date":"2026-03","year":2026,"title":"Critical authentication bypass vulnerability in Base44","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"Base44","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0250/"},{"id":"INC-15038","date":"2026-03","year":2026,"title":"Data exfiltration via prompt injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Dia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0251/"},{"id":"INC-15039","date":"2026-01","year":2026,"title":"OpenAI ChatGPT Content Safety Explicit Image Bypass","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"ChatGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0413/"},{"id":"INC-15040","date":"2025-11","year":2025,"title":"Eclipse Theia IDE MCP Configuration Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Theia IDE","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0414/"},{"id":"INC-15041","date":"2026-01","year":2026,"title":"OpenAI Codex CLI Notify Field Configuration Remote Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Codex CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0415/"},{"id":"INC-15042","date":"2025-12","year":2025,"title":"Amazon Kiro IDE Data Exfiltration via Filename Prompt Injection and Kiro Powers Registry Fetching","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"Kiro IDE","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0418/"},{"id":"INC-15043","date":"2025-12","year":2025,"title":"Google Gemini CLI Tool Discovery Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Gemini CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0420/"},{"id":"INC-15044","date":"2025-12","year":2025,"title":"Google Gemini CLI MCP Configuration Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Gemini CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0421/"},{"id":"INC-15045","date":"2025-11","year":2025,"title":"JetBrains Junie AI Coding Agent guidelines.md Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Junie AI, IntelliJ IDEA, PyCharm Pro, GoLand","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0422/"},{"id":"INC-15046","date":"2025-10","year":2025,"title":"TheLibrarian.io Internal Cloud Environment Access via web_fetch Tool","severity":"Medium","attack_vector":"other","owasp_llm":[],"owasp_asi":[],"cve_ids":[],"affected":"TheLibrarian.io","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0423/"},{"id":"INC-15047","date":"2025-11","year":2025,"title":"Google Antigravity IDE Persistent Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Antigravity IDE","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0426/"},{"id":"INC-15048","date":"2025-03","year":2025,"title":"Nvidia NemoGuard Jailbreak Detect Guardrail Evasion","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01"],"owasp_asi":[],"cve_ids":[],"affected":"NemoGuard Jailbreak Detect","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0430/"},{"id":"INC-15049","date":"2025-12","year":2025,"title":"Mistral Vibe CLI MCP Configuration Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Vibe CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0436/"},{"id":"INC-15050","date":"2026-01","year":2026,"title":"Mistral Vibe CLI Shell Expansion Command Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Vibe CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0437/"},{"id":"INC-15051","date":"2025-12","year":2025,"title":"Mistral Vibe CLI Python Tools Code Execution","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM10"],"owasp_asi":[],"cve_ids":[],"affected":"Vibe CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r0438/"},{"id":"INC-15052","date":"2023-02","year":2023,"title":"Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially enable information disclosure via net...","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-27234"],"affected":"CVAT software maintained by Intel(R)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1009/"},{"id":"INC-15053","date":"2022-08","year":2022,"title":"Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) (CVE-2022-31188)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-31188"],"affected":"cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1042/"},{"id":"INC-15054","date":"2022-12","year":2022,"title":"Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2022-46741"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1170/"},{"id":"INC-15055","date":"2022-12","year":2022,"title":"Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2022-46742"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1171/"},{"id":"INC-15056","date":"2023-06","year":2023,"title":"AI-Engine < 1.6.83 - Admin+ Stored XSS (CVE-2023-2580)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-2580"],"affected":"AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1212/"},{"id":"INC-15057","date":"2023-10","year":2023,"title":"S3 credentials included when exporting elyra notebook (CVE-2023-3361)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-3361"],"affected":"odh-dashboard, Red Hat OpenShift Data Science (RHODS)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1244/"},{"id":"INC-15058","date":"2023-07","year":2023,"title":"Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38669"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1259/"},{"id":"INC-15059","date":"2023-07","year":2023,"title":"Null pointer dereference in paddle.flip (CVE-2023-38670)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38670"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1260/"},{"id":"INC-15060","date":"2023-07","year":2023,"title":"Heap buffer overflow in paddle.trace (CVE-2023-38671)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-38671"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1261/"},{"id":"INC-15061","date":"2024-01","year":2024,"title":"FPE in paddle.nanmedian (CVE-2023-38674)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38674"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1262/"},{"id":"INC-15062","date":"2024-01","year":2024,"title":"FPE in paddle.linalg.matrix_rank (CVE-2023-38675)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38675"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1263/"},{"id":"INC-15063","date":"2024-01","year":2024,"title":"Segfault in paddle.dot (CVE-2023-38676)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38676"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1264/"},{"id":"INC-15064","date":"2024-01","year":2024,"title":"FPE in paddle.linalg.eig (CVE-2023-38677)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38677"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1265/"},{"id":"INC-15065","date":"2023-09","year":2023,"title":"Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm (CVE-2023-4898)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2023-4898"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1295/"},{"id":"INC-15066","date":"2023-09","year":2023,"title":"SQL Injection in mintplex-labs/anything-llm (CVE-2023-4899)","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-4899"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1296/"},{"id":"INC-15067","date":"2023-12","year":2023,"title":"MindsDB Server-Side Request Forgery vulnerability (CVE-2023-49795)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49795"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1298/"},{"id":"INC-15068","date":"2023-12","year":2023,"title":"MindsDB Arbitrary File Write vulnerability (CVE-2023-49796)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-49796"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1299/"},{"id":"INC-15069","date":"2023-12","year":2023,"title":"MindsDB has arbitrary file write in file.py (CVE-2023-50731)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-50731"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1301/"},{"id":"INC-15070","date":"2024-01","year":2024,"title":"Segfault in paddle.nextafter (CVE-2023-52302)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52302"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1305/"},{"id":"INC-15071","date":"2024-01","year":2024,"title":"Segfault in paddle.put_along_axis (CVE-2023-52303)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52303"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1306/"},{"id":"INC-15072","date":"2024-01","year":2024,"title":"Stack overflow in paddle.searchsorted (CVE-2023-52304)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52304"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1307/"},{"id":"INC-15073","date":"2024-01","year":2024,"title":"FPE in paddle.topk (CVE-2023-52305)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52305"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1308/"},{"id":"INC-15074","date":"2024-01","year":2024,"title":"FPE in paddle.lerp (CVE-2023-52306)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52306"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1309/"},{"id":"INC-15075","date":"2024-01","year":2024,"title":"Stack overflow in paddle.linalg.lu_unpack (CVE-2023-52307)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52307"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1310/"},{"id":"INC-15076","date":"2024-01","year":2024,"title":"FPE in paddle.amin (CVE-2023-52308)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52308"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1311/"},{"id":"INC-15077","date":"2024-01","year":2024,"title":"Heap buffer overflow in paddle.repeat_interleave (CVE-2023-52309)","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2023-52309"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1312/"},{"id":"INC-15078","date":"2024-01","year":2024,"title":"Command injection in get_online_pass_interval (CVE-2023-52310)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-52310"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1313/"},{"id":"INC-15079","date":"2024-01","year":2024,"title":"Command injection in _wget_download (CVE-2023-52311)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-52311"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1314/"},{"id":"INC-15080","date":"2024-01","year":2024,"title":"Null pointer dereference in paddle.crop (CVE-2023-52312)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52312"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1315/"},{"id":"INC-15081","date":"2024-01","year":2024,"title":"FPE in paddle.argmin and paddle.argmax (CVE-2023-52313)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-52313"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1316/"},{"id":"INC-15082","date":"2024-01","year":2024,"title":"Command injection in convert_shape_compare (CVE-2023-52314)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-52314"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1317/"},{"id":"INC-15083","date":"2023-10","year":2023,"title":"The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-5241"],"affected":"AI ChatBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1318/"},{"id":"INC-15084","date":"2023-11","year":2023,"title":"H2O Local File Include (CVE-2023-6013)","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-6013"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1321/"},{"id":"INC-15085","date":"2023-11","year":2023,"title":"H2O Remote Code Execution via POJO Model Import (CVE-2023-6016)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-6016"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1322/"},{"id":"INC-15086","date":"2023-12","year":2023,"title":"External Control of File Name or Path in h2oai/h2o-3 (CVE-2023-6569)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-6569"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1328/"},{"id":"INC-15087","date":"2023-12","year":2023,"title":"Cross-site Scripting (XSS) - Stored in allegroai/clearml-server (CVE-2023-6778)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2023-6778"],"affected":"allegroai/clearml-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1332/"},{"id":"INC-15088","date":"2024-03","year":2024,"title":"Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0815"],"affected":"paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1359/"},{"id":"INC-15089","date":"2024-03","year":2024,"title":"Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0818"],"affected":"paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1360/"},{"id":"INC-15090","date":"2024-03","year":2024,"title":"remote code execution in paddlepaddle/paddle 2.6.0","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0917"],"affected":"paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1361/"},{"id":"INC-15091","date":"2025-03","year":2025,"title":"Path Traversal and OS Command Injection in parisneo/lollms-webui (CVE-2024-10019)","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10019"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1362/"},{"id":"INC-15092","date":"2024-10","year":2024,"title":"Stored XSS in comfyanonymous/comfyui (CVE-2024-10099)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10099"],"affected":"comfyanonymous/comfyui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1364/"},{"id":"INC-15093","date":"2024-10","year":2024,"title":"Remote Code Execution in infiniflow/ragflow (CVE-2024-10131)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10131"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1365/"},{"id":"INC-15094","date":"2025-03","year":2025,"title":"Denial of Service by ReDOS in h2oai/h2o-3 (CVE-2024-10549)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10549"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1368/"},{"id":"INC-15095","date":"2025-03","year":2025,"title":"Denial of Service by ReDOS in h2oai/h2o-3 (CVE-2024-10550)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10550"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1369/"},{"id":"INC-15096","date":"2025-03","year":2025,"title":"Jdbc Deserialization in h2oai/h2o-3 (CVE-2024-10553)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10553"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1370/"},{"id":"INC-15097","date":"2025-03","year":2025,"title":"Denial of Service and Arbitrary File Write in h2oai/h2o-3 (CVE-2024-10572)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10572"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1371/"},{"id":"INC-15098","date":"2025-03","year":2025,"title":"Open Redirect in binary-husky/gpt_academic (CVE-2024-10812)","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10812"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1374/"},{"id":"INC-15099","date":"2025-03","year":2025,"title":"Deserialization of Untrusted Data in binary-husky/gpt_academic (CVE-2024-11039)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11039"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1375/"},{"id":"INC-15100","date":"2025-03","year":2025,"title":"Privilege Escalation in langgenius/dify (CVE-2024-11821)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-11821"],"affected":"langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1380/"},{"id":"INC-15101","date":"2025-03","year":2025,"title":"Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection (CVE-2024-12044)","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12044"],"affected":"open-mmlab/mmdetection","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1381/"},{"id":"INC-15102","date":"2025-03","year":2025,"title":"Server-Side Request Forgery in haotian-liu/llava (CVE-2024-12068)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12068"],"affected":"haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1382/"},{"id":"INC-15103","date":"2025-03","year":2025,"title":"Arbitrary File Write via TarSlip in dmlc/gluon-cv (CVE-2024-12216)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12216"],"affected":"dmlc/gluon-cv","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1384/"},{"id":"INC-15104","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim (CVE-2024-12777)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12777"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1390/"},{"id":"INC-15105","date":"2025-02","year":2025,"title":"Path Traversal in mintplex-labs/anything-llm (CVE-2024-13059)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-13059"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1391/"},{"id":"INC-15106","date":"2024-04","year":2024,"title":"S3 Bucket Takeover in h2oai/h2o-3 (CVE-2024-1456)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1456"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1393/"},{"id":"INC-15107","date":"2024-04","year":2024,"title":"Path Traversal Vulnerability in parisneo/lollms-webui (CVE-2024-1511)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1511"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1395/"},{"id":"INC-15108","date":"2024-03","year":2024,"title":"Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui (CVE-2024-1522)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1522"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1396/"},{"id":"INC-15109","date":"2024-03","year":2024,"title":"confirmed (CVE-2024-1603)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1603"],"affected":"paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1399/"},{"id":"INC-15110","date":"2024-04","year":2024,"title":"Session Reuse Vulnerability in lunary-ai/lunary (CVE-2024-1902)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1902"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1402/"},{"id":"INC-15111","date":"2024-12","year":2024,"title":"The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server b...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-21574"],"affected":"ComfyUI-Manager","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1409/"},{"id":"INC-15112","date":"2024-06","year":2024,"title":"Path Traversal Vulnerability in parisneo/lollms-webui (CVE-2024-2178)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2178"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1414/"},{"id":"INC-15113","date":"2024-04","year":2024,"title":"Remote Code Execution in aimhubio/aim (CVE-2024-2195)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2195"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1419/"},{"id":"INC-15114","date":"2024-05","year":2024,"title":"Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (CVE-2024-2358)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2358"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1430/"},{"id":"INC-15115","date":"2024-06","year":2024,"title":"Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui (CVE-2024-2359)","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2359"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1431/"},{"id":"INC-15116","date":"2024-09","year":2024,"title":"MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding (CVE-2024-24759)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-24759"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1439/"},{"id":"INC-15117","date":"2024-06","year":2024,"title":"TarSlip Vulnerability in deepjavalibrary/djl (CVE-2024-2914)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2914"],"affected":"deepjavalibrary/djl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1455/"},{"id":"INC-15118","date":"2024-04","year":2024,"title":"Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm (CVE-2024-3101)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3101"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1459/"},{"id":"INC-15119","date":"2024-05","year":2024,"title":"Command Injection in parisneo/lollms-webui (CVE-2024-3126)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3126"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1463/"},{"id":"INC-15120","date":"2024-06","year":2024,"title":"Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm (CVE-2024-3152)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3152"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1465/"},{"id":"INC-15121","date":"2024-06","year":2024,"title":"Path Traversal in parisneo/lollms-webui (CVE-2024-3322)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3322"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1476/"},{"id":"INC-15122","date":"2024-06","year":2024,"title":"Apache Submarine Server Core: authorization bypass (CVE-2024-36265)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-36265"],"affected":"Apache Submarine Server Core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1489/"},{"id":"INC-15123","date":"2024-07","year":2024,"title":"WordPress AI Power: Complete AI Pack – Powered by GPT-4 plugin <= 1.8.66 - Cross Site Scripting (XSS) vulnerability (CVE-2024-37465)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-37465"],"affected":"GPT3 AI Content Writer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1499/"},{"id":"INC-15124","date":"2024-06","year":2024,"title":"Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui (CVE-2024-4320)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4320"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1526/"},{"id":"INC-15125","date":"2024-05","year":2024,"title":"Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui (CVE-2024-4326)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4326"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1528/"},{"id":"INC-15126","date":"2024-06","year":2024,"title":"CSRF in restart_program in parisneo/lollms-webui (CVE-2024-4403)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4403"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1530/"},{"id":"INC-15127","date":"2024-09","year":2024,"title":"An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45851"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1535/"},{"id":"INC-15128","date":"2024-09","year":2024,"title":"Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint (CVE-2024-47063)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-47063"],"affected":"cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1537/"},{"id":"INC-15129","date":"2024-09","year":2024,"title":"Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints (CVE-2024-47172)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-47172"],"affected":"cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1544/"},{"id":"INC-15130","date":"2024-10","year":2024,"title":"IBM Watson Studio Local cross-site request forgery (CVE-2024-49340)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-49340"],"affected":"Watson Studio Local","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1554/"},{"id":"INC-15131","date":"2024-11","year":2024,"title":"XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui (CVE-2024-5125)","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-5125"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1556/"},{"id":"INC-15132","date":"2024-06","year":2024,"title":"Denial of Service via Invalid Argument in h2oai/h2o-3 (CVE-2024-5979)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5979"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1581/"},{"id":"INC-15133","date":"2024-08","year":2024,"title":"Missing client_id in parisneo/lollms-webui (CVE-2024-6040)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6040"],"affected":"parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1583/"},{"id":"INC-15134","date":"2024-07","year":2024,"title":"Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim (CVE-2024-6396)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6396"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1586/"},{"id":"INC-15135","date":"2025-03","year":2025,"title":"Arbitrary File/Directory Deletion in aimhubio/aim (CVE-2024-6483)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6483"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1587/"},{"id":"INC-15136","date":"2025-03","year":2025,"title":"Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim (CVE-2024-6829)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6829"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1591/"},{"id":"INC-15137","date":"2025-03","year":2025,"title":"Arbitrary File Overwrite in h2oai/h2o-3 (CVE-2024-6854)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6854"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1593/"},{"id":"INC-15138","date":"2024-10","year":2024,"title":"Arbitrary File Write in mudler/LocalAI (CVE-2024-6868)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6868"],"affected":"mudler/localai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1594/"},{"id":"INC-15139","date":"2025-03","year":2025,"title":"CSRF in aimhubio/aim (CVE-2024-7760)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-7760"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1602/"},{"id":"INC-15140","date":"2025-03","year":2025,"title":"Denial of Service in h2oai/h2o-3 (CVE-2024-7765)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7765"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1603/"},{"id":"INC-15141","date":"2025-03","year":2025,"title":"Denial of Service in h2oai/h2o-3 (CVE-2024-7768)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7768"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1604/"},{"id":"INC-15142","date":"2025-03","year":2025,"title":"Arbitrary File Overwrite in danswer-ai/danswer (CVE-2024-7957)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-7957"],"affected":"danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1606/"},{"id":"INC-15143","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim (CVE-2024-8061)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8061"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1609/"},{"id":"INC-15144","date":"2025-03","year":2025,"title":"Denial of Service in h2oai/h2o-3 (CVE-2024-8062)","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8062"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1610/"},{"id":"INC-15145","date":"2025-03","year":2025,"title":"CSRF in danswer-ai/danswer (CVE-2024-8065)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8065"],"affected":"danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1612/"},{"id":"INC-15146","date":"2025-03","year":2025,"title":"Unrestricted Code Execution in aimhubio/aim (CVE-2024-8238)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-8238"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1614/"},{"id":"INC-15147","date":"2025-03","year":2025,"title":"Path Traversal in mintplex-labs/anything-llm (CVE-2024-8248)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8248"],"affected":"mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1615/"},{"id":"INC-15148","date":"2025-02","year":2025,"title":"Local File Inclusion (LFI) in modelscope/agentscope (CVE-2024-8550)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-8550"],"affected":"modelscope/agentscope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1621/"},{"id":"INC-15149","date":"2025-03","year":2025,"title":"Arbitrary File Overwrite in h2oai/h2o-3 (CVE-2024-8616)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8616"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1623/"},{"id":"INC-15150","date":"2025-03","year":2025,"title":"Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim (CVE-2024-8769)","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8769"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1624/"},{"id":"INC-15151","date":"2024-09","year":2024,"title":"h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization (CVE-2024-8862)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8862"],"affected":"h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1627/"},{"id":"INC-15152","date":"2025-03","year":2025,"title":"Path Traversal in parisneo/lollms-webui (CVE-2024-8898)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8898"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1628/"},{"id":"INC-15153","date":"2025-03","year":2025,"title":"Local File Inclusion in bentoml/openllm (CVE-2024-8982)","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-8982"],"affected":"bentoml/openllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1629/"},{"id":"INC-15154","date":"2025-03","year":2025,"title":"Privilege Escalation in lunary-ai/lunary (CVE-2024-9098)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9098"],"affected":"lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1631/"},{"id":"INC-15155","date":"2025-03","year":2025,"title":"Improper Privilege Management in transformeroptimus/superagi (CVE-2024-9431)","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9431"],"affected":"transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1635/"},{"id":"INC-15156","date":"2025-03","year":2025,"title":"Remote Code Execution in transformeroptimus/superagi (CVE-2024-9439)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9439"],"affected":"transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1636/"},{"id":"INC-15157","date":"2025-03","year":2025,"title":"Missing Authentication Check in parisneo/lollms-webui (CVE-2024-9919)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9919"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1639/"},{"id":"INC-15158","date":"2025-03","year":2025,"title":"Unrestricted File Upload and Execution in parisneo/lollms-webui (CVE-2024-9920)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9920"],"affected":"parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1640/"},{"id":"INC-15159","date":"2025-03","year":2025,"title":"SSRF in gaizhenbiao/chuanhuchatgpt (CVE-2025-0188)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0188"],"affected":"gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1642/"},{"id":"INC-15160","date":"2025-03","year":2025,"title":"Stored Cross-site Scripting (XSS) in wandb/openui (CVE-2025-0192)","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0192"],"affected":"wandb/openui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1643/"},{"id":"INC-15161","date":"2025-03","year":2025,"title":"SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt (CVE-2025-0454)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0454"],"affected":"significant-gravitas/autogpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1645/"},{"id":"INC-15162","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI (CVE-2025-0744)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0744"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1648/"},{"id":"INC-15163","date":"2025-01","year":2025,"title":"CVAT allows remote code execution via tracker Nuclio functions (CVE-2025-23045)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-23045"],"affected":"cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1660/"},{"id":"INC-15164","date":"2025-03","year":2025,"title":"Applio allows SSRF and file write in model_download.py (CVE-2025-27775)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27775"],"affected":"Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1672/"},{"id":"INC-15165","date":"2025-03","year":2025,"title":"Applio allows unsafe deserialization in model_information.py (CVE-2025-27780)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27780"],"affected":"Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1673/"},{"id":"INC-15166","date":"2025-03","year":2025,"title":"Applio allows unsafe deserialization in inference.py (CVE-2025-27781)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27781"],"affected":"Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1674/"},{"id":"INC-15167","date":"2025-03","year":2025,"title":"Applio allows arbitrary file write in inference.py (CVE-2025-27782)","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27782"],"affected":"Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1675/"},{"id":"INC-15168","date":"2025-03","year":2025,"title":"Applio allows a DoS in restart.py (CVE-2025-27787)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27787"],"affected":"Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1676/"},{"id":"INC-15169","date":"2026-03","year":2026,"title":"Trivy ecosystem supply chain briefly compromised (CVE-2026-33634)","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-33634"],"affected":"setup-trivy, trivy-action, trivy, LiteLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://avidml.org/database/avid-2026-r1714/"},{"id":"INC-15170","date":"2024-01","year":2024,"title":"Segfault in paddle.mode","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2023-38678"],"affected":"PaddlePaddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2023-38678"},{"id":"INC-15171","date":"2024-04","year":2024,"title":"Mass Assignment Vulnerability in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0404"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0404"},{"id":"INC-15172","date":"2024-02","year":2024,"title":"User can submit message to self-XSS","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0435"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0435"},{"id":"INC-15173","date":"2024-02","year":2024,"title":"User can manually send request at manager permission to modify system configurations","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0439"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0439"},{"id":"INC-15174","date":"2024-02","year":2024,"title":"SSRF - file:// unsanitized access to underlying host files","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0440"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0440"},{"id":"INC-15175","date":"2024-01","year":2024,"title":"Code Injection in paddlepaddle/paddle","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0521"],"affected":"paddlepaddle/paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0521"},{"id":"INC-15176","date":"2024-04","year":2024,"title":"Relative Path Traversal in mintplex-labs/anything-llm","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0549"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0549"},{"id":"INC-15177","date":"2024-02","year":2024,"title":"Privileged User using traversal to read system files","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0550"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0550"},{"id":"INC-15178","date":"2024-02","year":2024,"title":"Download and export of file via default user role","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0551"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0551"},{"id":"INC-15179","date":"2024-02","year":2024,"title":"Improper validation of document removal parameter","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0763"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0763"},{"id":"INC-15180","date":"2024-03","year":2024,"title":"Create user API role not enforced","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-0795"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0795"},{"id":"INC-15181","date":"2024-02","year":2024,"title":"Privilege Escalation in mintplex-labs/anything-llm","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-0798"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0798"},{"id":"INC-15182","date":"2024-03","year":2024,"title":"Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-0817"],"affected":"paddlepaddle/paddlepaddle/paddle","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-0817"},{"id":"INC-15183","date":"2024-12","year":2024,"title":"SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-10044"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10044"},{"id":"INC-15184","date":"2025-03","year":2025,"title":"Directory Listing Vulnerability in parisneo/lollms-webui","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10047"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10047"},{"id":"INC-15185","date":"2024-10","year":2024,"title":"Path Traversal in binary-husky/gpt_academic","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-10100"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10100"},{"id":"INC-15186","date":"2024-10","year":2024,"title":"Stored XSS in binary-husky/gpt_academic","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10101"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10101"},{"id":"INC-15187","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10110"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10110"},{"id":"INC-15188","date":"2025-03","year":2025,"title":"Denial of Service in haotian-liu/llava","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10225"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10225"},{"id":"INC-15189","date":"2025-03","year":2025,"title":"Information Disclosure in transformeroptimus/superagi","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-10267"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10267"},{"id":"INC-15190","date":"2025-03","year":2025,"title":"Broken Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10272"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10272"},{"id":"INC-15191","date":"2025-03","year":2025,"title":"Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10275"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10275"},{"id":"INC-15192","date":"2025-03","year":2025,"title":"Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechat","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10359"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10359"},{"id":"INC-15193","date":"2025-03","year":2025,"title":"Arbitrary File Deletion via Path Traversal in danny-avila/librechat","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10361"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10361"},{"id":"INC-15194","date":"2025-03","year":2025,"title":"Improper Access Control in danny-avila/LibreChat","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10363"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10363"},{"id":"INC-15195","date":"2025-03","year":2025,"title":"IDOR in delete attachments in danny-avila/librechat","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10366"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10366"},{"id":"INC-15196","date":"2025-03","year":2025,"title":"SSRF Vulnerabilities in significant-gravitas/autogpt","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-10457"],"affected":"significant-gravitas/significant-gravitas/autogpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10457"},{"id":"INC-15197","date":"2025-02","year":2025,"title":"Unauthenticated File Upload in wandb/openui","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10649"],"affected":"wandb/wandb/openui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10649"},{"id":"INC-15198","date":"2025-03","year":2025,"title":"Denial of Service in binary-husky/gpt_academic","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10714"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10714"},{"id":"INC-15199","date":"2025-03","year":2025,"title":"CSRF to XSS in binary-husky/gpt_academic","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10819"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10819"},{"id":"INC-15200","date":"2025-03","year":2025,"title":"Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10901"],"affected":"eosphoros-ai/eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10901"},{"id":"INC-15201","date":"2025-03","year":2025,"title":"Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10907"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10907"},{"id":"INC-15202","date":"2025-03","year":2025,"title":"Open Redirect in lm-sys/fastchat","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10908"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10908"},{"id":"INC-15203","date":"2025-03","year":2025,"title":"Denial of Service in lm-sys/fastchat","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10912"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10912"},{"id":"INC-15204","date":"2025-03","year":2025,"title":"Arbitrary File Read via Upload Function in binary-husky/gpt_academic","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-10948"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10948"},{"id":"INC-15205","date":"2025-03","year":2025,"title":"ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10955"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10955"},{"id":"INC-15206","date":"2025-03","year":2025,"title":"Cross-Site WebSocket Hijacking in binary-husky/gpt_academic","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-10956"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10956"},{"id":"INC-15207","date":"2025-03","year":2025,"title":"Local File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academic","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-10986"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-10986"},{"id":"INC-15208","date":"2025-03","year":2025,"title":"Denial of Service (DoS) in binary-husky/gpt_academic","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11033"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11033"},{"id":"INC-15209","date":"2025-03","year":2025,"title":"IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11137"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11137"},{"id":"INC-15210","date":"2025-03","year":2025,"title":"Improper Access Control in danny-avila/librechat","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-11167"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11167"},{"id":"INC-15211","date":"2025-03","year":2025,"title":"Unhandled Exception Leading to Server Crash in danny-avila/librechat","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11169"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11169"},{"id":"INC-15212","date":"2025-03","year":2025,"title":"Path Traversal in danny-avila/librechat","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11170"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11170"},{"id":"INC-15213","date":"2025-03","year":2025,"title":"Improper Input Validation in danny-avila/librechat","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11171"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11171"},{"id":"INC-15214","date":"2025-03","year":2025,"title":"Denial of Service in danny-avila/librechat","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11172"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11172"},{"id":"INC-15215","date":"2025-03","year":2025,"title":"Missing check_access in lollms_binding_infos in parisneo/lollms","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-11302"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11302"},{"id":"INC-15216","date":"2025-03","year":2025,"title":"Server-Side Request Forgery in haotian-liu/llava","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11449"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11449"},{"id":"INC-15217","date":"2025-03","year":2025,"title":"Server-Side Request Forgery in lm-sys/fastchat","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11603"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11603"},{"id":"INC-15218","date":"2025-03","year":2025,"title":"Server-Side Request Forgery (SSRF) in langgenius/dify","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11822"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11822"},{"id":"INC-15219","date":"2025-03","year":2025,"title":"Stored XSS in langgenius/dify","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-11824"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11824"},{"id":"INC-15220","date":"2025-02","year":2025,"title":"Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-11831"],"affected":"serialize-javascript, Red Hat/Red Hat Advanced Cluster Security 4.4, Red Hat/Red Hat Advanced Cluster Security 4.5,…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11831"},{"id":"INC-15221","date":"2025-03","year":2025,"title":"Stored XSS in langgenius/dify","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-11850"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-11850"},{"id":"INC-15222","date":"2025-03","year":2025,"title":"Improper Restriction of Excessive Authentication Attempts in langgenius/dify","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12039"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12039"},{"id":"INC-15223","date":"2025-03","year":2025,"title":"IDOR Vulnerability in transformeroptimus/superagi","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12048"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12048"},{"id":"INC-15224","date":"2025-03","year":2025,"title":"Denial of Service in imartinez/privategpt","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12063"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12063"},{"id":"INC-15225","date":"2025-03","year":2025,"title":"Denial of Service in haotian-liu/llava","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12070"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12070"},{"id":"INC-15226","date":"2025-03","year":2025,"title":"Server Side Request Forgery in lm-sys/fastchat","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12376"],"affected":"lm-sys/lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12376"},{"id":"INC-15227","date":"2025-03","year":2025,"title":"Improper Input Validation in binary-husky/gpt_academic","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12387"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12387"},{"id":"INC-15228","date":"2025-03","year":2025,"title":"Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12388"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12388"},{"id":"INC-15229","date":"2025-03","year":2025,"title":"Path Traversal in binary-husky/gpt_academic","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12389"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12389"},{"id":"INC-15230","date":"2025-03","year":2025,"title":"Remote Code Execution in binary-husky/gpt_academic","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12390"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12390"},{"id":"INC-15231","date":"2025-03","year":2025,"title":"Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12391"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12391"},{"id":"INC-15232","date":"2025-03","year":2025,"title":"Server-Side Request Forgery (SSRF) in binary-husky/gpt_academic","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12392"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12392"},{"id":"INC-15233","date":"2025-03","year":2025,"title":"Remote Code Execution in infiniflow/ragflow","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12433"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12433"},{"id":"INC-15234","date":"2025-03","year":2025,"title":"RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12450"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12450"},{"id":"INC-15235","date":"2025-03","year":2025,"title":"Logs Debug Injection in danny-avila/librechat","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12580"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12580"},{"id":"INC-15236","date":"2025-03","year":2025,"title":"SSRF in parisneo/lollms-webui","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12766"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12766"},{"id":"INC-15237","date":"2025-03","year":2025,"title":"Authentication Bypass in langgenius/dify","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12776"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12776"},{"id":"INC-15238","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12778"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12778"},{"id":"INC-15239","date":"2025-03","year":2025,"title":"Improper Authentication in infiniflow/ragflow","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-12869"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12869"},{"id":"INC-15240","date":"2025-03","year":2025,"title":"Stored Cross-site Scripting (XSS) in infiniflow/ragflow","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12870"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12870"},{"id":"INC-15241","date":"2025-03","year":2025,"title":"Stored Cross-site Scripting (XSS) in infiniflow/ragflow","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-12871"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12871"},{"id":"INC-15242","date":"2025-03","year":2025,"title":"Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-12880"],"affected":"infiniflow/infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12880"},{"id":"INC-15243","date":"2025-03","year":2025,"title":"SSRF in comfyanonymous/comfyui","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-12882"],"affected":"comfyanonymous/comfyanonymous/comfyui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-12882"},{"id":"INC-15244","date":"2024-04","year":2024,"title":"OS Command Injection in parisneo/lollms-webui","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1520"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1520"},{"id":"INC-15245","date":"2024-04","year":2024,"title":"Uncontrolled Resource Consumption in parisneo/lollms-webui","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1569"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1569"},{"id":"INC-15246","date":"2024-04","year":2024,"title":"Local File Inclusion in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1600"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1600"},{"id":"INC-15247","date":"2024-04","year":2024,"title":"SQL Injection in parisneo/lollms-webui","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1601"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1601"},{"id":"INC-15248","date":"2024-04","year":2024,"title":"IDOR Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1625"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1625"},{"id":"INC-15249","date":"2024-04","year":2024,"title":"IDOR Vulnerability in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1626"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1626"},{"id":"INC-15250","date":"2024-04","year":2024,"title":"Unauthorized Organization Access in lunary-ai/lunary","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-1643"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1643"},{"id":"INC-15251","date":"2024-04","year":2024,"title":"Authentication Bypass in parisneo/lollms-webui","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-1646"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1646"},{"id":"INC-15252","date":"2024-04","year":2024,"title":"Unauthorized Radar Creation in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1666"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1666"},{"id":"INC-15253","date":"2024-04","year":2024,"title":"Incorrect Authorization in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1738"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1738"},{"id":"INC-15254","date":"2024-04","year":2024,"title":"Case Insensitive Email Address Validation Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1739"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1739"},{"id":"INC-15255","date":"2024-04","year":2024,"title":"Incorrect Authorization in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-1740"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1740"},{"id":"INC-15256","date":"2024-04","year":2024,"title":"Improper Authorization in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-1741"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1741"},{"id":"INC-15257","date":"2024-06","year":2024,"title":"Path Traversal and Denial of Service in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-1873"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-1873"},{"id":"INC-15258","date":"2024-04","year":2024,"title":"CSRF Vulnerability in aimhubio/aim","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-2196"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2196"},{"id":"INC-15259","date":"2024-04","year":2024,"title":"Improper Access Control in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-2217"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2217"},{"id":"INC-15260","date":"2024-06","year":2024,"title":"CSRF File Upload Vulnerability in parisneo/lollms-webui","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2288"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2288"},{"id":"INC-15261","date":"2024-05","year":2024,"title":"Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2299"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2299"},{"id":"INC-15262","date":"2026-02","year":2026,"title":"Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2356"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2356"},{"id":"INC-15263","date":"2024-06","year":2024,"title":"Path Traversal leading to Remote Code Execution in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2360"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2360"},{"id":"INC-15264","date":"2024-05","year":2024,"title":"Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2361"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2361"},{"id":"INC-15265","date":"2024-06","year":2024,"title":"Path Traversal in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2362"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2362"},{"id":"INC-15266","date":"2024-05","year":2024,"title":"Remote Code Execution in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2366"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2366"},{"id":"INC-15267","date":"2024-06","year":2024,"title":"Path Traversal in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2548"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2548"},{"id":"INC-15268","date":"2024-06","year":2024,"title":"Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2624"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2624"},{"id":"INC-15269","date":"2024-04","year":2024,"title":"WordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-2830"],"affected":"stevejburge/Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2830"},{"id":"INC-15270","date":"2024-05","year":2024,"title":"Race Condition Vulnerability in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-2913"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-2913"},{"id":"INC-15271","date":"2024-04","year":2024,"title":"Path Traversal in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3025"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3025"},{"id":"INC-15272","date":"2024-04","year":2024,"title":"Improper Input Validation in mintplex-labs/anything-llm","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3028"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3028"},{"id":"INC-15273","date":"2024-04","year":2024,"title":"Improper Input Validation in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3029"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3029"},{"id":"INC-15274","date":"2024-06","year":2024,"title":"JSON Injection in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3102"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3102"},{"id":"INC-15275","date":"2024-06","year":2024,"title":"Stored XSS leading to admin account takeover in mintplex-labs/anything-llm","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3110"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3110"},{"id":"INC-15276","date":"2024-06","year":2024,"title":"SSRF in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3149"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3149"},{"id":"INC-15277","date":"2024-06","year":2024,"title":"Privilege Escalation in mintplex-labs/anything-llm","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3150"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3150"},{"id":"INC-15278","date":"2024-06","year":2024,"title":"Uncontrolled Resource Consumption in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3153"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3153"},{"id":"INC-15279","date":"2024-06","year":2024,"title":"Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm","severity":"Low","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3166"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3166"},{"id":"INC-15280","date":"2024-08","year":2024,"title":"Improper Access Control in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-3279"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3279"},{"id":"INC-15281","date":"2024-04","year":2024,"title":"Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3283"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3283"},{"id":"INC-15282","date":"2024-04","year":2024,"title":"Unauthorized access to GET/SET of Slack Bot Tokens in Danswer","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-32881"],"affected":"danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-32881"},{"id":"INC-15283","date":"2024-11","year":2024,"title":"Incorrect Authorization in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3379"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3379"},{"id":"INC-15284","date":"2024-06","year":2024,"title":"Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3402"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3402"},{"id":"INC-15285","date":"2024-05","year":2024,"title":"Local File Inclusion in imartinez/privategpt","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3403"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3403"},{"id":"INC-15286","date":"2024-06","year":2024,"title":"Improper Access Control in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-3404"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3404"},{"id":"INC-15287","date":"2024-05","year":2024,"title":"Path Traversal in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3435"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3435"},{"id":"INC-15288","date":"2024-05","year":2024,"title":"joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array().","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-34997"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-34997"},{"id":"INC-15289","date":"2024-11","year":2024,"title":"Exposure of Sensitive Information in lunary-ai/lunary","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-3501"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3501"},{"id":"INC-15290","date":"2024-11","year":2024,"title":"Exposure of Sensitive Information in lunary-ai/lunary","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-3502"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3502"},{"id":"INC-15291","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-3504"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3504"},{"id":"INC-15292","date":"2024-04","year":2024,"title":"Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3569"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3569"},{"id":"INC-15293","date":"2024-04","year":2024,"title":"Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3575"],"affected":"mindsdb/mindsdb/mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3575"},{"id":"INC-15294","date":"2024-06","year":2024,"title":"Apache Submarine Server Core: SQL injection","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-36263"],"affected":"Apache Software Foundation/Apache Submarine Server Core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36263"},{"id":"INC-15295","date":"2024-06","year":2024,"title":"Apache Submarine Commons Utils: default secret","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-36264"],"affected":"Apache Software Foundation/Apache Submarine Commons Utils","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-36264"},{"id":"INC-15296","date":"2024-06","year":2024,"title":"CVAT SSRF via custom cloud storage endpoints","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-37164"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37164"},{"id":"INC-15297","date":"2024-06","year":2024,"title":"CVAT's export and backup-related API endpoints are susceptible to CSRF","severity":"High","attack_vector":"other","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-37306"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-37306"},{"id":"INC-15298","date":"2024-11","year":2024,"title":"Email Bombing Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3760"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3760"},{"id":"INC-15299","date":"2024-05","year":2024,"title":"Missing Authorization on Delete Datasets in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-3761"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3761"},{"id":"INC-15300","date":"2024-05","year":2024,"title":"Unrestricted File Upload Leading to XSS in imartinez/privategpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-3851"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-3851"},{"id":"INC-15301","date":"2024-12","year":2024,"title":"Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-39025"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-39025"},{"id":"INC-15302","date":"2024-06","year":2024,"title":"SSRF vulnerability in mintplex-labs/anything-llm","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4084"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4084"},{"id":"INC-15303","date":"2024-06","year":2024,"title":"Incorrect Authorization in lunary-ai/lunary","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-4146"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4146"},{"id":"INC-15304","date":"2026-02","year":2026,"title":"Insufficient Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4147"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4147"},{"id":"INC-15305","date":"2024-06","year":2024,"title":"Redos (Regular Expression Denial of Service) in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4148"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4148"},{"id":"INC-15306","date":"2024-05","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4151"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4151"},{"id":"INC-15307","date":"2024-05","year":2024,"title":"Incorrect Synchronization in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4154"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4154"},{"id":"INC-15308","date":"2024-05","year":2024,"title":"Remote Code Execution in parisneo/lollms-webui","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4267"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4267"},{"id":"INC-15309","date":"2024-08","year":2024,"title":"SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the/ajax/Logi...","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-42679"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-42679"},{"id":"INC-15310","date":"2024-05","year":2024,"title":"Denial of Service in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4284"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4284"},{"id":"INC-15311","date":"2024-05","year":2024,"title":"Improper Neutralization of Special Elements in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4286"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4286"},{"id":"INC-15312","date":"2024-05","year":2024,"title":"Improper Input Validation in mintplex-labs/anything-llm","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4287"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4287"},{"id":"INC-15313","date":"2024-05","year":2024,"title":"Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-4321"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4321"},{"id":"INC-15314","date":"2024-05","year":2024,"title":"Path Traversal in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4322"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4322"},{"id":"INC-15315","date":"2024-06","year":2024,"title":"CSRF in clear_personality_files_list in parisneo/lollms-webui","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4328"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4328"},{"id":"INC-15316","date":"2024-11","year":2024,"title":"LightGBM Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-43598"],"affected":"Microsoft/LightGBM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-43598"},{"id":"INC-15317","date":"2024-06","year":2024,"title":"Path Traversal and RFI Vulnerability in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4498"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4498"},{"id":"INC-15318","date":"2024-06","year":2024,"title":"CSRF Vulnerability in parisneo/lollms XTTS Server","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-4499"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4499"},{"id":"INC-15319","date":"2024-06","year":2024,"title":"Improper Access Control in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-4520"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4520"},{"id":"INC-15320","date":"2024-09","year":2024,"title":"Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-45393"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45393"},{"id":"INC-15321","date":"2024-09","year":2024,"title":"An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45847"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45847"},{"id":"INC-15322","date":"2024-09","year":2024,"title":"An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45849"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45849"},{"id":"INC-15323","date":"2024-09","year":2024,"title":"An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45850"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45850"},{"id":"INC-15324","date":"2024-09","year":2024,"title":"Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server whe...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45852"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45852"},{"id":"INC-15325","date":"2024-09","year":2024,"title":"Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45853"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45853"},{"id":"INC-15326","date":"2024-09","year":2024,"title":"Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45854"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45854"},{"id":"INC-15327","date":"2024-09","year":2024,"title":"Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-45855"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-45855"},{"id":"INC-15328","date":"2024-09","year":2024,"title":"Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-47064"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-47064"},{"id":"INC-15329","date":"2024-11","year":2024,"title":"gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission.","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-48059"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-48059"},{"id":"INC-15330","date":"2024-06","year":2024,"title":"Path Traversal in parisneo/lollms-webui","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-4841"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4841"},{"id":"INC-15331","date":"2024-06","year":2024,"title":"Code Injection in berriai/litellm","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-4889"],"affected":"berriai/berriai/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-4889"},{"id":"INC-15332","date":"2025-08","year":2025,"title":"IBM Watson Studio on Cloud Pak for Data cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-49790"],"affected":"IBM/Watson Studio on Cloud Pak for Data","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-49790"},{"id":"INC-15333","date":"2024-06","year":2024,"title":"Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-5124"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5124"},{"id":"INC-15334","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5126"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5126"},{"id":"INC-15335","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5127"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5127"},{"id":"INC-15336","date":"2024-06","year":2024,"title":"IDOR Vulnerability in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5128"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5128"},{"id":"INC-15337","date":"2024-06","year":2024,"title":"Privilege Escalation Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5129"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5129"},{"id":"INC-15338","date":"2024-06","year":2024,"title":"Incorrect Authorization in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5130"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5130"},{"id":"INC-15339","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5131"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5131"},{"id":"INC-15340","date":"2024-06","year":2024,"title":"Account Takeover via Exposed Recovery Token in lunary-ai/lunary","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5133"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5133"},{"id":"INC-15341","date":"2024-06","year":2024,"title":"Command Injection in mudler/localai","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5181"],"affected":"mudler/mudler/localai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5181"},{"id":"INC-15342","date":"2024-06","year":2024,"title":"Server Side Request Forgery (SSRF) in imartinez/privategpt","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5186"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5186"},{"id":"INC-15343","date":"2024-06","year":2024,"title":"Sensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learn","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM05"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-5206"],"affected":"scikit-learn/scikit-learn/scikit-learn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5206"},{"id":"INC-15344","date":"2024-06","year":2024,"title":"Uncontrolled Resource Consumption in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5208"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5208"},{"id":"INC-15345","date":"2024-06","year":2024,"title":"Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-5211"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5211"},{"id":"INC-15346","date":"2024-06","year":2024,"title":"Exposure of Sensitive Information in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-5213"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5213"},{"id":"INC-15347","date":"2024-06","year":2024,"title":"Denial of Service in mintplex-labs/anything-llm","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5216"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5216"},{"id":"INC-15348","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5248"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5248"},{"id":"INC-15349","date":"2024-06","year":2024,"title":"Weak Password Recovery Mechanism in lunary-ai/lunary","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5277"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5277"},{"id":"INC-15350","date":"2024-06","year":2024,"title":"Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5278"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5278"},{"id":"INC-15351","date":"2024-11","year":2024,"title":"An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename in an uploaded file.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-52787"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-52787"},{"id":"INC-15352","date":"2024-06","year":2024,"title":"SSRF Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5328"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5328"},{"id":"INC-15353","date":"2024-12","year":2024,"title":"RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-53450"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-53450"},{"id":"INC-15354","date":"2026-02","year":2026,"title":"Account Hijacking via Password Reset Token Leak in lunary-ai/lunary","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5386"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5386"},{"id":"INC-15355","date":"2024-06","year":2024,"title":"SSRF in add_webpage endpoint in parisneo/lollms-webui","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5482"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5482"},{"id":"INC-15356","date":"2025-01","year":2025,"title":"An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-55459"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-55459"},{"id":"INC-15357","date":"2024-06","year":2024,"title":"Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-5550"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5550"},{"id":"INC-15358","date":"2024-07","year":2024,"title":"CSRF Vulnerability in mudler/LocalAI","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5616"],"affected":"mudler/mudler/localai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5616"},{"id":"INC-15359","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5714"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5714"},{"id":"INC-15360","date":"2024-07","year":2024,"title":"Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5753"],"affected":"vanna-ai/vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5753"},{"id":"INC-15361","date":"2024-06","year":2024,"title":"Email Validation Bypass in lunary-ai/lunary","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5755"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5755"},{"id":"INC-15362","date":"2024-06","year":2024,"title":"Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPT","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5822"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5822"},{"id":"INC-15363","date":"2024-10","year":2024,"title":"File Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5823"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5823"},{"id":"INC-15364","date":"2024-06","year":2024,"title":"Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5827"],"affected":"vanna-ai/vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5827"},{"id":"INC-15365","date":"2024-06","year":2024,"title":"Cross-site Scripting (XSS) in parisneo/lollms-webui","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5933"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5933"},{"id":"INC-15366","date":"2024-06","year":2024,"title":"CSRF Vulnerability in imartinez/privategpt","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-5935"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5935"},{"id":"INC-15367","date":"2024-06","year":2024,"title":"Open Redirect in imartinez/privategpt","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-5936"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5936"},{"id":"INC-15368","date":"2024-10","year":2024,"title":"Path Traversal in gaizhenbiao/chuanhuchatgpt","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5982"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5982"},{"id":"INC-15369","date":"2026-02","year":2026,"title":"Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-5986"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-5986"},{"id":"INC-15370","date":"2024-07","year":2024,"title":"Stored XSS in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6035"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6035"},{"id":"INC-15371","date":"2024-07","year":2024,"title":"Denial of Service in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6036"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6036"},{"id":"INC-15372","date":"2024-07","year":2024,"title":"Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6037"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6037"},{"id":"INC-15373","date":"2024-06","year":2024,"title":"ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6038"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6038"},{"id":"INC-15374","date":"2024-06","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-6086"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6086"},{"id":"INC-15375","date":"2024-09","year":2024,"title":"Improper Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-6087"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6087"},{"id":"INC-15376","date":"2024-06","year":2024,"title":"Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6090"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6090"},{"id":"INC-15377","date":"2024-07","year":2024,"title":"Infinite Loop in aimhubio/aim","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6227"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6227"},{"id":"INC-15378","date":"2024-06","year":2024,"title":"Absolute Path Traversal in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6250"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6250"},{"id":"INC-15379","date":"2024-07","year":2024,"title":"Path Traversal in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6255"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6255"},{"id":"INC-15380","date":"2024-09","year":2024,"title":"Local File Inclusion in parisneo/lollms-webui","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6394"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6394"},{"id":"INC-15381","date":"2024-07","year":2024,"title":"Stored XSS in aimhubio/aim","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6578"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6578"},{"id":"INC-15382","date":"2024-09","year":2024,"title":"Broken Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-6582"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6582"},{"id":"INC-15383","date":"2024-10","year":2024,"title":"Data Leak through CORS Misconfiguration in parisneo/lollms-webui","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-6674"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6674"},{"id":"INC-15384","date":"2024-08","year":2024,"title":"Open WebUI Arbitrary File Upload + Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6707"],"affected":"Open WebUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6707"},{"id":"INC-15385","date":"2025-03","year":2025,"title":"CSRF in vanna-ai/vanna","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6841"],"affected":"vanna-ai/vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6841"},{"id":"INC-15386","date":"2025-03","year":2025,"title":"Arbitrary File Deletion in aimhubio/aim","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6851"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6851"},{"id":"INC-15387","date":"2024-09","year":2024,"title":"Cross-Site Request Forgery (CSRF) in lunary-ai/lunary","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6862"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6862"},{"id":"INC-15388","date":"2025-03","year":2025,"title":"Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3","severity":"Medium","attack_vector":"ransomware","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6863"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6863"},{"id":"INC-15389","date":"2024-09","year":2024,"title":"Information Disclosure in lunary-ai/lunary","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-6867"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6867"},{"id":"INC-15390","date":"2024-10","year":2024,"title":"Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-6959"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6959"},{"id":"INC-15391","date":"2025-03","year":2025,"title":"Cross-site Scripting (XSS) in parisneo/lollms-webui","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-6986"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-6986"},{"id":"INC-15392","date":"2024-10","year":2024,"title":"Timing Attack in mudler/localai","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7010"],"affected":"mudler/mudler/localai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7010"},{"id":"INC-15393","date":"2024-10","year":2024,"title":"IDOR in open-webui/open-webui","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7048"],"affected":"open-webui/open-webui/open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7048"},{"id":"INC-15394","date":"2025-03","year":2025,"title":"Relative Path Traversal in parisneo/lollms-webui","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7058"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7058"},{"id":"INC-15395","date":"2024-07","year":2024,"title":"W&B Weave server remote arbitrary file leak and privilege escalation","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7340"],"affected":"weave","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7340"},{"id":"INC-15396","date":"2024-11","year":2024,"title":"SQL Injection in lunary-ai/lunary","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-7456"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7456"},{"id":"INC-15397","date":"2024-10","year":2024,"title":"Email Injection Vulnerability in lunary-ai/lunary","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7472"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7472"},{"id":"INC-15398","date":"2024-10","year":2024,"title":"IDOR Vulnerability in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7473"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7473"},{"id":"INC-15399","date":"2025-03","year":2025,"title":"Broken Access Control in lunary-ai/lunary","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7476"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7476"},{"id":"INC-15400","date":"2024-08","year":2024,"title":"Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7557"],"affected":"odh-dashboard, Red Hat/Red Hat OpenShift AI (RHOAI), Red Hat/Red Hat OpenShift Data Science (RHODS)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7557"},{"id":"INC-15401","date":"2025-03","year":2025,"title":"Improper Access Control in danswer-ai/danswer","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-7767"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7767"},{"id":"INC-15402","date":"2025-03","year":2025,"title":"Denial of Service in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7771"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7771"},{"id":"INC-15403","date":"2025-03","year":2025,"title":"ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7779"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7779"},{"id":"INC-15404","date":"2024-10","year":2024,"title":"Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-7783"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7783"},{"id":"INC-15405","date":"2024-10","year":2024,"title":"Denial of Service (DOS) in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-7807"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7807"},{"id":"INC-15406","date":"2025-03","year":2025,"title":"CORS Misconfiguration in danswer-ai/danswer","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-7819"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7819"},{"id":"INC-15407","date":"2024-10","year":2024,"title":"Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-7962"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-7962"},{"id":"INC-15408","date":"2025-03","year":2025,"title":"Cross-site Scripting (XSS) in open-webui/open-webui","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8017"],"affected":"open-webui/open-webui/open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8017"},{"id":"INC-15409","date":"2025-03","year":2025,"title":"Denial of Service in danswer-ai/danswer","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8028"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8028"},{"id":"INC-15410","date":"2025-03","year":2025,"title":"Stored XSS in imartinez/privategpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8029"],"affected":"imartinez/imartinez/privategpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8029"},{"id":"INC-15411","date":"2025-03","year":2025,"title":"Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8055"],"affected":"vanna-ai/vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8055"},{"id":"INC-15412","date":"2025-03","year":2025,"title":"Improper Access Control in danswer-ai/danswer","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-8057"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8057"},{"id":"INC-15413","date":"2025-03","year":2025,"title":"Server-Side Request Forgery (SSRF) in vanna-ai/vanna","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8099"],"affected":"vanna-ai/vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8099"},{"id":"INC-15414","date":"2025-03","year":2025,"title":"Stored XSS in aimhubio/aim","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8101"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8101"},{"id":"INC-15415","date":"2024-10","year":2024,"title":"Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8143"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8143"},{"id":"INC-15416","date":"2025-03","year":2025,"title":"Command Injection in significant-gravitas/autogpt","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8156"],"affected":"significant-gravitas/significant-gravitas/autogpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8156"},{"id":"INC-15417","date":"2025-03","year":2025,"title":"Missing Authentication for Critical Function in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8196"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8196"},{"id":"INC-15418","date":"2025-03","year":2025,"title":"Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8249"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8249"},{"id":"INC-15419","date":"2025-03","year":2025,"title":"Prisma Injection in mintplex-labs/anything-llm","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8251"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8251"},{"id":"INC-15420","date":"2025-03","year":2025,"title":"Stored XSS in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8400"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8400"},{"id":"INC-15421","date":"2025-03","year":2025,"title":"CSRF due to overly permissive CORS headers in modelscope/agentscope","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8489"],"affected":"modelscope/modelscope/agentscope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8489"},{"id":"INC-15422","date":"2025-03","year":2025,"title":"Path Traversal in parisneo/lollms-webui","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-8581"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8581"},{"id":"INC-15423","date":"2025-03","year":2025,"title":"Improper Access Control in gaizhenbiao/chuanhuchatgpt","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-8613"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8613"},{"id":"INC-15424","date":"2025-03","year":2025,"title":"Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8736"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8736"},{"id":"INC-15425","date":"2025-03","year":2025,"title":"Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8763"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8763"},{"id":"INC-15426","date":"2025-03","year":2025,"title":"Improper Authorization in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8764"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8764"},{"id":"INC-15427","date":"2025-03","year":2025,"title":"Improper Path Equivalence Resolution in lunary-ai/lunary","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8765"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8765"},{"id":"INC-15428","date":"2025-03","year":2025,"title":"Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8789"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8789"},{"id":"INC-15429","date":"2025-03","year":2025,"title":"Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-8998"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-8998"},{"id":"INC-15430","date":"2025-03","year":2025,"title":"Improper Authorization in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9095"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9095"},{"id":"INC-15431","date":"2025-03","year":2025,"title":"Improper Authorization in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9096"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9096"},{"id":"INC-15432","date":"2025-03","year":2025,"title":"Exposure of Private API Keys in lunary-ai/lunary","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9099"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9099"},{"id":"INC-15433","date":"2025-03","year":2025,"title":"Stored XSS in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9107"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9107"},{"id":"INC-15434","date":"2025-03","year":2025,"title":"Incorrect Authorization in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9159"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9159"},{"id":"INC-15435","date":"2025-03","year":2025,"title":"Authentication Bypass in gaizhenbiao/ChuanhuChatGPT","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9216"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9216"},{"id":"INC-15436","date":"2025-03","year":2025,"title":"Open Redirect in haotian-liu/llava","severity":"Medium","attack_vector":"phishing","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2024-9308"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9308"},{"id":"INC-15437","date":"2025-03","year":2025,"title":"SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2024-9309"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9309"},{"id":"INC-15438","date":"2025-03","year":2025,"title":"Cross-Site Request Forgery to XSS in haotian-liu/llava","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2024-9311"],"affected":"haotian-liu/haotian-liu/llava","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9311"},{"id":"INC-15439","date":"2025-03","year":2025,"title":"Path Traversal in transformeroptimus/superagi","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9415"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9415"},{"id":"INC-15440","date":"2025-03","year":2025,"title":"Insufficiently Protected Credentials in transformeroptimus/superagi","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9418"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9418"},{"id":"INC-15441","date":"2025-03","year":2025,"title":"Unauthenticated Denial of Service in transformeroptimus/superagi","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9437"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9437"},{"id":"INC-15442","date":"2025-03","year":2025,"title":"Exposure of Sensitive Information in transformeroptimus/superagi","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2024-9447"],"affected":"transformeroptimus/transformeroptimus/superagi","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9447"},{"id":"INC-15443","date":"2025-03","year":2025,"title":"Path Traversal in parisneo/lollms","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2024-9597"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9597"},{"id":"INC-15444","date":"2025-03","year":2025,"title":"Unauthorized Access in danswer-ai/danswer","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9612"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9612"},{"id":"INC-15445","date":"2025-03","year":2025,"title":"IDOR in danswer-ai/danswer","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2024-9617"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2024-9617"},{"id":"INC-15446","date":"2025-03","year":2025,"title":"Denial of Service in danswer-ai/danswer","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0182"],"affected":"danswer-ai/danswer-ai/danswer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0182"},{"id":"INC-15447","date":"2025-03","year":2025,"title":"Stored XSS in binary-husky/gpt_academic","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0183"],"affected":"binary-husky/binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0183"},{"id":"INC-15448","date":"2025-03","year":2025,"title":"Server-Side Request Forgery (SSRF) in langgenius/dify","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0184"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0184"},{"id":"INC-15449","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0189"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0189"},{"id":"INC-15450","date":"2025-03","year":2025,"title":"Denial of Service in aimhubio/aim","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0190"],"affected":"aimhubio/aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0190"},{"id":"INC-15451","date":"2025-03","year":2025,"title":"Denial of Service in gaizhenbiao/chuanhuchatgpt","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0191"],"affected":"gaizhenbiao/gaizhenbiao/chuanhuchatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0191"},{"id":"INC-15452","date":"2025-03","year":2025,"title":"Stored Cross-Site Scripting (XSS) in lunary-ai/lunary","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0281"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0281"},{"id":"INC-15453","date":"2025-03","year":2025,"title":"Arbitrary File Deletion in eosphoros-ai/DB-GPT","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-0452"],"affected":"eosphoros-ai/eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0452"},{"id":"INC-15454","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0739"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0739"},{"id":"INC-15455","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0740"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0740"},{"id":"INC-15456","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0741"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0741"},{"id":"INC-15457","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0742"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0742"},{"id":"INC-15458","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0743"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0743"},{"id":"INC-15459","date":"2025-01","year":2025,"title":"Improper Access Control vulnerability in EmbedAI","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-0745"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0745"},{"id":"INC-15460","date":"2025-01","year":2025,"title":"Reflected Cross-Site Scripting vulnerability in EmbedAI","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0746"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0746"},{"id":"INC-15461","date":"2025-01","year":2025,"title":"Stored Cross-Site vulnerability in EmbedAI","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-0747"],"affected":"EmbedAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-0747"},{"id":"INC-15462","date":"2025-09","year":2025,"title":"binary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-10236"],"affected":"binary-husky/gpt_academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10236"},{"id":"INC-15463","date":"2025-09","year":2025,"title":"1Panel-dev MaxKB debug deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-10433"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10433"},{"id":"INC-15464","date":"2025-09","year":2025,"title":"h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-10768"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10768"},{"id":"INC-15465","date":"2025-09","year":2025,"title":"h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-10769"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10769"},{"id":"INC-15466","date":"2025-09","year":2025,"title":"huggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-10772"],"affected":"huggingface/LeRobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-10772"},{"id":"INC-15467","date":"2025-09","year":2025,"title":"Tencent WeKnora test testEmbeddingModel server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11046"],"affected":"Tencent/WeKnora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11046"},{"id":"INC-15468","date":"2025-10","year":2025,"title":"win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11202"],"affected":"win-cli-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11202"},{"id":"INC-15469","date":"2025-10","year":2025,"title":"wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11490"],"affected":"wonderwhy-er/DesktopCommanderMCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11490"},{"id":"INC-15470","date":"2025-10","year":2025,"title":"wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-11491"],"affected":"wonderwhy-er/DesktopCommanderMCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11491"},{"id":"INC-15471","date":"2025-10","year":2025,"title":"User Enumeration via Distinct Error Messages in langgenius/dify-web","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-11750"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11750"},{"id":"INC-15472","date":"2025-10","year":2025,"title":"HTTP Desynchronisation in Vertex AI for certain third-party models","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-11915"],"affected":"Google Cloud/Vertex AI: Partner Models for MaaS, Google Cloud/Vertex AI: Open Models for MaaS, Google Cloud/Vertex AI:…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-11915"},{"id":"INC-15473","date":"2025-10","year":2025,"title":"Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12058"],"affected":"Keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12058"},{"id":"INC-15474","date":"2025-11","year":2025,"title":"evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-12489"],"affected":"evernote-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-12489"},{"id":"INC-15475","date":"2025-03","year":2025,"title":"Insufficient Patch Leading to DoS in parisneo/lollms-webui","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-1451"],"affected":"parisneo/parisneo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1451"},{"id":"INC-15476","date":"2025-12","year":2025,"title":"ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-14569"],"affected":"ggml-org/whisper.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-14569"},{"id":"INC-15477","date":"2026-04","year":2026,"title":"1Panel-dev MaxKB MdPreview chat.ts cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-15632"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-15632"},{"id":"INC-15478","date":"2025-06","year":2025,"title":"SQL Injection in run-llama/llama_index","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-1750"],"affected":"run-llama/run-llama/llama_index","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1750"},{"id":"INC-15479","date":"2025-03","year":2025,"title":"Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-1796"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-1796"},{"id":"INC-15480","date":"2025-05","year":2025,"title":"Visual Studio Code Security Feature Bypass Vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-21264"],"affected":"Microsoft/Microsoft Visual Studio Code CoPilot Chat Extension, Microsoft/Visual Studio Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-21264"},{"id":"INC-15481","date":"2025-03","year":2025,"title":"274056675 springboot-openai-chatgpt User submit improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-2320"],"affected":"274056675/springboot-openai-chatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2320"},{"id":"INC-15482","date":"2025-03","year":2025,"title":"274056675 springboot-openai-chatgpt addData logic error","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-2321"],"affected":"274056675/springboot-openai-chatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2321"},{"id":"INC-15483","date":"2025-03","year":2025,"title":"274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-2322"],"affected":"274056675/springboot-openai-chatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2322"},{"id":"INC-15484","date":"2025-03","year":2025,"title":"274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-2323"],"affected":"274056675/springboot-openai-chatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2323"},{"id":"INC-15485","date":"2025-03","year":2025,"title":"274056675 springboot-openai-chatgpt Chat History chat deleteChat access control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-2334"],"affected":"274056675/springboot-openai-chatgpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-2334"},{"id":"INC-15486","date":"2025-07","year":2025,"title":"WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-23968"],"affected":"WebFactory/AiBud WP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-23968"},{"id":"INC-15487","date":"2025-02","year":2025,"title":"Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-25282"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-25282"},{"id":"INC-15488","date":"2025-02","year":2025,"title":"RAGFlow SQL Injection vulnerability","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27135"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27135"},{"id":"INC-15489","date":"2025-03","year":2025,"title":"Applio allows SSRF and file write in model_download.py","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27774"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27774"},{"id":"INC-15490","date":"2025-03","year":2025,"title":"Applio allows SSRF and file write in model_download.py","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27776"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27776"},{"id":"INC-15491","date":"2025-03","year":2025,"title":"Applio allows SSRF and file write in model_download.py","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27777"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27777"},{"id":"INC-15492","date":"2025-03","year":2025,"title":"Applio allows unsafe deserialization in infer.py","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27778"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27778"},{"id":"INC-15493","date":"2025-03","year":2025,"title":"Applio allows unsafe deserialization in model_blender.py","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27779"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27779"},{"id":"INC-15494","date":"2025-03","year":2025,"title":"Applio allows arbitrary file write in train.py","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27783"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27783"},{"id":"INC-15495","date":"2025-03","year":2025,"title":"Applio allows arbitrary file read in train.py export_pth function","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27784"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27784"},{"id":"INC-15496","date":"2025-03","year":2025,"title":"Applio allows arbitrary file read in train.py export_index function","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-27785"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27785"},{"id":"INC-15497","date":"2025-03","year":2025,"title":"Applio allows arbitrary file removal in core.py","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-27786"],"affected":"IAHispano/Applio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-27786"},{"id":"INC-15498","date":"2025-09","year":2025,"title":"IBM Watson Studio on Cloud Pak for Data cross-site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-33116"],"affected":"IBM/Watson Studio on Cloud Pak for Data","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-33116"},{"id":"INC-15499","date":"2025-12","year":2025,"title":"NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-33211"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-33211"},{"id":"INC-15500","date":"2026-05","year":2026,"title":"NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-33255"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-33255"},{"id":"INC-15501","date":"2025-07","year":2025,"title":"XSS Vulnerability in langgenius/dify","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-3467"],"affected":"langgenius/langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3467"},{"id":"INC-15502","date":"2025-04","year":2025,"title":"lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-3677"],"affected":"lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-3677"},{"id":"INC-15503","date":"2025-07","year":2025,"title":"Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-45424"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-45424"},{"id":"INC-15504","date":"2025-05","year":2025,"title":"1Panel-dev MaxKB Knowledge Base Module csv injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-4546"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4546"},{"id":"INC-15505","date":"2025-07","year":2025,"title":"Stored Cross-site Scripting (XSS) in lunary-ai/lunary","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-4779"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4779"},{"id":"INC-15506","date":"2025-05","year":2025,"title":"RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account reg...","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48187"],"affected":"infiniflow/RAGFlow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48187"},{"id":"INC-15507","date":"2025-05","year":2025,"title":"CVAT has information disclosure via browsable API","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48381"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48381"},{"id":"INC-15508","date":"2025-06","year":2025,"title":"MaxKB Python Sandbox Bypass in Function Library","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-48950"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-48950"},{"id":"INC-15509","date":"2025-06","year":2025,"title":"CVAT missing validation for in-progress backup upload names","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-49135"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49135"},{"id":"INC-15510","date":"2025-08","year":2025,"title":"IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-4962"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-4962"},{"id":"INC-15511","date":"2025-10","year":2025,"title":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-49655"],"affected":"Keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-49655"},{"id":"INC-15512","date":"2025-08","year":2025,"title":"A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/model_merger.py script when using the \"fsdp\" backend.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50461"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50461"},{"id":"INC-15513","date":"2025-08","year":2025,"title":"The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` function of the `Mo...","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50472"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50472"},{"id":"INC-15514","date":"2025-11","year":2025,"title":"Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers ...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-50735"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-50735"},{"id":"INC-15515","date":"2026-05","year":2026,"title":"An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nne...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51427"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51427"},{"id":"INC-15516","date":"2025-07","year":2025,"title":"SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/...","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51458"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51458"},{"id":"INC-15517","date":"2025-07","year":2025,"title":"File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file ...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51459"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51459"},{"id":"INC-15518","date":"2025-07","year":2025,"title":"Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to ...","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51462"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51462"},{"id":"INC-15519","date":"2025-07","year":2025,"title":"Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the r...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51463"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51463"},{"id":"INC-15520","date":"2025-07","year":2025,"title":"Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/rep...","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51464"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51464"},{"id":"INC-15521","date":"2025-07","year":2025,"title":"Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent te...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-51472"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51472"},{"id":"INC-15522","date":"2025-07","year":2025,"title":"Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitise...","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51475"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51475"},{"id":"INC-15523","date":"2025-07","year":2025,"title":"Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-51482"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-51482"},{"id":"INC-15524","date":"2025-05","year":2025,"title":"aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-5321"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5321"},{"id":"INC-15525","date":"2025-08","year":2025,"title":"Environment Variable XSS in Analytics Component in lunary-ai/lunary","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-5352"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5352"},{"id":"INC-15526","date":"2025-07","year":2025,"title":"MaxKB sandbox bypass","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-53927"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53927"},{"id":"INC-15527","date":"2025-07","year":2025,"title":"MaxKB has RCE in MCP call","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-53928"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-53928"},{"id":"INC-15528","date":"2025-07","year":2025,"title":"CVAT vulnerable to email verification bypass by use of basic authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-54573"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-54573"},{"id":"INC-15529","date":"2025-08","year":2025,"title":"Unsafe symlink following in restricted workspace-write sandbox leads to RCE","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-55345"],"affected":"@openai/codex","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55345"},{"id":"INC-15530","date":"2026-05","year":2026,"title":"AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-55449"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-55449"},{"id":"INC-15531","date":"2025-09","year":2025,"title":"An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-56404"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-56404"},{"id":"INC-15532","date":"2025-09","year":2025,"title":"An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-56405"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-56405"},{"id":"INC-15533","date":"2025-09","year":2025,"title":"Deserialization Vulnerability in h2oai/h2o-3","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-5662"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-5662"},{"id":"INC-15534","date":"2025-10","year":2025,"title":"New API has Authenticated Server-Side Request Forgery (SSRF) issue","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59146"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59146"},{"id":"INC-15535","date":"2025-09","year":2025,"title":"feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a \"kubectl versio...","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59376"],"affected":"feiskyer/mcp-kubernetes-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59376"},{"id":"INC-15536","date":"2025-09","year":2025,"title":"feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used.","severity":"Low","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59377"],"affected":"feiskyer/mcp-kubernetes-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59377"},{"id":"INC-15537","date":"2025-09","year":2025,"title":"lobe-chat has an Open Redirect","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-59426"],"affected":"lobehub/lobe-chat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59426"},{"id":"INC-15538","date":"2026-09","year":2026,"title":"LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-59953"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-59953"},{"id":"INC-15539","date":"2025-09","year":2025,"title":"Improper Authorization in danny-avila/librechat","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-6088"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6088"},{"id":"INC-15540","date":"2025-06","year":2025,"title":"letta-ai letta interface.py function_message eval injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-6101"],"affected":"letta-ai/letta","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6101"},{"id":"INC-15541","date":"2026-01","year":2026,"title":"A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-61489"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-61489"},{"id":"INC-15542","date":"2025-11","year":2025,"title":"QuantumNous New API Has SSRF Bypass","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-62155"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62155"},{"id":"INC-15543","date":"2025-10","year":2025,"title":"SSRF in lobehub/lobe-chat with native web fetch module","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-62505"],"affected":"lobehub/lobe-chat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-62505"},{"id":"INC-15544","date":"2025-06","year":2025,"title":"TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6280"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6280"},{"id":"INC-15545","date":"2025-11","year":2025,"title":"A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_q...","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-63604"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-63604"},{"id":"INC-15546","date":"2025-11","year":2025,"title":"CVAT: Mounted share file overwrite via crafted request","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64485"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64485"},{"id":"INC-15547","date":"2025-11","year":2025,"title":"MaxKB has SSRF in sandbox","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-64511"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64511"},{"id":"INC-15548","date":"2025-11","year":2025,"title":"MaxKB has Information Leak in sandbox","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-64703"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-64703"},{"id":"INC-15549","date":"2025-09","year":2025,"title":"Deserialization of Untrusted Data in h2oai/h2o-3","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6507"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6507"},{"id":"INC-15550","date":"2025-09","year":2025,"title":"Deserialization Vulnerability in h2oai/h2o-3","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6544"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6544"},{"id":"INC-15551","date":"2025-12","year":2025,"title":"A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before.","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-65512"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-65512"},{"id":"INC-15552","date":"2025-12","year":2025,"title":"MaxKB vulnerable to privilege escalation through sandbox bypass","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-66419"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66419"},{"id":"INC-15553","date":"2025-12","year":2025,"title":"MaxKB has a Python sandbox LD_PRELOAD bypass","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-66446"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66446"},{"id":"INC-15554","date":"2026-09","year":2026,"title":"LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2025-66455"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-66455"},{"id":"INC-15555","date":"2025-06","year":2025,"title":"eosphoros-ai db-gpt import import_flow path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-6772"],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-6772"},{"id":"INC-15556","date":"2025-12","year":2025,"title":"CVAT vulnerable to directory traversal via mounted share listing","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-68430"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68430"},{"id":"INC-15557","date":"2026-01","year":2026,"title":"MindsDB has improper sanitation of filepath that leads to information disclosure and DOS","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-68472"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68472"},{"id":"INC-15558","date":"2025-12","year":2025,"title":"RAGFlow Remote Code Execution Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-68700"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-68700"},{"id":"INC-15559","date":"2026-07","year":2026,"title":"WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-69134"],"affected":"Merkulove/OpenAI Chatbot for WordPress – Helper","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69134"},{"id":"INC-15560","date":"2025-12","year":2025,"title":"RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-69286"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69286"},{"id":"INC-15561","date":"2026-03","year":2026,"title":"A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell m...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-69902"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-69902"},{"id":"INC-15562","date":"2026-03","year":2026,"title":"An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2025-70040"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-70040"},{"id":"INC-15563","date":"2025-09","year":2025,"title":"Mass Assignment in danny-avila/librechat","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-7104"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7104"},{"id":"INC-15564","date":"2026-02","year":2026,"title":"Denial of Service via JavaScript Memory Overflow in danny-avila/librechat","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-7105"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7105"},{"id":"INC-15565","date":"2025-09","year":2025,"title":"Authorization Bypass due to Incorrect Access Control in danny-avila/librechat","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-7106"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-7106"},{"id":"INC-15566","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via Incomplete Disallowed Inputs","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71320"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71320"},{"id":"INC-15567","date":"2026-06","year":2026,"title":"picklescan - Arbitrary File Writing via distutils Module Bypass","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71321"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71321"},{"id":"INC-15568","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via Unblocked ctypes Module","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71323"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71323"},{"id":"INC-15569","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via Undetected profile.Profile.runctx","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71341"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71341"},{"id":"INC-15570","date":"2026-07","year":2026,"title":"picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71342"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71342"},{"id":"INC-15571","date":"2026-07","year":2026,"title":"picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71343"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71343"},{"id":"INC-15572","date":"2026-07","year":2026,"title":"picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71345"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71345"},{"id":"INC-15573","date":"2026-07","year":2026,"title":"picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71347"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71347"},{"id":"INC-15574","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected trace.Trace.run in Pickle Files","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71349"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71349"},{"id":"INC-15575","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Files","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71352"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71352"},{"id":"INC-15576","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-71357"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71357"},{"id":"INC-15577","date":"2026-07","year":2026,"title":"picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71359"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71359"},{"id":"INC-15578","date":"2026-07","year":2026,"title":"picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-71360"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71360"},{"id":"INC-15579","date":"2026-07","year":2026,"title":"picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71362"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71362"},{"id":"INC-15580","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71363"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71363"},{"id":"INC-15581","date":"2026-07","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71364"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71364"},{"id":"INC-15582","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71365"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71365"},{"id":"INC-15583","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected doctest.debug_script","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71368"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71368"},{"id":"INC-15584","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71371"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71371"},{"id":"INC-15585","date":"2026-07","year":2026,"title":"Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71372"],"affected":"Picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71372"},{"id":"INC-15586","date":"2026-07","year":2026,"title":"picklescan - Remote Code Execution via operator.methodcaller Detection Bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71373"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71373"},{"id":"INC-15587","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected profile.Profile.run","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71374"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71374"},{"id":"INC-15588","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completions","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71376"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71376"},{"id":"INC-15589","date":"2026-06","year":2026,"title":"picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-71378"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71378"},{"id":"INC-15590","date":"2026-10","year":2026,"title":"Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2025-71427"],"affected":"GongRzhe/Office-PowerPoint-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-71427"},{"id":"INC-15591","date":"2025-10","year":2025,"title":"HTML Injection in Accept-Language Header in danny-avila/librechat","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-8848"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8848"},{"id":"INC-15592","date":"2025-10","year":2025,"title":"Insecure API Design in danny-avila/librechat","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2025-8850"],"affected":"danny-avila/danny-avila/librechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-8850"},{"id":"INC-15593","date":"2025-11","year":2025,"title":"Improper Authentication in lunary-ai/lunary","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2025-9803"],"affected":"lunary-ai/lunary-ai/lunary","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9803"},{"id":"INC-15594","date":"2025-09","year":2025,"title":"Arbitrary Code execution in Keras Safe Mode","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2025-9906"],"affected":"Keras-team/Keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2025-9906"},{"id":"INC-15595","date":"2026-03","year":2026,"title":"Unauthenticated File Upload in parisneo/lollms","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-0558"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0558"},{"id":"INC-15596","date":"2026-03","year":2026,"title":"Server-Side Request Forgery (SSRF) in parisneo/lollms","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0560"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0560"},{"id":"INC-15597","date":"2026-03","year":2026,"title":"Insecure Direct Object Reference (IDOR) in parisneo/lollms","severity":"High","attack_vector":"privacy-violation","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-0562"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0562"},{"id":"INC-15598","date":"2026-01","year":2026,"title":"github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0756"],"affected":"github-kanban-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0756"},{"id":"INC-15599","date":"2026-01","year":2026,"title":"mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0758"],"affected":"mcp-server-siri-shortcuts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0758"},{"id":"INC-15600","date":"2026-01","year":2026,"title":"GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0762"],"affected":"GPT Academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0762"},{"id":"INC-15601","date":"2026-01","year":2026,"title":"GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0763"],"affected":"GPT Academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0763"},{"id":"INC-15602","date":"2026-01","year":2026,"title":"GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-0764"],"affected":"GPT Academic","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-0764"},{"id":"INC-15603","date":"2026-09","year":2026,"title":"GluonTS arbitrary command execution during model deserialization","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100308"],"affected":"AWS/gluonts","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100308"},{"id":"INC-15604","date":"2026-09","year":2026,"title":"OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100525"],"affected":"openclaw/diagnostics-prometheus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100525"},{"id":"INC-15605","date":"2026-09","year":2026,"title":"Vulnerability in discord","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100526"],"affected":"openclaw/discord","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100526"},{"id":"INC-15606","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.2 Denial of Service via Browser Relay","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100527"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100527"},{"id":"INC-15607","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100528"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100528"},{"id":"INC-15608","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100529"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100529"},{"id":"INC-15609","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Exec Approval Directory Binding","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100530"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100530"},{"id":"INC-15610","date":"2026-09","year":2026,"title":"openclaw Slack before 2026.8.1 Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100531"],"affected":"openclaw/slack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100531"},{"id":"INC-15611","date":"2026-09","year":2026,"title":"openclaw WhatsApp before 2026.8.1 Authentication Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100532"],"affected":"openclaw/whatsapp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100532"},{"id":"INC-15612","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100533"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100533"},{"id":"INC-15613","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100534"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100534"},{"id":"INC-15614","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Privilege Escalation via Session Memory","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100535"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100535"},{"id":"INC-15615","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Path Traversal via Structured Attachments","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100536"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100536"},{"id":"INC-15616","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authentication Bypass via Active Memory","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100537"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100537"},{"id":"INC-15617","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Local File Read via Outbound Attachments","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100538"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100538"},{"id":"INC-15618","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Memory Access Control Bypass","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100539"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100539"},{"id":"INC-15619","date":"2026-09","year":2026,"title":"OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100540"],"affected":"openclaw/feishu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100540"},{"id":"INC-15620","date":"2026-09","year":2026,"title":"OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100541"],"affected":"openclaw/matrix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100541"},{"id":"INC-15621","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2","severity":"Low","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100542"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100542"},{"id":"INC-15622","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100543"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100543"},{"id":"INC-15623","date":"2026-09","year":2026,"title":"openclaw voice-call before 2026.8.1 Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100544"],"affected":"openclaw/voice-call","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100544"},{"id":"INC-15624","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100545"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100545"},{"id":"INC-15625","date":"2026-09","year":2026,"title":"OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100546"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100546"},{"id":"INC-15626","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authentication Bypass via File URL","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100547"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100547"},{"id":"INC-15627","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100548"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100548"},{"id":"INC-15628","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100549"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100549"},{"id":"INC-15629","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authentication Bypass via Access Group","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100550"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100550"},{"id":"INC-15630","date":"2026-09","year":2026,"title":"OpenClaw iOS Control UI TLS Pin Enforcement Bypass","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100551"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100551"},{"id":"INC-15631","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Policy Bypass via Native Tools","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100552"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100552"},{"id":"INC-15632","date":"2026-09","year":2026,"title":"OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100553"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100553"},{"id":"INC-15633","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100554"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100554"},{"id":"INC-15634","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100555"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100555"},{"id":"INC-15635","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authentication Bypass via Session Reset","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100556"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100556"},{"id":"INC-15636","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100557"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100557"},{"id":"INC-15637","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100558"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100558"},{"id":"INC-15638","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Command Injection via Escaped Newlines","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100559"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100559"},{"id":"INC-15639","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100560"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100560"},{"id":"INC-15640","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100561"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100561"},{"id":"INC-15641","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Authorization Bypass via sessions.create","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100562"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100562"},{"id":"INC-15642","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100563"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100563"},{"id":"INC-15643","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100564"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100564"},{"id":"INC-15644","date":"2026-09","year":2026,"title":"OpenClaw LINE before 2026.8.1 Access Control Inheritance","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100566"],"affected":"openclaw/line","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100566"},{"id":"INC-15645","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100567"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100567"},{"id":"INC-15646","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Unauthorized Command Job Access","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100568"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100568"},{"id":"INC-15647","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100569"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100569"},{"id":"INC-15648","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100570"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100570"},{"id":"INC-15649","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100571"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100571"},{"id":"INC-15650","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Denial of Service via Rate Limit","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100572"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100572"},{"id":"INC-15651","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100573"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100573"},{"id":"INC-15652","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100574"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100574"},{"id":"INC-15653","date":"2026-09","year":2026,"title":"OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100575"],"affected":"openclaw/slack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100575"},{"id":"INC-15654","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100576"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100576"},{"id":"INC-15655","date":"2026-09","year":2026,"title":"OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100577"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100577"},{"id":"INC-15656","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via chat.send","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100578"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100578"},{"id":"INC-15657","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100579"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100579"},{"id":"INC-15658","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Remote Code Execution via cron tool","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100580"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100580"},{"id":"INC-15659","date":"2026-09","year":2026,"title":"OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100581"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100581"},{"id":"INC-15660","date":"2026-09","year":2026,"title":"OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100582"],"affected":"openclaw/msteams, openclaw/feishu, openclaw/matrix, openclaw/googlechat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100582"},{"id":"INC-15661","date":"2026-09","year":2026,"title":"OpenClaw Discord before 2026.7.1 Authorization Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100583"],"affected":"openclaw/discord","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100583"},{"id":"INC-15662","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100584"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100584"},{"id":"INC-15663","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100585"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100585"},{"id":"INC-15664","date":"2026-09","year":2026,"title":"OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100586"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100586"},{"id":"INC-15665","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via Codex Install","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100587"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100587"},{"id":"INC-15666","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via node.invoke","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100588"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100588"},{"id":"INC-15667","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100589"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100589"},{"id":"INC-15668","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via voice set","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100590"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100590"},{"id":"INC-15669","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via Active Memory","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100591"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100591"},{"id":"INC-15670","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100592"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100592"},{"id":"INC-15671","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authentication Bypass via activation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100593"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100593"},{"id":"INC-15672","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via trajectory export","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100594"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100594"},{"id":"INC-15673","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via diagnostics","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100595"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100595"},{"id":"INC-15674","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100596"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100596"},{"id":"INC-15675","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Path Traversal via Filesystem Race","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100597"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100597"},{"id":"INC-15676","date":"2026-09","year":2026,"title":"OpenClaw before 2026.7.1 Approval Binding Logic Error","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100598"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100598"},{"id":"INC-15677","date":"2026-09","year":2026,"title":"OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100599"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100599"},{"id":"INC-15678","date":"2026-09","year":2026,"title":"ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100600"],"affected":"openclaw/clawhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100600"},{"id":"INC-15679","date":"2026-09","year":2026,"title":"ClawHub SSRF via Unchecked DNS Resolution in Profile Image","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-100601"],"affected":"openclaw/clawhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100601"},{"id":"INC-15680","date":"2026-09","year":2026,"title":"ClawHub Changelog Preview Information Disclosure via Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100602"],"affected":"openclaw/clawhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100602"},{"id":"INC-15681","date":"2026-09","year":2026,"title":"ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100603"],"affected":"openclaw/clawhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100603"},{"id":"INC-15682","date":"2026-09","year":2026,"title":"ClawHub Authentication Bypass via Former Publisher Skill Control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100604"],"affected":"openclaw/clawhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100604"},{"id":"INC-15683","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Missing Authorization via Chat Message Routes","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100605"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100605"},{"id":"INC-15684","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Authentication Bypass via SSO Email Match","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100606"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100606"},{"id":"INC-15685","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Authentication Bypass via Email-Only SSO","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100607"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100607"},{"id":"INC-15686","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100608"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100608"},{"id":"INC-15687","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Insecure Direct Object Reference via Credential","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100609"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100609"},{"id":"INC-15688","date":"2026-09","year":2026,"title":"Flowise through 3.1.4 Missing Authorization via upsert-history","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-100610"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100610"},{"id":"INC-15689","date":"2026-09","year":2026,"title":"SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100633"],"affected":"siyuan-note/siyuan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100633"},{"id":"INC-15690","date":"2026-09","year":2026,"title":"vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100647"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100647"},{"id":"INC-15691","date":"2026-09","year":2026,"title":"vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100648"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100648"},{"id":"INC-15692","date":"2026-09","year":2026,"title":"vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100649"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100649"},{"id":"INC-15693","date":"2026-09","year":2026,"title":"vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-100650"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100650"},{"id":"INC-15694","date":"2026-09","year":2026,"title":"vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100651"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100651"},{"id":"INC-15695","date":"2026-09","year":2026,"title":"vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100652"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100652"},{"id":"INC-15696","date":"2026-09","year":2026,"title":"vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-100653"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100653"},{"id":"INC-15697","date":"2026-09","year":2026,"title":"vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100654"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100654"},{"id":"INC-15698","date":"2026-09","year":2026,"title":"Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-100868"],"affected":"penpot, penpot/@penpot/mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-100868"},{"id":"INC-15699","date":"2026-09","year":2026,"title":"utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-101057"],"affected":"universal-tool-calling-protocol/python-utcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101057"},{"id":"INC-15700","date":"2026-09","year":2026,"title":"Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101062"],"affected":"obot-platform/obot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101062"},{"id":"INC-15701","date":"2026-09","year":2026,"title":"Obot before v0.23.0 Server-Side Request Forgery via MCP","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-101064"],"affected":"obot-platform/obot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101064"},{"id":"INC-15702","date":"2026-09","year":2026,"title":"Obot Quickstart Docker Deployment Unauthenticated Admin Access","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101065"],"affected":"obot-platform/obot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101065"},{"id":"INC-15703","date":"2026-09","year":2026,"title":"deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101078"],"affected":"deepseek-ai/deepseek-harness","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101078"},{"id":"INC-15704","date":"2026-09","year":2026,"title":"Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101080"],"affected":"Tencent/AI-Infra-Guard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101080"},{"id":"INC-15705","date":"2026-09","year":2026,"title":"deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101102"],"affected":"deepseek-ai/deepseek-harness","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101102"},{"id":"INC-15706","date":"2026-09","year":2026,"title":"deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101131"],"affected":"deepseek-ai/deepseek-harness","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101131"},{"id":"INC-15707","date":"2026-09","year":2026,"title":"DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101132"],"affected":"DeepSeek/deepseek-harness","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101132"},{"id":"INC-15708","date":"2026-08","year":2026,"title":"Langflow is affected by weaknesses in secret handling and sensitive configuration access","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10128"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10128"},{"id":"INC-15709","date":"2026-09","year":2026,"title":"Langflow Code Execution via eval() in Component Input Schema","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101861"],"affected":"langflow-ai/langflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101861"},{"id":"INC-15710","date":"2026-09","year":2026,"title":"OpenClaw Windows Node before 2026.7.1-3 Missing Authorization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101879"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101879"},{"id":"INC-15711","date":"2026-09","year":2026,"title":"OpenClaw Windows Node before 2026.7.1 Authorization Bypass","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101880"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101880"},{"id":"INC-15712","date":"2026-09","year":2026,"title":"OpenClaw Windows Node before 2026.7.1 Denial of Service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-101881"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101881"},{"id":"INC-15713","date":"2026-09","year":2026,"title":"OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101882"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101882"},{"id":"INC-15714","date":"2026-09","year":2026,"title":"OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101883"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101883"},{"id":"INC-15715","date":"2026-09","year":2026,"title":"OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-101884"],"affected":"OpenClaw/OpenClaw Windows Node","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-101884"},{"id":"INC-15716","date":"2026-06","year":2026,"title":"AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10210"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10210"},{"id":"INC-15717","date":"2026-06","year":2026,"title":"AstrBotDevs AstrBot fs.py _normalize_rw_path authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10211"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10211"},{"id":"INC-15718","date":"2026-06","year":2026,"title":"AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10212"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10212"},{"id":"INC-15719","date":"2026-06","year":2026,"title":"AstrBotDevs AstrBot API Endpoint delete path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10213"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10213"},{"id":"INC-15720","date":"2026-06","year":2026,"title":"NousResearch hermes-agent skills_tool.py skill_view injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10220"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10220"},{"id":"INC-15721","date":"2026-06","year":2026,"title":"NousResearch hermes-agent run_agent.py _compress_context injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10221"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10221"},{"id":"INC-15722","date":"2026-06","year":2026,"title":"NousResearch hermes-agent config.py _sanitize_env_lines injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10222"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10222"},{"id":"INC-15723","date":"2026-06","year":2026,"title":"NousResearch hermes-agent memory_tool.py _scan_memory_content injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10223"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10223"},{"id":"INC-15724","date":"2026-06","year":2026,"title":"NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10224"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10224"},{"id":"INC-15725","date":"2026-09","year":2026,"title":"Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-102242"],"affected":"Google/MCP Toolbox for Databases","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102242"},{"id":"INC-15726","date":"2026-09","year":2026,"title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-102437"],"affected":"esengine/DeepSeek-Reasonix","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102437"},{"id":"INC-15727","date":"2026-09","year":2026,"title":"SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-102634"],"affected":"sgl-project/sglang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102634"},{"id":"INC-15728","date":"2026-06","year":2026,"title":"lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10264"],"affected":"lharries/whatsapp-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10264"},{"id":"INC-15729","date":"2026-06","year":2026,"title":"decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10269"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10269"},{"id":"INC-15730","date":"2026-09","year":2026,"title":"Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-102697"],"affected":"ollama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102697"},{"id":"INC-15731","date":"2026-06","year":2026,"title":"indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10274"],"affected":"indrasishbanerjee/aem-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10274"},{"id":"INC-15732","date":"2026-06","year":2026,"title":"hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10276"],"affected":"hekmon8/Jenkins-server-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10276"},{"id":"INC-15733","date":"2026-06","year":2026,"title":"j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10277"],"affected":"j3k0/mcp-google-workspace","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10277"},{"id":"INC-15734","date":"2026-06","year":2026,"title":"ishayoyo excel-mcp read_file/write_file index.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10278"],"affected":"ishayoyo/excel-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10278"},{"id":"INC-15735","date":"2026-06","year":2026,"title":"hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10279"],"affected":"hiraishikentaro/wezterm-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10279"},{"id":"INC-15736","date":"2026-09","year":2026,"title":"OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-102806"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102806"},{"id":"INC-15737","date":"2026-09","year":2026,"title":"OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-102807"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102807"},{"id":"INC-15738","date":"2026-09","year":2026,"title":"mcp-chrome-bridge through 1.0.31 CORS Origin Bypass","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-102878"],"affected":"hangwin/mcp-chrome-bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102878"},{"id":"INC-15739","date":"2026-09","year":2026,"title":"0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-102906"],"affected":"0xshariq/github-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102906"},{"id":"INC-15740","date":"2026-09","year":2026,"title":"zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-102911"],"affected":"zosmaai/pi-llm-wiki","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-102911"},{"id":"INC-15741","date":"2026-06","year":2026,"title":"ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10298"],"affected":"ggml-org/whisper.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10298"},{"id":"INC-15742","date":"2026-09","year":2026,"title":"Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise...","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103012"],"affected":"Anthropic/@anthropic-ai/claude-code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103012"},{"id":"INC-15743","date":"2026-10","year":2026,"title":"WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103068"],"affected":"ByteCore Stack/ByteCoreStack &#8211; MCP Connector for AI Tools","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103068"},{"id":"INC-15744","date":"2026-09","year":2026,"title":"vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103241"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103241"},{"id":"INC-15745","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103245"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103245"},{"id":"INC-15746","date":"2026-10","year":2026,"title":"n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103246"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103246"},{"id":"INC-15747","date":"2026-10","year":2026,"title":"n8n before 1.123.80 Credential Tampering via Duplicate Node IDs","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103247"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103247"},{"id":"INC-15748","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103248"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103248"},{"id":"INC-15749","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103249"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103249"},{"id":"INC-15750","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103250"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103250"},{"id":"INC-15751","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103251"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103251"},{"id":"INC-15752","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103252"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103252"},{"id":"INC-15753","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-103253"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103253"},{"id":"INC-15754","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103254"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103254"},{"id":"INC-15755","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103255"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103255"},{"id":"INC-15756","date":"2026-10","year":2026,"title":"n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103256"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103256"},{"id":"INC-15757","date":"2026-10","year":2026,"title":"n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-103257"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103257"},{"id":"INC-15758","date":"2026-10","year":2026,"title":"n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103258"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103258"},{"id":"INC-15759","date":"2026-10","year":2026,"title":"n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103259"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103259"},{"id":"INC-15760","date":"2026-10","year":2026,"title":"n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-103260"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103260"},{"id":"INC-15761","date":"2026-10","year":2026,"title":"pgvector buffer overflow in IVFFlat index build","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103484"],"affected":"pgvector","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103484"},{"id":"INC-15762","date":"2026-09","year":2026,"title":"decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-103530"],"affected":"decolua/9Router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103530"},{"id":"INC-15763","date":"2026-10","year":2026,"title":"Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-103758"],"affected":"obot-platform/obot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-103758"},{"id":"INC-15764","date":"2026-10","year":2026,"title":"OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-104019"],"affected":"AWS/sagemaker-distribution","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-104019"},{"id":"INC-15765","date":"2026-10","year":2026,"title":"modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-104120"],"affected":"modelcontextprotocol/mcp-server-fetch, modelcontextprotocol/mcp-server-everything","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-104120"},{"id":"INC-15766","date":"2026-10","year":2026,"title":"Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-104433"],"affected":"kvcache-ai/Mooncake","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-104433"},{"id":"INC-15767","date":"2026-10","year":2026,"title":"LangGraph SDK custom auth silently ignores actions= on resource decorators","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-104873"],"affected":"langchain-ai/langgraph","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-104873"},{"id":"INC-15768","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10547"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10547"},{"id":"INC-15769","date":"2026-06","year":2026,"title":"NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10548"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10548"},{"id":"INC-15770","date":"2026-08","year":2026,"title":"Path Traversal Vulnerability in parisneo/lollms","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10595"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10595"},{"id":"INC-15771","date":"2026-06","year":2026,"title":"ahujasid blender-mcp server.py open injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10661"],"affected":"ahujasid/blender-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10661"},{"id":"INC-15772","date":"2026-06","year":2026,"title":"ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10662"],"affected":"ahujasid/blender-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10662"},{"id":"INC-15773","date":"2026-06","year":2026,"title":"ahujasid blender-mcp server.py execute_blender_code code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10688"],"affected":"ahujasid/blender-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10688"},{"id":"INC-15774","date":"2026-06","year":2026,"title":"wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-10690"],"affected":"wonderwhy-er/DesktopCommanderMCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10690"},{"id":"INC-15775","date":"2026-06","year":2026,"title":"wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10691"],"affected":"wonderwhy-er/DesktopCommanderMCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10691"},{"id":"INC-15776","date":"2026-06","year":2026,"title":"johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10692"],"affected":"johnhuang316/code-index-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10692"},{"id":"INC-15777","date":"2026-07","year":2026,"title":"Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-10700"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10700"},{"id":"INC-15778","date":"2026-06","year":2026,"title":"PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10800"],"affected":"PaddlePaddle/FastDeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10800"},{"id":"INC-15779","date":"2026-06","year":2026,"title":"modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-10801"],"affected":"modelscope/ms-swift","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-10801"},{"id":"INC-15780","date":"2026-04","year":2026,"title":"Improper Access Control via Weak JWT Token in parisneo/lollms","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-1114"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1114"},{"id":"INC-15781","date":"2026-04","year":2026,"title":"Cross-site Scripting (XSS) in parisneo/lollms","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-1116"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1116"},{"id":"INC-15782","date":"2026-06","year":2026,"title":"Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-11322"],"affected":"nesquena/Hermes WebUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11322"},{"id":"INC-15783","date":"2026-07","year":2026,"title":"BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-11371"],"affected":"Unknown/BetterDocs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11371"},{"id":"INC-15784","date":"2026-06","year":2026,"title":"NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11461"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11461"},{"id":"INC-15785","date":"2026-06","year":2026,"title":"designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-11529"],"affected":"designcomputer/mysql-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11529"},{"id":"INC-15786","date":"2026-06","year":2026,"title":"An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-11717"],"affected":"Google/MCP Toolbox for Databases (googleapis/mcp-toolbox)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11717"},{"id":"INC-15787","date":"2026-06","year":2026,"title":"An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-11718"],"affected":"Google/MCP Toolbox for Databases (googleapis/mcp-toolbox)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11718"},{"id":"INC-15788","date":"2026-06","year":2026,"title":"Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-11720"],"affected":"Google/MCP Toolbox for Databases (googleapis/mcp-toolbox)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11720"},{"id":"INC-15789","date":"2026-07","year":2026,"title":"Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-11876"],"affected":"zenml-io/zenml-io/zenml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11876"},{"id":"INC-15790","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-11918"],"affected":"IBM/ContextForge MCP Gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11918"},{"id":"INC-15791","date":"2026-07","year":2026,"title":"Rate-limit Bypass in zenml-io/zenml","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-11922"],"affected":"zenml-io/zenml-io/zenml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-11922"},{"id":"INC-15792","date":"2026-07","year":2026,"title":"Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12228"],"affected":"parisneo/parisneo/lollms","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12228"},{"id":"INC-15793","date":"2026-08","year":2026,"title":"Improper Access Control in nltk/nltk","severity":"Medium","attack_vector":"model-poisoning","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12261"],"affected":"nltk/nltk/nltk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12261"},{"id":"INC-15794","date":"2026-06","year":2026,"title":"Path Traversal in keras-team/keras","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12479"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12479"},{"id":"INC-15795","date":"2026-07","year":2026,"title":"Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM05"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-12480"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12480"},{"id":"INC-15796","date":"2026-07","year":2026,"title":"Deserialization of Untrusted Data in keras-team/keras","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12481"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12481"},{"id":"INC-15797","date":"2026-07","year":2026,"title":"Path Traversal via Symlink Name Validation Bypass in keras-team/keras","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12482"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12482"},{"id":"INC-15798","date":"2026-07","year":2026,"title":"Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12484"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12484"},{"id":"INC-15799","date":"2026-08","year":2026,"title":"Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12570"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12570"},{"id":"INC-15800","date":"2026-09","year":2026,"title":"Langflow is vulnerable to authentication bypass and insufficient session expiration","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12763"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12763"},{"id":"INC-15801","date":"2026-09","year":2026,"title":"Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12765"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12765"},{"id":"INC-15802","date":"2026-09","year":2026,"title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12766"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12766"},{"id":"INC-15803","date":"2026-09","year":2026,"title":"Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12767"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12767"},{"id":"INC-15804","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12940"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12940"},{"id":"INC-15805","date":"2026-07","year":2026,"title":"Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-12942"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12942"},{"id":"INC-15806","date":"2026-09","year":2026,"title":"Incomplete Security Scanner Blocklist Enables Network-Based Code Execution","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-12944"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12944"},{"id":"INC-15807","date":"2026-07","year":2026,"title":"Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-12945"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12945"},{"id":"INC-15808","date":"2026-07","year":2026,"title":"Remote Code Execution in CUGA Component CodeAgent","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-12946"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-12946"},{"id":"INC-15809","date":"2026-07","year":2026,"title":"OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-13233"],"affected":"Drupal/OpenAI Provider","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13233"},{"id":"INC-15810","date":"2026-07","year":2026,"title":"Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-13341"],"affected":"KongHQ/mcp-konnect","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13341"},{"id":"INC-15811","date":"2026-07","year":2026,"title":"Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-13435"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13435"},{"id":"INC-15812","date":"2026-07","year":2026,"title":"Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-13442"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13442"},{"id":"INC-15813","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpo...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-13444"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13444"},{"id":"INC-15814","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpo...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-13445"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13445"},{"id":"INC-15815","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpo...","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-13446"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13446"},{"id":"INC-15816","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpo...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-13448"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13448"},{"id":"INC-15817","date":"2026-09","year":2026,"title":"Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOME","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-13745"],"affected":"Google Cloud/Gemini CLI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-13745"},{"id":"INC-15818","date":"2026-09","year":2026,"title":"Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14470"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14470"},{"id":"INC-15819","date":"2026-07","year":2026,"title":"Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14471"],"affected":"AWS/MCP Gateway & Registry","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14471"},{"id":"INC-15820","date":"2026-07","year":2026,"title":"Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpo...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14499"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14499"},{"id":"INC-15821","date":"2026-07","year":2026,"title":"Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14537"],"affected":"Google/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14537"},{"id":"INC-15822","date":"2026-07","year":2026,"title":"BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-14538"],"affected":"Google/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14538"},{"id":"INC-15823","date":"2026-07","year":2026,"title":"Denial of Service via Unrestricted Payload Buffering in MCP Toolbox","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14539"],"affected":"Google/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14539"},{"id":"INC-15824","date":"2026-07","year":2026,"title":"Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14540"],"affected":"Google/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14540"},{"id":"INC-15825","date":"2026-07","year":2026,"title":"Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-14541"],"affected":"Google/mcp-toolbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14541"},{"id":"INC-15826","date":"2026-07","year":2026,"title":"NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14617"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14617"},{"id":"INC-15827","date":"2026-07","year":2026,"title":"NousResearch hermes-agent server.py shell.exec protection mechanism","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14625"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14625"},{"id":"INC-15828","date":"2026-07","year":2026,"title":"NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14626"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14626"},{"id":"INC-15829","date":"2026-07","year":2026,"title":"NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-14627"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14627"},{"id":"INC-15830","date":"2026-07","year":2026,"title":"NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14628"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14628"},{"id":"INC-15831","date":"2026-07","year":2026,"title":"ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14630"],"affected":"ForceInjection/AI-fundermentals","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14630"},{"id":"INC-15832","date":"2026-07","year":2026,"title":"onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14647"],"affected":"onnx","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14647"},{"id":"INC-15833","date":"2026-07","year":2026,"title":"zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14699"],"affected":"zcaceres/markdownify-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14699"},{"id":"INC-15834","date":"2026-07","year":2026,"title":"zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14702"],"affected":"zcaceres/markdownify-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14702"},{"id":"INC-15835","date":"2026-07","year":2026,"title":"zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-14714"],"affected":"zhayujie/chatgpt-on-wechat CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14714"},{"id":"INC-15836","date":"2026-07","year":2026,"title":"langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-14742"],"affected":"langchain-ai/langgraph","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14742"},{"id":"INC-15837","date":"2026-07","year":2026,"title":"AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14748"],"affected":"AIAnytime/Awesome-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14748"},{"id":"INC-15838","date":"2026-07","year":2026,"title":"NousResearch hermes-agent skills_tool.py skill_view path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14783"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14783"},{"id":"INC-15839","date":"2026-07","year":2026,"title":"terraform-mcp-server vulnerable to server side request forgery leading to token exposure","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14869"],"affected":"HashiCorp/Tooling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14869"},{"id":"INC-15840","date":"2026-07","year":2026,"title":"CVE-2026-14890","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-14890"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14890"},{"id":"INC-15841","date":"2026-07","year":2026,"title":"The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses.","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-14898"],"affected":"OpenAI/Codex desktop app for macOS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-14898"},{"id":"INC-15842","date":"2026-07","year":2026,"title":"bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15035"],"affected":"bentoml/OpenLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15035"},{"id":"INC-15843","date":"2026-07","year":2026,"title":"tumf mcp-text-editor text_editor.py _validate_file_path path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15138"],"affected":"tumf/mcp-text-editor","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15138"},{"id":"INC-15844","date":"2026-07","year":2026,"title":"aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15189"],"affected":"aerostackdev/aerostack-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15189"},{"id":"INC-15845","date":"2026-07","year":2026,"title":"AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15193"],"affected":"AidanPark/openclaw-android","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15193"},{"id":"INC-15846","date":"2026-07","year":2026,"title":"NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15311"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15311"},{"id":"INC-15847","date":"2026-07","year":2026,"title":"zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-15329"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15329"},{"id":"INC-15848","date":"2026-07","year":2026,"title":"zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15330"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15330"},{"id":"INC-15849","date":"2026-07","year":2026,"title":"zhayujie CowAgent Skill Installation service.py _add_package path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15331"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15331"},{"id":"INC-15850","date":"2026-07","year":2026,"title":"zhayujie CowAgent Message Endpoint channel.py authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15332"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15332"},{"id":"INC-15851","date":"2026-07","year":2026,"title":"Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15415"],"affected":"AWS/aws-healthomics-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15415"},{"id":"INC-15852","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-15499"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15499"},{"id":"INC-15853","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15500"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15500"},{"id":"INC-15854","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15501"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15501"},{"id":"INC-15855","date":"2026-07","year":2026,"title":"makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15521"],"affected":"makafeli/n8n-workflow-builder","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15521"},{"id":"INC-15856","date":"2026-07","year":2026,"title":"tugcantopaloglu godot-mcp run_project index.js validatePath path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15522"],"affected":"tugcantopaloglu/godot-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15522"},{"id":"INC-15857","date":"2026-07","year":2026,"title":"alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15524"],"affected":"alioshr/memory-bank-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15524"},{"id":"INC-15858","date":"2026-07","year":2026,"title":"augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15526"],"affected":"augmnt/augments-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15526"},{"id":"INC-15859","date":"2026-07","year":2026,"title":"lamaalrajih kicad-mcp path_validator.py protection mechanism","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15528"],"affected":"lamaalrajih/kicad-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15528"},{"id":"INC-15860","date":"2026-07","year":2026,"title":"yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15531"],"affected":"yashbhalgat/HashNeRF-pytorch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15531"},{"id":"INC-15861","date":"2026-07","year":2026,"title":"Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-15574"],"affected":"Red Hat/Red Hat OpenShift AI (RHOAI)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15574"},{"id":"INC-15862","date":"2026-07","year":2026,"title":"SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15583"],"affected":"Grafana/Grafana MCP Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15583"},{"id":"INC-15863","date":"2026-07","year":2026,"title":"wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15605"],"affected":"wandb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15605"},{"id":"INC-15864","date":"2026-07","year":2026,"title":"WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15610"],"affected":"quantumcloud/WPBot – AI ChatBot for Live Support, Lead Generation, AI Services","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15610"},{"id":"INC-15865","date":"2026-07","year":2026,"title":"zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15628"],"affected":"zhayujie/chatgpt-on-wechat CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15628"},{"id":"INC-15866","date":"2026-07","year":2026,"title":"AWS HealthLake MCP Server SSRF via Pagination URL","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-15643"],"affected":"AWS/awslabs.healthlake-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15643"},{"id":"INC-15867","date":"2026-08","year":2026,"title":"Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15679"],"affected":"Hugging Face/PyTorch Image Models","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15679"},{"id":"INC-15868","date":"2026-07","year":2026,"title":"Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15685"],"affected":"Ollama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15685"},{"id":"INC-15869","date":"2026-07","year":2026,"title":"Credential disclosure in Strands Agents Tools elasticsearch_memory tool","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-15746"],"affected":"Amazon/strands-agents-tools","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15746"},{"id":"INC-15870","date":"2026-07","year":2026,"title":"mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15749"],"affected":"mastergo-design/mastergo-magic-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15749"},{"id":"INC-15871","date":"2026-07","year":2026,"title":"mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15750"],"affected":"mastergo-design/mastergo-magic-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15750"},{"id":"INC-15872","date":"2026-07","year":2026,"title":"mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15751"],"affected":"mastergo-design/mastergo-magic-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15751"},{"id":"INC-15873","date":"2026-07","year":2026,"title":"SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15829"],"affected":"Google/MCP Toolbox for Databases (googleapis/mcp-toolbox)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15829"},{"id":"INC-15874","date":"2026-07","year":2026,"title":"CVE-2026-15969","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15969"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15969"},{"id":"INC-15875","date":"2026-07","year":2026,"title":"CVE-2026-15971","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15971"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15971"},{"id":"INC-15876","date":"2026-07","year":2026,"title":"CVE-2026-15974","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-15974"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15974"},{"id":"INC-15877","date":"2026-07","year":2026,"title":"CVE-2026-15976","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-15976"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15976"},{"id":"INC-15878","date":"2026-07","year":2026,"title":"CVE-2026-15977","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-15977"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15977"},{"id":"INC-15879","date":"2026-07","year":2026,"title":"CVE-2026-15978","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-15978"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15978"},{"id":"INC-15880","date":"2026-07","year":2026,"title":"IBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processi...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-15995"],"affected":"IBM/Cognos Analytics","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-15995"},{"id":"INC-15881","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-16073"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16073"},{"id":"INC-15882","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-16074"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16074"},{"id":"INC-15883","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-16075"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16075"},{"id":"INC-15884","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-16076"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16076"},{"id":"INC-15885","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-16077"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16077"},{"id":"INC-15886","date":"2026-07","year":2026,"title":"zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-16194"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16194"},{"id":"INC-15887","date":"2026-07","year":2026,"title":"consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-16326"],"affected":"HashiCorp/Tooling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16326"},{"id":"INC-15888","date":"2026-07","year":2026,"title":"consul-mcp-server vulnerable to server side request forgery leading to token exposure","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-16328"],"affected":"HashiCorp/Tooling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16328"},{"id":"INC-15889","date":"2026-07","year":2026,"title":"Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-16481"],"affected":"Google/MCP Toolbox for Databases (googleapis/mcp-toolbox)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16481"},{"id":"INC-15890","date":"2026-07","year":2026,"title":"terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-16496"],"affected":"HashiCorp/Tooling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16496"},{"id":"INC-15891","date":"2026-09","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-16497"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16497"},{"id":"INC-15892","date":"2026-07","year":2026,"title":"terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-16498"],"affected":"HashiCorp/Tooling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16498"},{"id":"INC-15893","date":"2026-07","year":2026,"title":"AWS API MCP Server Security Policy Bypass via Startup Failure","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-16584"],"affected":"AWS/aws-api-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-16584"},{"id":"INC-15894","date":"2026-07","year":2026,"title":"pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-17351"],"affected":"pgadmin.org/pgAdmin 4","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17351"},{"id":"INC-15895","date":"2026-07","year":2026,"title":"NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-17432"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17432"},{"id":"INC-15896","date":"2026-07","year":2026,"title":"nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-17433"],"affected":"nanocoai/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17433"},{"id":"INC-15897","date":"2026-07","year":2026,"title":"nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-17434"],"affected":"nanocoai/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17434"},{"id":"INC-15898","date":"2026-07","year":2026,"title":"mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-17457"],"affected":"mf-yang/openclaw-cn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17457"},{"id":"INC-15899","date":"2026-07","year":2026,"title":"mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17458"],"affected":"mf-yang/openclaw-cn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17458"},{"id":"INC-15900","date":"2026-07","year":2026,"title":"ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17500"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17500"},{"id":"INC-15901","date":"2026-07","year":2026,"title":"ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17501"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17501"},{"id":"INC-15902","date":"2026-07","year":2026,"title":"ggml-org whisper.cpp log_mel_spectrogram out-of-bounds","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17512"],"affected":"ggml-org/whisper.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17512"},{"id":"INC-15903","date":"2026-07","year":2026,"title":"ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17513"],"affected":"ggml-org/whisper.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17513"},{"id":"INC-15904","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot astr_main_agent.py authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17529"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17529"},{"id":"INC-15905","date":"2026-07","year":2026,"title":"AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17530"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17530"},{"id":"INC-15906","date":"2026-07","year":2026,"title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-17534"],"affected":"MoonshotAI/Kimi Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17534"},{"id":"INC-15907","date":"2026-09","year":2026,"title":"Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17621"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17621"},{"id":"INC-15908","date":"2026-09","year":2026,"title":"Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-17622"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17622"},{"id":"INC-15909","date":"2026-08","year":2026,"title":"Langflow is affected OS Command Injection in Model Context Protocol features","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17623"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17623"},{"id":"INC-15910","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17624"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17624"},{"id":"INC-15911","date":"2026-08","year":2026,"title":"Langflow is affected by OS Command Injection in Model Context Protocol features","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17625"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17625"},{"id":"INC-15912","date":"2026-08","year":2026,"title":"Langflow is affected by security vulnerabilities in Model Context Protocol features","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-17626"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17626"},{"id":"INC-15913","date":"2026-09","year":2026,"title":"Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-17627"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17627"},{"id":"INC-15914","date":"2026-09","year":2026,"title":"Langflow is affected by improper authentication due to missing password verification in the password reset endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-17628"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17628"},{"id":"INC-15915","date":"2026-08","year":2026,"title":"Langflow is affected by security vulnerabilities in Model Context Protocol features","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17630"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17630"},{"id":"INC-15916","date":"2026-09","year":2026,"title":"Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17631"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17631"},{"id":"INC-15917","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17632"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17632"},{"id":"INC-15918","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-17633"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-17633"},{"id":"INC-15919","date":"2026-07","year":2026,"title":"pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18022"],"affected":"pgvector","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18022"},{"id":"INC-15920","date":"2026-07","year":2026,"title":"Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-18266"],"affected":"LangGenius/Dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18266"},{"id":"INC-15921","date":"2026-08","year":2026,"title":"CVE-2026-18482","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18482"],"affected":"Klarso GmbH/neo-mjs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18482"},{"id":"INC-15922","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-18486"],"affected":"IBM/ContextForge MCP Gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18486"},{"id":"INC-15923","date":"2026-09","year":2026,"title":"IBM ContextForge Translate is affected by cross-client credential context confusion","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-18489"],"affected":"IBM/ContextForge MCP Gateway - Translate utility","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18489"},{"id":"INC-15924","date":"2026-08","year":2026,"title":"Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18545"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18545"},{"id":"INC-15925","date":"2026-08","year":2026,"title":"ggml-org llama.cpp Jinja Minja Template parser.cpp assertion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18581"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18581"},{"id":"INC-15926","date":"2026-08","year":2026,"title":"langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18632"],"affected":"langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18632"},{"id":"INC-15927","date":"2026-08","year":2026,"title":"Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-18655"],"affected":"AWS/amazon-mq-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18655"},{"id":"INC-15928","date":"2026-08","year":2026,"title":"Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18729"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18729"},{"id":"INC-15929","date":"2026-08","year":2026,"title":"Prompt injection bypasses shell tool consent gate in Strands Agents Tools","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-18733"],"affected":"AWS/strands-agents-tools","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18733"},{"id":"INC-15930","date":"2026-08","year":2026,"title":"NousResearch hermes-agent Quick run.py _check_slash_access authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18773"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18773"},{"id":"INC-15931","date":"2026-08","year":2026,"title":"NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18774"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18774"},{"id":"INC-15932","date":"2026-08","year":2026,"title":"NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18775"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18775"},{"id":"INC-15933","date":"2026-09","year":2026,"title":"IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18875"],"affected":"IBM/Financial Transaction Manager (FTM) for RedHat OpenShift","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18875"},{"id":"INC-15934","date":"2026-08","year":2026,"title":"Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-18891"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18891"},{"id":"INC-15935","date":"2026-08","year":2026,"title":"Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18899"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18899"},{"id":"INC-15936","date":"2026-08","year":2026,"title":"Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-18904"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18904"},{"id":"INC-15937","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-18905"],"affected":"IBM/ContextForge MCP Gateway (`mcp-contextforge-gateway`)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18905"},{"id":"INC-15938","date":"2026-08","year":2026,"title":"Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18953"],"affected":"AWS/aws-transform-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18953"},{"id":"INC-15939","date":"2026-08","year":2026,"title":"Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18954"],"affected":"AWS/documentdb-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18954"},{"id":"INC-15940","date":"2026-08","year":2026,"title":"NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18976"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18976"},{"id":"INC-15941","date":"2026-08","year":2026,"title":"letta-ai LettaBot API Status Route server.ts missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-18990"],"affected":"letta-ai/LettaBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18990"},{"id":"INC-15942","date":"2026-08","year":2026,"title":"nanocoai NanoClaw send_file core.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-18991"],"affected":"nanocoai/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18991"},{"id":"INC-15943","date":"2026-08","year":2026,"title":"zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-18992"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18992"},{"id":"INC-15944","date":"2026-08","year":2026,"title":"NousResearch hermes-agent Memory Toolset model_tools.py access control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-18993"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-18993"},{"id":"INC-15945","date":"2026-08","year":2026,"title":"nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19005"],"affected":"nanocoai/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19005"},{"id":"INC-15946","date":"2026-08","year":2026,"title":"mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19006"],"affected":"mf-yang/openclaw-cn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19006"},{"id":"INC-15947","date":"2026-08","year":2026,"title":"mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19007"],"affected":"mf-yang/openclaw-cn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19007"},{"id":"INC-15948","date":"2026-08","year":2026,"title":"mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19008"],"affected":"mf-yang/openclaw-cn","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19008"},{"id":"INC-15949","date":"2026-08","year":2026,"title":"MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19038"],"affected":"MonomythDevelopment/la-forge-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19038"},{"id":"INC-15950","date":"2026-08","year":2026,"title":"Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19039"],"affected":"Kino-Kafkaesque/ssh-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19039"},{"id":"INC-15951","date":"2026-08","year":2026,"title":"MissionSquad mcp-api dcrClients.ts server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19040"],"affected":"MissionSquad/mcp-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19040"},{"id":"INC-15952","date":"2026-08","year":2026,"title":"MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19041"],"affected":"MissionSquad/mcp-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19041"},{"id":"INC-15953","date":"2026-08","year":2026,"title":"LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19044"],"affected":"LeeSinLiang/godot-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19044"},{"id":"INC-15954","date":"2026-08","year":2026,"title":"FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19058"],"affected":"FoundationAgents/MetaGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19058"},{"id":"INC-15955","date":"2026-08","year":2026,"title":"FoundationAgents MetaGPT editor.py read path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19059"],"affected":"FoundationAgents/MetaGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19059"},{"id":"INC-15956","date":"2026-08","year":2026,"title":"FoundationAgents MetaGPT code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19060"],"affected":"FoundationAgents/MetaGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19060"},{"id":"INC-15957","date":"2026-08","year":2026,"title":"Insecure direct object reference in Strands Agents Tools memory tool namespace isolation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19111"],"affected":"AWS/strands-agents-tools","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19111"},{"id":"INC-15958","date":"2026-09","year":2026,"title":"Token Cache Reuse in mcp-toolbox-sdk-python","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19202"],"affected":"Google/mcp-toolbox-sdk-python","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19202"},{"id":"INC-15959","date":"2026-08","year":2026,"title":"HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19243"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19243"},{"id":"INC-15960","date":"2026-08","year":2026,"title":"HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-19244"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19244"},{"id":"INC-15961","date":"2026-08","year":2026,"title":"HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-19245"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19245"},{"id":"INC-15962","date":"2026-08","year":2026,"title":"HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19246"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19246"},{"id":"INC-15963","date":"2026-08","year":2026,"title":"INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19263"],"affected":"INQUIRELAB/mcp-bridge-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19263"},{"id":"INC-15964","date":"2026-08","year":2026,"title":"Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19270"],"affected":"Hulupeep/mcp-ui-probe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19270"},{"id":"INC-15965","date":"2026-08","year":2026,"title":"MIMICLab mcp-pdf-vision index.ts load_pdf command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19279"],"affected":"MIMICLab/mcp-pdf-vision","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19279"},{"id":"INC-15966","date":"2026-08","year":2026,"title":"adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19281"],"affected":"adolfosalasgomez3011/slidev-builder-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19281"},{"id":"INC-15967","date":"2026-08","year":2026,"title":"andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19282"],"affected":"andreahaku/llm_memory_mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19282"},{"id":"INC-15968","date":"2026-08","year":2026,"title":"Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19286"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19286"},{"id":"INC-15969","date":"2026-08","year":2026,"title":"abrinsmead mindpilot-mcp HistoryService path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19287"],"affected":"abrinsmead/mindpilot-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19287"},{"id":"INC-15970","date":"2026-08","year":2026,"title":"astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19288"],"affected":"astralisone/rive-mcp-server-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19288"},{"id":"INC-15971","date":"2026-08","year":2026,"title":"Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-19294"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19294"},{"id":"INC-15972","date":"2026-08","year":2026,"title":"Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19295"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19295"},{"id":"INC-15973","date":"2026-08","year":2026,"title":"Insufficient Authentication Brute Force Protection on Login Endpoint","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19297"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19297"},{"id":"INC-15974","date":"2026-09","year":2026,"title":"Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19298"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19298"},{"id":"INC-15975","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19299"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19299"},{"id":"INC-15976","date":"2026-09","year":2026,"title":"Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-19300"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19300"},{"id":"INC-15977","date":"2026-09","year":2026,"title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19301"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19301"},{"id":"INC-15978","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-19302"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19302"},{"id":"INC-15979","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19303"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19303"},{"id":"INC-15980","date":"2026-09","year":2026,"title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-19304"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19304"},{"id":"INC-15981","date":"2026-09","year":2026,"title":"Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19305"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19305"},{"id":"INC-15982","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-19306"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19306"},{"id":"INC-15983","date":"2026-08","year":2026,"title":"azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19323"],"affected":"azer/react-analyzer-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19323"},{"id":"INC-15984","date":"2026-08","year":2026,"title":"HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19324"],"affected":"HelloGGX/shadcn-vue-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19324"},{"id":"INC-15985","date":"2026-08","year":2026,"title":"IncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/append_memory_bank_entry index.ts appendMemoryBankEntry path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19325"],"affected":"IncomeStreamSurfer/roo-code-memory-bank-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19325"},{"id":"INC-15986","date":"2026-08","year":2026,"title":"abracadabra50 claude-sesh enricher.ts enrichSession path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19327"],"affected":"abracadabra50/claude-sesh","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19327"},{"id":"INC-15987","date":"2026-08","year":2026,"title":"aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19328"],"affected":"aktsmm/skill-ninja-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19328"},{"id":"INC-15988","date":"2026-08","year":2026,"title":"andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19329"],"affected":"andreahaku/codex_mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19329"},{"id":"INC-15989","date":"2026-08","year":2026,"title":"angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19330"],"affected":"angrysky56/advanced-reasoning-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19330"},{"id":"INC-15990","date":"2026-08","year":2026,"title":"bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19331"],"affected":"bazylhorsey/obsidian-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19331"},{"id":"INC-15991","date":"2026-08","year":2026,"title":"NightTrek Supabase-MCP generate_types command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19333"],"affected":"NightTrek/Supabase-MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19333"},{"id":"INC-15992","date":"2026-08","year":2026,"title":"NightTrek Ollama-mcp index.ts command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19334"],"affected":"NightTrek/Ollama-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19334"},{"id":"INC-15993","date":"2026-08","year":2026,"title":"Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19336"],"affected":"Pimzino/spec-workflow-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19336"},{"id":"INC-15994","date":"2026-08","year":2026,"title":"adenot mcp-google-search read_webpage index.ts server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19337"],"affected":"adenot/mcp-google-search","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19337"},{"id":"INC-15995","date":"2026-08","year":2026,"title":"aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19339"],"affected":"aliyun/alibabacloud-dataworks-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19339"},{"id":"INC-15996","date":"2026-08","year":2026,"title":"anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19340"],"affected":"anubissbe/ProjectHub-Mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19340"},{"id":"INC-15997","date":"2026-08","year":2026,"title":"Ichigo3766 image-gen-mcp upscale_images index.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19365"],"affected":"Ichigo3766/image-gen-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19365"},{"id":"INC-15998","date":"2026-08","year":2026,"title":"PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19368"],"affected":"PV-Bhat/gemsuite-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19368"},{"id":"INC-15999","date":"2026-08","year":2026,"title":"KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19369"],"affected":"KS-GEN-AI/jira-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19369"},{"id":"INC-16000","date":"2026-08","year":2026,"title":"bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19370"],"affected":"bartekke8it56w2/new-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19370"},{"id":"INC-16001","date":"2026-08","year":2026,"title":"Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19371"],"affected":"Nikolaibibo/claude-comfyui-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19371"},{"id":"INC-16002","date":"2026-08","year":2026,"title":"Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19372"],"affected":"Handwriting-OCR/handwriting-ocr-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19372"},{"id":"INC-16003","date":"2026-08","year":2026,"title":"PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19373"],"affected":"PhialsBasement/KoboldCPP-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19373"},{"id":"INC-16004","date":"2026-08","year":2026,"title":"adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19374"],"affected":"adafap/api-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19374"},{"id":"INC-16005","date":"2026-08","year":2026,"title":"dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19375"],"affected":"dmitriiweb/article-scraper-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19375"},{"id":"INC-16006","date":"2026-08","year":2026,"title":"Bucket Squatting in Vertex AI Search for Commerce","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19485"],"affected":"Google Cloud/Vertex AI Search for Commerce","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19485"},{"id":"INC-16007","date":"2026-08","year":2026,"title":"CVE-2026-19516 CVE Record","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19516"],"affected":"Grafana/Grafana MCP Server, Grafana/mcp-grafana","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19516"},{"id":"INC-16008","date":"2026-09","year":2026,"title":"OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19590"],"affected":"OpenAI/Codex Desktop, OpenAI/Codex Desktop (Microsoft Store package)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19590"},{"id":"INC-16009","date":"2026-09","year":2026,"title":"OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser inte...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19591"],"affected":"OpenAI/Codex CLI, OpenAI/Codex Desktop, OpenAI/Codex Desktop (Microsoft Store package)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19591"},{"id":"INC-16010","date":"2026-09","year":2026,"title":"OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local cor...","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19592"],"affected":"OpenAI/Codex CLI, OpenAI/Codex Desktop, OpenAI/Codex Desktop (Microsoft Store package)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19592"},{"id":"INC-16011","date":"2026-09","year":2026,"title":"OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-19593"],"affected":"OpenAI/Codex Desktop, OpenAI/Codex Desktop (Microsoft Store package)","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19593"},{"id":"INC-16012","date":"2026-09","year":2026,"title":"Multiple vulnerabilities in IBM MQ Agent images","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19645"],"affected":"IBM/MQ Agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19645"},{"id":"INC-16013","date":"2026-08","year":2026,"title":"EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19751"],"affected":"EnzoVezzaro/mcp-dominican-layer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19751"},{"id":"INC-16014","date":"2026-08","year":2026,"title":"EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19752"],"affected":"EnzoVezzaro/mcp-dominican-layer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19752"},{"id":"INC-16015","date":"2026-08","year":2026,"title":"Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19753"],"affected":"Model Context Protocol/mcp-rdf-explorer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19753"},{"id":"INC-16016","date":"2026-08","year":2026,"title":"eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19765"],"affected":"eyaushev/swagger-testcase-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19765"},{"id":"INC-16017","date":"2026-02","year":2026,"title":"isaacwasserman mcp-vegalite-server visualize_data eval code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-1977"],"affected":"isaacwasserman/mcp-vegalite-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-1977"},{"id":"INC-16018","date":"2026-08","year":2026,"title":"feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19770"],"affected":"feedmob/fm-mcp-servers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19770"},{"id":"INC-16019","date":"2026-08","year":2026,"title":"Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-19875"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19875"},{"id":"INC-16020","date":"2026-08","year":2026,"title":"gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19956"],"affected":"gomarble-ai/facebook-ads-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19956"},{"id":"INC-16021","date":"2026-08","year":2026,"title":"graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19957"],"affected":"graphlit/graphlit-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19957"},{"id":"INC-16022","date":"2026-08","year":2026,"title":"iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19958"],"affected":"iatsiuk/pptr-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19958"},{"id":"INC-16023","date":"2026-08","year":2026,"title":"Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-19964"],"affected":"Jij-Inc/Jij-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19964"},{"id":"INC-16024","date":"2026-08","year":2026,"title":"jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19978"],"affected":"jiantao88/android-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19978"},{"id":"INC-16025","date":"2026-08","year":2026,"title":"jkawamoto mcp-florence2 __init__.py get_images server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-19984"],"affected":"jkawamoto/mcp-florence2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-19984"},{"id":"INC-16026","date":"2026-02","year":2026,"title":"abhiphile fermat-mcp eqn_chart.py eqn_chart code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-2008"],"affected":"abhiphile/fermat-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2008"},{"id":"INC-16027","date":"2026-08","year":2026,"title":"Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-20728"],"affected":"Intel Extension for TensorFlow software","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-20728"},{"id":"INC-16028","date":"2026-08","year":2026,"title":"Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-20755"],"affected":"LLM Scaler software","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-20755"},{"id":"INC-16029","date":"2026-02","year":2026,"title":"XixianLiang HarmonyOS-mcp-server input_text os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2131"],"affected":"XixianLiang/HarmonyOS-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2131"},{"id":"INC-16030","date":"2026-08","year":2026,"title":"Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-21387"],"affected":"Intel(R) LLM Library for PyTorch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21387"},{"id":"INC-16031","date":"2026-08","year":2026,"title":"HCL AION is affected by multiple security vulnerabilities.","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-21832"],"affected":"HCL Software/AION","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-21832"},{"id":"INC-16032","date":"2026-05","year":2026,"title":"Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-22677"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-22677"},{"id":"INC-16033","date":"2026-01","year":2026,"title":"CVAT vulnerable to XSS via skeleton SVG images","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23516"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23516"},{"id":"INC-16034","date":"2026-01","year":2026,"title":"CVAT vulnerable to privilege escalation of users with staff status","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-23526"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-23526"},{"id":"INC-16035","date":"2026-05","year":2026,"title":"NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24142"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24142"},{"id":"INC-16036","date":"2026-05","year":2026,"title":"NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24160"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24160"},{"id":"INC-16037","date":"2026-05","year":2026,"title":"NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24163"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24163"},{"id":"INC-16038","date":"2026-03","year":2026,"title":"NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24164"],"affected":"NVIDIA/BioNeMo Framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24164"},{"id":"INC-16039","date":"2026-03","year":2026,"title":"NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24165"],"affected":"NVIDIA/BioNeMo Framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24165"},{"id":"INC-16040","date":"2026-05","year":2026,"title":"NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24188"],"affected":"NVIDIA/TensorRT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24188"},{"id":"INC-16041","date":"2026-05","year":2026,"title":"NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24216"],"affected":"NVIDIA/BioNeMo Framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24216"},{"id":"INC-16042","date":"2026-05","year":2026,"title":"NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file.","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24217"],"affected":"NVIDIA/BioNeMo Framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24217"},{"id":"INC-16043","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24220"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24220"},{"id":"INC-16044","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-24226"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24226"},{"id":"INC-16045","date":"2026-07","year":2026,"title":"NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24227"],"affected":"NVIDIA/TensorRT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24227"},{"id":"INC-16046","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by send...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-24229"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24229"},{"id":"INC-16047","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause des...","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24233"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24233"},{"id":"INC-16048","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery.","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24234"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24234"},{"id":"INC-16049","date":"2026-07","year":2026,"title":"NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24238"],"affected":"NVIDIA/TensorRT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24238"},{"id":"INC-16050","date":"2026-09","year":2026,"title":"NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-24239"],"affected":"NVIDIA/NeMo Speech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24239"},{"id":"INC-16051","date":"2026-07","year":2026,"title":"NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24252"],"affected":"NVIDIA/NeMo Framework","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24252"},{"id":"INC-16052","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-24259"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24259"},{"id":"INC-16053","date":"2026-09","year":2026,"title":"NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-24267"],"affected":"NVIDIA/NeMo Speech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24267"},{"id":"INC-16054","date":"2026-07","year":2026,"title":"NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24268"],"affected":"NVIDIA/TensorRT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24268"},{"id":"INC-16055","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24271"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24271"},{"id":"INC-16056","date":"2026-07","year":2026,"title":"NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer.","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24272"],"affected":"NVIDIA/TensorRT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24272"},{"id":"INC-16057","date":"2026-08","year":2026,"title":"Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-24693"],"affected":"Intel(R) oneCCL Bindings for PyTorch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24693"},{"id":"INC-16058","date":"2026-01","year":2026,"title":"RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-24770"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-24770"},{"id":"INC-16059","date":"2026-02","year":2026,"title":"MindsDB File Upload security.py clear_filename server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2531"],"affected":"MindsDB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2531"},{"id":"INC-16060","date":"2026-02","year":2026,"title":"JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-2555"],"affected":"JeecgBoot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2555"},{"id":"INC-16061","date":"2026-02","year":2026,"title":"New API has an SQL LIKE Wildcard Injection DoS via Token Search","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-25591"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25591"},{"id":"INC-16062","date":"2026-02","year":2026,"title":"Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-2577"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-2577"},{"id":"INC-16063","date":"2026-04","year":2026,"title":"LeRobot Unsafe Deserialization Remote Code Execution via gRPC","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-25874"],"affected":"Hugging Face/LeRobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-25874"},{"id":"INC-16064","date":"2026-08","year":2026,"title":"Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-27765"],"affected":"vLLM Hardware Plugin for Intel(R) Gaudi(R) software","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-27765"},{"id":"INC-16065","date":"2026-02","year":2026,"title":"Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-28400"],"affected":"docker/model-runner","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28400"},{"id":"INC-16066","date":"2026-08","year":2026,"title":"Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28707"],"affected":"LLM-on-Ray","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28707"},{"id":"INC-16067","date":"2026-04","year":2026,"title":"RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent \"Text Processing\" Component","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-28797"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-28797"},{"id":"INC-16068","date":"2026-07","year":2026,"title":"LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-30623"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-30623"},{"id":"INC-16069","date":"2026-05","year":2026,"title":"The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint.","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31242"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31242"},{"id":"INC-16070","date":"2026-05","year":2026,"title":"The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memories endpoint.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31243"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31243"},{"id":"INC-16071","date":"2026-05","year":2026,"title":"The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}).","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31244"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31244"},{"id":"INC-16072","date":"2026-05","year":2026,"title":"The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-31245"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-31245"},{"id":"INC-16073","date":"2026-10","year":2026,"title":"WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-32585"],"affected":"airano/Airano MCP Bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32585"},{"id":"INC-16074","date":"2026-03","year":2026,"title":"Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-32857"],"affected":"Firecrawl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32857"},{"id":"INC-16075","date":"2026-03","year":2026,"title":"New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-32879"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-32879"},{"id":"INC-16076","date":"2026-03","year":2026,"title":"LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33340"],"affected":"ParisNeo/lollms-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33340"},{"id":"INC-16077","date":"2026-09","year":2026,"title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-33625"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33625"},{"id":"INC-16078","date":"2026-07","year":2026,"title":"New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-33655"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-33655"},{"id":"INC-16079","date":"2026-03","year":2026,"title":"eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-3409"],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3409"},{"id":"INC-16080","date":"2026-04","year":2026,"title":"Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35002"],"affected":"Agno","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35002"},{"id":"INC-16081","date":"2026-08","year":2026,"title":"Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege.","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-35502"],"affected":"Intel(R) Extension for PyTorch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35502"},{"id":"INC-16082","date":"2026-04","year":2026,"title":"nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-35589"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-35589"},{"id":"INC-16083","date":"2026-03","year":2026,"title":"RyuzakiShinji biome-mcp-server biome-mcp-server.ts command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3680"],"affected":"RyuzakiShinji/biome-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3680"},{"id":"INC-16084","date":"2026-08","year":2026,"title":"Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection.","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-37003"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37003"},{"id":"INC-16085","date":"2026-08","year":2026,"title":"BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dot...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-37004"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37004"},{"id":"INC-16086","date":"2026-08","year":2026,"title":"A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Pr...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-37006"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37006"},{"id":"INC-16087","date":"2026-08","year":2026,"title":"A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-37007"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37007"},{"id":"INC-16088","date":"2026-09","year":2026,"title":"CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-37008"],"affected":"CrewAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37008"},{"id":"INC-16089","date":"2026-08","year":2026,"title":"vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-37237"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-37237"},{"id":"INC-16090","date":"2026-09","year":2026,"title":"In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0.","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-38924"],"affected":"Oraios AI/Serena","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-38924"},{"id":"INC-16091","date":"2026-04","year":2026,"title":"MaxKB: RCE via MCP stdio command injection in workflow engine","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39417"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39417"},{"id":"INC-16092","date":"2026-04","year":2026,"title":"MaxKB: SSRF via sandbox network hook bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39418"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39418"},{"id":"INC-16093","date":"2026-04","year":2026,"title":"MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-39419"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39419"},{"id":"INC-16094","date":"2026-04","year":2026,"title":"MaxKB: Sandbox escape via LD_PRELOAD bypass","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39420"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39420"},{"id":"INC-16095","date":"2026-04","year":2026,"title":"MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39421"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39421"},{"id":"INC-16096","date":"2026-04","year":2026,"title":"MaxKB has Stored XSS via ChatHeadersMiddleware","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39422"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39422"},{"id":"INC-16097","date":"2026-04","year":2026,"title":"Stored XSS via Eval Injection in EchartsRander Component","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39423"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39423"},{"id":"INC-16098","date":"2026-04","year":2026,"title":"MaxKB has CSV Injection in its Application Chat Export Functionality","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39424"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39424"},{"id":"INC-16099","date":"2026-04","year":2026,"title":"MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-39425"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-39425"},{"id":"INC-16100","date":"2026-04","year":2026,"title":"Remote Code Execution in h2oai/h2o-3","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-3960"],"affected":"h2oai/h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-3960"},{"id":"INC-16101","date":"2026-07","year":2026,"title":"Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-40047"],"affected":"Apache Software Foundation/Apache Camel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40047"},{"id":"INC-16102","date":"2026-04","year":2026,"title":"PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence","severity":"Critical","attack_vector":"supply-chain","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40313"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40313"},{"id":"INC-16103","date":"2026-06","year":2026,"title":"WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-40775"],"affected":"Royal Plugins/Royal MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-40775"},{"id":"INC-16104","date":"2026-07","year":2026,"title":"Microsoft 365 Copilot Elevation of Privilege Vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-41106"],"affected":"Microsoft/Microsoft 365 Copilot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-41106"},{"id":"INC-16105","date":"2026-03","year":2026,"title":"AvinashBole quip-mcp-server index.ts setupToolHandlers command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4192"],"affected":"AvinashBole/quip-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4192"},{"id":"INC-16106","date":"2026-03","year":2026,"title":"hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4198"],"affected":"hypermodel-labs/mcp-server-auto-commit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4198"},{"id":"INC-16107","date":"2026-03","year":2026,"title":"bazinga012 mcp_code_executor index.ts installDependencies command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4199"],"affected":"bazinga012/mcp_code_executor","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4199"},{"id":"INC-16108","date":"2026-03","year":2026,"title":"vanna-ai vanna Endpoint __init__.py update_sql sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4230"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4230"},{"id":"INC-16109","date":"2026-03","year":2026,"title":"vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4231"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4231"},{"id":"INC-16110","date":"2026-05","year":2026,"title":"MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42335"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42335"},{"id":"INC-16111","date":"2026-05","year":2026,"title":"MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-42336"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42336"},{"id":"INC-16112","date":"2026-05","year":2026,"title":"MaxKB: Broken Access Control in MaxKB OSS URL Fetch API","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-42337"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-42337"},{"id":"INC-16113","date":"2026-08","year":2026,"title":"llama.cpp b1886–b7445 Double Free via llama-android.cpp","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43622"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43622"},{"id":"INC-16114","date":"2026-08","year":2026,"title":"llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43627"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43627"},{"id":"INC-16115","date":"2026-08","year":2026,"title":"llama.cpp b3978–b9058 Integer Underflow via DRY Sampler","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43628"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43628"},{"id":"INC-16116","date":"2026-08","year":2026,"title":"llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43629"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43629"},{"id":"INC-16117","date":"2026-08","year":2026,"title":"llama.cpp b5702–b7653 Out-of-Bounds Read Information Disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-43630"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43630"},{"id":"INC-16118","date":"2026-08","year":2026,"title":"llama.cpp b7492–b9060 Use-After-Free RCE via llama-server","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43631"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43631"},{"id":"INC-16119","date":"2026-08","year":2026,"title":"llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-43632"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-43632"},{"id":"INC-16120","date":"2026-07","year":2026,"title":"Docling Core has insufficient validation of image reference URIs","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44019"],"affected":"docling-project/docling-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44019"},{"id":"INC-16121","date":"2026-06","year":2026,"title":"Docling: Potential Path Traversal via LaTeX \\includegraphics and \\input Commands","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-44022"],"affected":"docling-project/docling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44022"},{"id":"INC-16122","date":"2026-07","year":2026,"title":"Docling Core has unsafe remote filename resolution","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44023"],"affected":"docling-project/docling-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44023"},{"id":"INC-16123","date":"2026-07","year":2026,"title":"Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-44192"],"affected":"Red Hat/Red Hat Ansible Automation Platform 2","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44192"},{"id":"INC-16124","date":"2026-07","year":2026,"title":"New API CSRF in email and WeChat account binding endpoints","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44342"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44342"},{"id":"INC-16125","date":"2026-05","year":2026,"title":"CVAT: Stored XSS via annotation guides","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44369"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44369"},{"id":"INC-16126","date":"2026-05","year":2026,"title":"Lumiverse: Sign-up nonce race condition allows unauthorized account registration","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44443"],"affected":"prolix-oc/Lumiverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44443"},{"id":"INC-16127","date":"2026-05","year":2026,"title":"Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44444"],"affected":"prolix-oc/Lumiverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44444"},{"id":"INC-16128","date":"2026-05","year":2026,"title":"Lumiverse: SMB `exists()` basename injection via smbclient `!cmd` escape","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44449"],"affected":"prolix-oc/Lumiverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44449"},{"id":"INC-16129","date":"2026-05","year":2026,"title":"Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44451"],"affected":"prolix-oc/Lumiverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44451"},{"id":"INC-16130","date":"2026-07","year":2026,"title":"ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44512"],"affected":"onnx","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44512"},{"id":"INC-16131","date":"2026-05","year":2026,"title":"Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-44520"],"affected":"docling-project/docling-graph","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44520"},{"id":"INC-16132","date":"2026-05","year":2026,"title":"MaxKB: Webhook Trigger Authentication Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-44847"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44847"},{"id":"INC-16133","date":"2026-07","year":2026,"title":"Exposed tokens in SUSE Rancher AI Agent logs","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-44934"],"affected":"SUSE/Rancher","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-44934"},{"id":"INC-16134","date":"2026-03","year":2026,"title":"sigmade Git-MCP-Server gitUtils.ts child_process.exec os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4496"],"affected":"sigmade/Git-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4496"},{"id":"INC-16135","date":"2026-03","year":2026,"title":"eosphoros-ai db-gpt Incomplete Fix editor sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4504"],"affected":"eosphoros-ai/db-gpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4504"},{"id":"INC-16136","date":"2026-03","year":2026,"title":"eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4505"],"affected":"eosphoros-ai/DB-GPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4505"},{"id":"INC-16137","date":"2026-03","year":2026,"title":"vanna-ai vanna legacy exec injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4511"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4511"},{"id":"INC-16138","date":"2026-03","year":2026,"title":"vanna-ai vanna base.py ask sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4513"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4513"},{"id":"INC-16139","date":"2026-05","year":2026,"title":"Crabbox < 0.9.0 Authentication Bypass via Admin Claim Injection","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-45223"],"affected":"openclaw/crabbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45223"},{"id":"INC-16140","date":"2026-05","year":2026,"title":"MaxKB: Unauthenticated SSRF via Workflow Template Import","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-45412"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45412"},{"id":"INC-16141","date":"2026-05","year":2026,"title":"MaxKB: Unsalted MD5 Password Hashing","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-45413"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-45413"},{"id":"INC-16142","date":"2026-07","year":2026,"title":"WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-46555"],"affected":"verygoodplugins/whatsapp-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-46555"},{"id":"INC-16143","date":"2026-07","year":2026,"title":"Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47237"],"affected":"kubeflow/community-distribution","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47237"},{"id":"INC-16144","date":"2026-07","year":2026,"title":"praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47409"],"affected":"MervinPraison/praisonai-platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47409"},{"id":"INC-16145","date":"2026-07","year":2026,"title":"praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47413"],"affected":"MervinPraison/praisonai-platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47413"},{"id":"INC-16146","date":"2026-07","year":2026,"title":"GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47427"],"affected":"github/github-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47427"},{"id":"INC-16147","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47470"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47470"},{"id":"INC-16148","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47471"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47471"},{"id":"INC-16149","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47472"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47472"},{"id":"INC-16150","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-47473"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47473"},{"id":"INC-16151","date":"2026-07","year":2026,"title":"NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread.","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47475"],"affected":"NVIDIA/TensorRT-LLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47475"},{"id":"INC-16152","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47476"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47476"},{"id":"INC-16153","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47477"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47477"},{"id":"INC-16154","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47478"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47478"},{"id":"INC-16155","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47479"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47479"},{"id":"INC-16156","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47480"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47480"},{"id":"INC-16157","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-47481"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47481"},{"id":"INC-16158","date":"2026-07","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47482"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47482"},{"id":"INC-16159","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a ...","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-47487"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47487"},{"id":"INC-16160","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47606"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47606"},{"id":"INC-16161","date":"2026-09","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-47625"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47625"},{"id":"INC-16162","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal.","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47627"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47627"},{"id":"INC-16163","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47628"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47628"},{"id":"INC-16164","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47629"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47629"},{"id":"INC-16165","date":"2026-08","year":2026,"title":"NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-47630"],"affected":"NVIDIA/Triton Inference Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47630"},{"id":"INC-16166","date":"2026-08","year":2026,"title":"CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47682"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47682"},{"id":"INC-16167","date":"2026-07","year":2026,"title":"APIFold Vulnerable to Unauthenticated Webhook Event Injection","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47769"],"affected":"Work90210/APIFold","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47769"},{"id":"INC-16168","date":"2026-08","year":2026,"title":"Predictable cache directory location allows local ONNX model substitution in Spring AI","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-47852"],"affected":"Spring/Spring AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-47852"},{"id":"INC-16169","date":"2026-08","year":2026,"title":"PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48168"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48168"},{"id":"INC-16170","date":"2026-06","year":2026,"title":"nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-48716"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-48716"},{"id":"INC-16171","date":"2026-08","year":2026,"title":"ONNX symlink-following and path-traversal arbitrary file write","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49114"],"affected":"ONNX","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49114"},{"id":"INC-16172","date":"2026-06","year":2026,"title":"Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49138"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49138"},{"id":"INC-16173","date":"2026-06","year":2026,"title":"Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-49139"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49139"},{"id":"INC-16174","date":"2026-06","year":2026,"title":"Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49140"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49140"},{"id":"INC-16175","date":"2026-07","year":2026,"title":"9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49352"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49352"},{"id":"INC-16176","date":"2026-07","year":2026,"title":"9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49353"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49353"},{"id":"INC-16177","date":"2026-03","year":2026,"title":"letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4964"],"affected":"letta-ai/letta","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4964"},{"id":"INC-16178","date":"2026-03","year":2026,"title":"letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4965"],"affected":"letta-ai/letta","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4965"},{"id":"INC-16179","date":"2026-03","year":2026,"title":"wandb OpenUI HTMLAnnotator server.py get_share HTML injection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-4992"],"affected":"wandb/OpenUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4992"},{"id":"INC-16180","date":"2026-03","year":2026,"title":"wandb OpenUI APIStatusError server.py generic_exception_handler information exposure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-4994"],"affected":"wandb/OpenUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4994"},{"id":"INC-16181","date":"2026-03","year":2026,"title":"wandb OpenUI Window Message Event index.html cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-4995"],"affected":"wandb/OpenUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-4995"},{"id":"INC-16182","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49955"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49955"},{"id":"INC-16183","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49956"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49956"},{"id":"INC-16184","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49957"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49957"},{"id":"INC-16185","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discard","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-49958"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49958"},{"id":"INC-16186","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.311 RCE via Git Configuration Injection","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-49959"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49959"},{"id":"INC-16187","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-49973"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-49973"},{"id":"INC-16188","date":"2026-08","year":2026,"title":"mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-50027"],"affected":"doobidoo/mcp-memory-service","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50027"},{"id":"INC-16189","date":"2026-03","year":2026,"title":"kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5007"],"affected":"kazuph/mcp-docs-rag","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5007"},{"id":"INC-16190","date":"2026-09","year":2026,"title":"MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50125"],"affected":"StacklokLabs/mkp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50125"},{"id":"INC-16191","date":"2026-09","year":2026,"title":"yutu: Arbitrary File Write via MCP `caption-download` Tool","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50158"],"affected":"eat-pray-ai/yutu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50158"},{"id":"INC-16192","date":"2026-07","year":2026,"title":"Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50180"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50180"},{"id":"INC-16193","date":"2026-07","year":2026,"title":"Langroid: Path traversal in the file tools allows read/write outside configured current directory","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-50181"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50181"},{"id":"INC-16194","date":"2026-03","year":2026,"title":"Langflow - Missing Authorization on download_image Endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5022"],"affected":"langflow-ai/langflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5022"},{"id":"INC-16195","date":"2026-03","year":2026,"title":"DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5023"],"affected":"DeDeveloper23/codebase-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5023"},{"id":"INC-16196","date":"2026-03","year":2026,"title":"Langflow - Application Logs Exposed to All Authenticated Users","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5025"],"affected":"langflow-ai/langflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5025"},{"id":"INC-16197","date":"2026-03","year":2026,"title":"Langflow - Stored XSS via Malicious SVG Upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5026"],"affected":"langflow-ai/langflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5026"},{"id":"INC-16198","date":"2026-03","year":2026,"title":"Langflow - Path Traversal Arbitrary File Write via upload_user_file","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5027"],"affected":"langflow-ai/langflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5027"},{"id":"INC-16199","date":"2026-07","year":2026,"title":"GitHub Copilot Remote Code Execution Vulnerability","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-50510"],"affected":"Microsoft/GitHub Copilot Plugin for JetBrains IDEs","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50510"},{"id":"INC-16200","date":"2026-07","year":2026,"title":"Microsoft M365 Copilot Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-50517"],"affected":"Microsoft/Microsoft 365 Copilot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50517"},{"id":"INC-16201","date":"2026-07","year":2026,"title":"FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-50562"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-50562"},{"id":"INC-16202","date":"2026-03","year":2026,"title":"raine consult-llm-mcp server.ts child_process.execSync os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5125"],"affected":"raine/consult-llm-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5125"},{"id":"INC-16203","date":"2026-09","year":2026,"title":"DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51862"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51862"},{"id":"INC-16204","date":"2026-09","year":2026,"title":"DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42).","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51864"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51864"},{"id":"INC-16205","date":"2026-09","year":2026,"title":"In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-51866"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51866"},{"id":"INC-16206","date":"2026-09","year":2026,"title":"DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-51869"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51869"},{"id":"INC-16207","date":"2026-10","year":2026,"title":"The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51882"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51882"},{"id":"INC-16208","date":"2026-10","year":2026,"title":"The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51883"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51883"},{"id":"INC-16209","date":"2026-10","year":2026,"title":"The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51884"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51884"},{"id":"INC-16210","date":"2026-10","year":2026,"title":"langflow-ai langflow v1.9.3 is affected by: Code Injection.","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51886"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51886"},{"id":"INC-16211","date":"2026-10","year":2026,"title":"infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-51892"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51892"},{"id":"INC-16212","date":"2026-10","year":2026,"title":"Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py).","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-51895"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51895"},{"id":"INC-16213","date":"2026-10","year":2026,"title":"infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py).","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-51896"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51896"},{"id":"INC-16214","date":"2026-10","year":2026,"title":"In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow au...","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-51899"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51899"},{"id":"INC-16215","date":"2026-10","year":2026,"title":"SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-51901"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51901"},{"id":"INC-16216","date":"2026-10","year":2026,"title":"vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51911"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51911"},{"id":"INC-16217","date":"2026-09","year":2026,"title":"mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticat...","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51994"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51994"},{"id":"INC-16218","date":"2026-09","year":2026,"title":"An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts c...","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-51995"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51995"},{"id":"INC-16219","date":"2026-09","year":2026,"title":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51996"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51996"},{"id":"INC-16220","date":"2026-09","year":2026,"title":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-51997"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-51997"},{"id":"INC-16221","date":"2026-09","year":2026,"title":"An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper \" src/lib/utils.ts","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-52001"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52001"},{"id":"INC-16222","date":"2026-09","year":2026,"title":"An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-52098"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52098"},{"id":"INC-16223","date":"2026-09","year":2026,"title":"llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52130"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52130"},{"id":"INC-16224","date":"2026-09","year":2026,"title":"llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52131"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52131"},{"id":"INC-16225","date":"2026-09","year":2026,"title":"llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52132"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52132"},{"id":"INC-16226","date":"2026-06","year":2026,"title":"Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-5241"],"affected":"huggingface/huggingface/transformers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5241"},{"id":"INC-16227","date":"2026-07","year":2026,"title":"Navigator NCS and MCP System Accounts with Default Passwords","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5269"],"affected":"CIENA/Navigator NCS, CIENA/MCP, CIENA/Planner Plus OnPrem","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5269"},{"id":"INC-16228","date":"2026-07","year":2026,"title":"Authentication Bypass in Navigator and Blue Planet Products","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-5270"],"affected":"CIENA/Navigator NCS, CIENA/MCP, CIENA/Planner Plus OnPrem, Blue Planet/Inventory","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5270"},{"id":"INC-16229","date":"2026-07","year":2026,"title":"fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52830"],"affected":"leshchenko1979/fast-mcp-telegram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52830"},{"id":"INC-16230","date":"2026-07","year":2026,"title":"MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52869"],"affected":"modelcontextprotocol/python-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52869"},{"id":"INC-16231","date":"2026-07","year":2026,"title":"MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-52870"],"affected":"modelcontextprotocol/python-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-52870"},{"id":"INC-16232","date":"2026-04","year":2026,"title":"vanna-ai vanna Chat API Endpoint v2 missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-5320"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5320"},{"id":"INC-16233","date":"2026-04","year":2026,"title":"vanna-ai vanna FastAPI/Flask Server cross-domain policy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5321"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5321"},{"id":"INC-16234","date":"2026-04","year":2026,"title":"AlejandroArciniegas mcp-data-vis MCP server.js request sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5322"],"affected":"AlejandroArciniegas/mcp-data-vis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5322"},{"id":"INC-16235","date":"2026-08","year":2026,"title":"@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53509"],"affected":"ondata/ckan-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53509"},{"id":"INC-16236","date":"2026-09","year":2026,"title":"SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53554"],"affected":"dataease/SQLBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53554"},{"id":"INC-16237","date":"2026-09","year":2026,"title":"Stored XSS via SVG Upload","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53555"],"affected":"dataease/SQLBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53555"},{"id":"INC-16238","date":"2026-09","year":2026,"title":"SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53556"],"affected":"dataease/SQLBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53556"},{"id":"INC-16239","date":"2026-09","year":2026,"title":"SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53557"],"affected":"dataease/SQLBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53557"},{"id":"INC-16240","date":"2026-09","year":2026,"title":"ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-53708"],"affected":"IBM/mcp-context-forge, IBM/mcp-contextforge-gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53708"},{"id":"INC-16241","date":"2026-09","year":2026,"title":"MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53710"],"affected":"IBM/mcp-context-forge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53710"},{"id":"INC-16242","date":"2026-06","year":2026,"title":"chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53766"],"affected":"ChromeDevTools/chrome-devtools-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53766"},{"id":"INC-16243","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53871"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53871"},{"id":"INC-16244","date":"2026-06","year":2026,"title":"picklescan - Arbitrary File Read via Unsafe Pickle Deserialization","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53872"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53872"},{"id":"INC-16245","date":"2026-06","year":2026,"title":"picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-53873"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53873"},{"id":"INC-16246","date":"2026-09","year":2026,"title":"MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53937"],"affected":"modelcontextprotocol/io.modelcontextprotocol:kotlin-sdk, modelcontextprotocol/io.modelcontextprotocol:kotlin-sdk-client…","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53937"},{"id":"INC-16247","date":"2026-09","year":2026,"title":"Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-53957"],"affected":"contentful/contentful-mcp-server, @contentful/mcp-server, @contentful/mcp-tools","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53957"},{"id":"INC-16248","date":"2026-08","year":2026,"title":"MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-53965"],"affected":"modelcontextprotocol/php-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-53965"},{"id":"INC-16249","date":"2026-08","year":2026,"title":"Open WebUI: DNS Rebinding SSRF Bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54020"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54020"},{"id":"INC-16250","date":"2026-07","year":2026,"title":"n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54052"],"affected":"czlonkowski/n8n-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54052"},{"id":"INC-16251","date":"2026-07","year":2026,"title":"MaxKB MCP tool import validation bypass allows post-authentication remote code execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54149"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54149"},{"id":"INC-16252","date":"2026-06","year":2026,"title":"LobeHub: Unauthenticated SSRF in `/webapi/proxy`","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54157"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54157"},{"id":"INC-16253","date":"2026-07","year":2026,"title":"vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54234"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54234"},{"id":"INC-16254","date":"2026-07","year":2026,"title":"VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54249"],"affected":"pydantic/pydantic-ai, pydantic/pydantic-ai-slim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54249"},{"id":"INC-16255","date":"2026-09","year":2026,"title":"NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54446"],"affected":"Labs64/NetLicensing-MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54446"},{"id":"INC-16256","date":"2026-08","year":2026,"title":"LangBot: Authenticated RCE Via MCP Configuration","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54449"],"affected":"langbot-app/LangBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54449"},{"id":"INC-16257","date":"2026-09","year":2026,"title":"ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54450"],"affected":"stacklok/toolhive","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54450"},{"id":"INC-16258","date":"2026-08","year":2026,"title":"TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54457"],"affected":"tensorzero","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54457"},{"id":"INC-16259","date":"2026-09","year":2026,"title":"MCP Documentation Server: Web UI API binds to all interfaces without authentication by default","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54504"],"affected":"andrea9293/mcp-documentation-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54504"},{"id":"INC-16260","date":"2026-09","year":2026,"title":"Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54547"],"affected":"pipeboard-co/meta-ads-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54547"},{"id":"INC-16261","date":"2026-09","year":2026,"title":"Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54549"],"affected":"pipeboard-co/meta-ads-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54549"},{"id":"INC-16262","date":"2026-09","year":2026,"title":"PocketSphinx: Buffer overflows in language and acoustic model loading code","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54559"],"affected":"cmusphinx/pocketsphinx","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54559"},{"id":"INC-16263","date":"2026-09","year":2026,"title":"MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54561"],"affected":"mkreyman/mcp-memory-keeper","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54561"},{"id":"INC-16264","date":"2026-07","year":2026,"title":"FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54601"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54601"},{"id":"INC-16265","date":"2026-07","year":2026,"title":"FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54602"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54602"},{"id":"INC-16266","date":"2026-07","year":2026,"title":"FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54607"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54607"},{"id":"INC-16267","date":"2026-09","year":2026,"title":"Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54618"],"affected":"jimprosser/obsidian-web-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54618"},{"id":"INC-16268","date":"2026-08","year":2026,"title":"n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54687"],"affected":"DangerBlack/n8n-node-sqlite3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54687"},{"id":"INC-16269","date":"2026-09","year":2026,"title":"mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54688"],"affected":"ihor-sokoliuk/mcp-searxng","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54688"},{"id":"INC-16270","date":"2026-09","year":2026,"title":"mcp-searxng hardened-mode SSRF bypasses permit internal URL access","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54689"],"affected":"ihor-sokoliuk/mcp-searxng","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54689"},{"id":"INC-16271","date":"2026-08","year":2026,"title":"Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-54745"],"affected":"kubeflow/pipelines","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54745"},{"id":"INC-16272","date":"2026-07","year":2026,"title":"Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54760"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54760"},{"id":"INC-16273","date":"2026-07","year":2026,"title":"Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-54769"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54769"},{"id":"INC-16274","date":"2026-07","year":2026,"title":"Langroid: handle_message() executes user-supplied tool JSON without sender verification","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54771"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54771"},{"id":"INC-16275","date":"2026-07","year":2026,"title":"gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-54785"],"affected":"eLyiN/gemini-bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54785"},{"id":"INC-16276","date":"2026-06","year":2026,"title":"WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-54842"],"affected":"Royal Plugins/Royal MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-54842"},{"id":"INC-16277","date":"2026-09","year":2026,"title":"MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55071"],"affected":"SepineTam/mcp-for-stata","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55071"},{"id":"INC-16278","date":"2026-09","year":2026,"title":"tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55093"],"affected":"sonos/tract","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55093"},{"id":"INC-16279","date":"2026-09","year":2026,"title":"SSRF via DNS-resolution gap in _validate_url_security (file download by URL)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55096"],"affected":"leshchenko1979/fast-mcp-telegram","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55096"},{"id":"INC-16280","date":"2026-09","year":2026,"title":"Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55156"],"affected":"ooples/token-optimizer-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55156"},{"id":"INC-16281","date":"2026-09","year":2026,"title":"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55157"],"affected":"ooples/token-optimizer-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55157"},{"id":"INC-16282","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55196"],"affected":"hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55196"},{"id":"INC-16283","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55197"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55197"},{"id":"INC-16284","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55198"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55198"},{"id":"INC-16285","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55205"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55205"},{"id":"INC-16286","date":"2026-09","year":2026,"title":"langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55235"],"affected":"langchain-ai/langgraph-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55235"},{"id":"INC-16287","date":"2026-09","year":2026,"title":"langgraph-api: Incomplete assistant authorization in LangGraph Server run creation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55236"],"affected":"langchain-ai/langgraph-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55236"},{"id":"INC-16288","date":"2026-09","year":2026,"title":"LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55253"],"affected":"langchain-ai/langchain-mongodb, langchain-ai/langgraph-checkpoint-mongodb, langchain-ai/langgraph-store-mongodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55253"},{"id":"INC-16289","date":"2026-04","year":2026,"title":"MoussaabBadla code-screenshot-mcp HTTP os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5528"],"affected":"MoussaabBadla/code-screenshot-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5528"},{"id":"INC-16290","date":"2026-07","year":2026,"title":"FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55418"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55418"},{"id":"INC-16291","date":"2026-07","year":2026,"title":"9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55500"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55500"},{"id":"INC-16292","date":"2026-07","year":2026,"title":"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55501"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55501"},{"id":"INC-16293","date":"2026-07","year":2026,"title":"vLLM denial of service via prompt embeds on M-RoPE models","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55514"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55514"},{"id":"INC-16294","date":"2026-08","year":2026,"title":"PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55522"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonaiagents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55522"},{"id":"INC-16295","date":"2026-08","year":2026,"title":"PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55523"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55523"},{"id":"INC-16296","date":"2026-08","year":2026,"title":"PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55524"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55524"},{"id":"INC-16297","date":"2026-08","year":2026,"title":"PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55525"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonaiagents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55525"},{"id":"INC-16298","date":"2026-08","year":2026,"title":"PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55526"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonaiagents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55526"},{"id":"INC-16299","date":"2026-08","year":2026,"title":"PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55527"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55527"},{"id":"INC-16300","date":"2026-08","year":2026,"title":"praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55528"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonaiagents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55528"},{"id":"INC-16301","date":"2026-08","year":2026,"title":"PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55529"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55529"},{"id":"INC-16302","date":"2026-08","year":2026,"title":"PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55530"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonaiagents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55530"},{"id":"INC-16303","date":"2026-08","year":2026,"title":"PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55531"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55531"},{"id":"INC-16304","date":"2026-08","year":2026,"title":"PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55532"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55532"},{"id":"INC-16305","date":"2026-08","year":2026,"title":"PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55533"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55533"},{"id":"INC-16306","date":"2026-08","year":2026,"title":"PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55534"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55534"},{"id":"INC-16307","date":"2026-08","year":2026,"title":"PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55535"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55535"},{"id":"INC-16308","date":"2026-08","year":2026,"title":"Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55536"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55536"},{"id":"INC-16309","date":"2026-08","year":2026,"title":"PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55537"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55537"},{"id":"INC-16310","date":"2026-08","year":2026,"title":"PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55538"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55538"},{"id":"INC-16311","date":"2026-08","year":2026,"title":"PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55539"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55539"},{"id":"INC-16312","date":"2026-08","year":2026,"title":"PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55540"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55540"},{"id":"INC-16313","date":"2026-08","year":2026,"title":"PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55541"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55541"},{"id":"INC-16314","date":"2026-08","year":2026,"title":"QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55546"],"affected":"QWED-AI/qwed-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55546"},{"id":"INC-16315","date":"2026-08","year":2026,"title":"browse-mcp: Arbitrary file write via unconfined download and state paths","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-55557"],"affected":"That1Drifter/browse-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55557"},{"id":"INC-16316","date":"2026-07","year":2026,"title":"vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55574"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55574"},{"id":"INC-16317","date":"2026-08","year":2026,"title":"mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55580"],"affected":"sonirico/mcp-shell","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55580"},{"id":"INC-16318","date":"2026-08","year":2026,"title":"mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55581"],"affected":"sonirico/mcp-shell","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55581"},{"id":"INC-16319","date":"2026-08","year":2026,"title":"mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-55582"],"affected":"sonirico/mcp-shell","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55582"},{"id":"INC-16320","date":"2026-08","year":2026,"title":"QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55585"],"affected":"QWED-AI/qwed-verification","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55585"},{"id":"INC-16321","date":"2026-07","year":2026,"title":"@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55604"],"affected":"arikusi/deepseek-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55604"},{"id":"INC-16322","date":"2026-07","year":2026,"title":"@arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55605"],"affected":"arikusi/deepseek-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55605"},{"id":"INC-16323","date":"2026-07","year":2026,"title":"n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55608"],"affected":"czlonkowski/n8n-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55608"},{"id":"INC-16324","date":"2026-07","year":2026,"title":"Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-55615"],"affected":"langroid","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55615"},{"id":"INC-16325","date":"2026-08","year":2026,"title":"genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55637"],"affected":"GeiserX/genieacs-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55637"},{"id":"INC-16326","date":"2026-07","year":2026,"title":"9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55638"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55638"},{"id":"INC-16327","date":"2026-08","year":2026,"title":"Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55640"],"affected":"cbcoutinho/nextcloud-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55640"},{"id":"INC-16328","date":"2026-07","year":2026,"title":"9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-55641"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55641"},{"id":"INC-16329","date":"2026-07","year":2026,"title":"vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-55646"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-55646"},{"id":"INC-16330","date":"2026-04","year":2026,"title":"Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-5585"],"affected":"Tencent/AI-Infra-Guard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5585"},{"id":"INC-16331","date":"2026-06","year":2026,"title":"PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56076"],"affected":"PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56076"},{"id":"INC-16332","date":"2026-04","year":2026,"title":"Braffolk mcp-summarization-functions summarize_command mcp-server.ts os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5619"],"affected":"Braffolk/mcp-summarization-functions","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5619"},{"id":"INC-16333","date":"2026-04","year":2026,"title":"ChrisChinchilla Vale-MCP HTTP index.ts os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5621"],"affected":"ChrisChinchilla/Vale-MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5621"},{"id":"INC-16334","date":"2026-07","year":2026,"title":"Crawl4AI - Arbitrary File Write via output_path Parameter","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56260"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56260"},{"id":"INC-16335","date":"2026-07","year":2026,"title":"Crawl4AI - Server-Side Request Forgery via Webhook URLs","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56261"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56261"},{"id":"INC-16336","date":"2026-06","year":2026,"title":"Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56262"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56262"},{"id":"INC-16337","date":"2026-06","year":2026,"title":"Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56263"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56263"},{"id":"INC-16338","date":"2026-06","year":2026,"title":"Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56264"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56264"},{"id":"INC-16339","date":"2026-06","year":2026,"title":"Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56265"],"affected":"Crawl4AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56265"},{"id":"INC-16340","date":"2026-04","year":2026,"title":"Path Traversal in mintplex-labs/anything-llm","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-5627"],"affected":"mintplex-labs/mintplex-labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5627"},{"id":"INC-16341","date":"2026-07","year":2026,"title":"Flowise - Weak Default JWT Secrets in Authentication Middleware","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56271"],"affected":"Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56271"},{"id":"INC-16342","date":"2026-07","year":2026,"title":"Flowise - Path Traversal in Vector Store basePath Parameter","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56273"],"affected":"Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56273"},{"id":"INC-16343","date":"2026-06","year":2026,"title":"picklescan - Arbitrary File Creation via logging.FileHandler Deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56304"],"affected":"picklescan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56304"},{"id":"INC-16344","date":"2026-07","year":2026,"title":"n8n - Authentication Bypass in Chat Trigger Node","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56353"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56353"},{"id":"INC-16345","date":"2026-07","year":2026,"title":"Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56398"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56398"},{"id":"INC-16346","date":"2026-06","year":2026,"title":"NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56402"],"affected":"nanocoai/nanoclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56402"},{"id":"INC-16347","date":"2026-07","year":2026,"title":"ComfyUI: Stored XSS via SVG file upload on the /view endpoint","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56670"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56670"},{"id":"INC-16348","date":"2026-07","year":2026,"title":"ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56671"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56671"},{"id":"INC-16349","date":"2026-07","year":2026,"title":"ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56672"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56672"},{"id":"INC-16350","date":"2026-07","year":2026,"title":"ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56673"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56673"},{"id":"INC-16351","date":"2026-07","year":2026,"title":"9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56675"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56675"},{"id":"INC-16352","date":"2026-07","year":2026,"title":"9router: Image prefetch DNS rebinding allows SSRF to internal services","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56676"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56676"},{"id":"INC-16353","date":"2026-08","year":2026,"title":"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56677"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56677"},{"id":"INC-16354","date":"2026-07","year":2026,"title":"9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-56678"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56678"},{"id":"INC-16355","date":"2026-07","year":2026,"title":"9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56679"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56679"},{"id":"INC-16356","date":"2026-09","year":2026,"title":"9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56681"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56681"},{"id":"INC-16357","date":"2026-09","year":2026,"title":"9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56682"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56682"},{"id":"INC-16358","date":"2026-06","year":2026,"title":"NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56692"],"affected":"nanocoai/nanoclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56692"},{"id":"INC-16359","date":"2026-06","year":2026,"title":"NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56693"],"affected":"nanocoai/nanoclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56693"},{"id":"INC-16360","date":"2026-06","year":2026,"title":"NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-56694"],"affected":"nanocoai/nanoclaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56694"},{"id":"INC-16361","date":"2026-06","year":2026,"title":"MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-56779"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-56779"},{"id":"INC-16362","date":"2026-09","year":2026,"title":"praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)","severity":"Critical","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-57148"],"affected":"MervinPraison/PraisonAI, MervinPraison/praisonai-platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57148"},{"id":"INC-16363","date":"2026-09","year":2026,"title":"vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-57173"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57173"},{"id":"INC-16364","date":"2026-09","year":2026,"title":"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-57441"],"affected":"bitbonsai/mcpvault","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57441"},{"id":"INC-16365","date":"2026-07","year":2026,"title":"Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-57516"],"affected":"Anyscale, Inc/Ray","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57516"},{"id":"INC-16366","date":"2026-04","year":2026,"title":"CVE-2026-5752","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5752"],"affected":"Cohere/cohere-terrarium","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5752"},{"id":"INC-16367","date":"2026-07","year":2026,"title":"Crawl4AI arbitrary file write via download filename path traversal","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-57571"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57571"},{"id":"INC-16368","date":"2026-07","year":2026,"title":"Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-57572"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57572"},{"id":"INC-16369","date":"2026-07","year":2026,"title":"Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-57573"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57573"},{"id":"INC-16370","date":"2026-07","year":2026,"title":"ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-57860"],"affected":"tailcallhq/forgecode","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-57860"},{"id":"INC-16371","date":"2026-04","year":2026,"title":"idachev mcp-javadc HTTP os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-5802"],"affected":"idachev/mcp-javadc","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5802"},{"id":"INC-16372","date":"2026-07","year":2026,"title":"Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-58122"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58122"},{"id":"INC-16373","date":"2026-07","year":2026,"title":"Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-58123"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58123"},{"id":"INC-16374","date":"2026-06","year":2026,"title":"Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58174"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58174"},{"id":"INC-16375","date":"2026-09","year":2026,"title":"ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-58196"],"affected":"stacklok/toolhive","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58196"},{"id":"INC-16376","date":"2026-09","year":2026,"title":"ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58197"],"affected":"stacklok/toolhive, stacklok/toolhive-studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58197"},{"id":"INC-16377","date":"2026-09","year":2026,"title":"Lokka: Azure Resource Manager URL path validation issue","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58201"],"affected":"merill/lokka","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58201"},{"id":"INC-16378","date":"2026-06","year":2026,"title":"CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-58373"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58373"},{"id":"INC-16379","date":"2026-04","year":2026,"title":"decolua 9router Administrative API Endpoint api authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-5842"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-5842"},{"id":"INC-16380","date":"2026-07","year":2026,"title":"LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58578"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58578"},{"id":"INC-16381","date":"2026-07","year":2026,"title":"RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58579"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58579"},{"id":"INC-16382","date":"2026-07","year":2026,"title":"LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58580"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58580"},{"id":"INC-16383","date":"2026-07","year":2026,"title":"M365 Copilot for iOS Elevation of Privilege Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-58617"],"affected":"Microsoft/Microsoft 365 Copilot for iOS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58617"},{"id":"INC-16384","date":"2026-07","year":2026,"title":"PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58653"],"affected":"PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58653"},{"id":"INC-16385","date":"2026-07","year":2026,"title":"PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-58659"],"affected":"Lightning-AI/pytorch-lightning","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58659"},{"id":"INC-16386","date":"2026-07","year":2026,"title":"n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-58661"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-58661"},{"id":"INC-16387","date":"2026-07","year":2026,"title":"Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59093"],"affected":"weaviate","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59093"},{"id":"INC-16388","date":"2026-07","year":2026,"title":"LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-59095"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59095"},{"id":"INC-16389","date":"2026-07","year":2026,"title":"LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59098"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59098"},{"id":"INC-16390","date":"2026-07","year":2026,"title":"LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59100"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59100"},{"id":"INC-16391","date":"2026-07","year":2026,"title":"Arbitrary server-side file read in LangSmith SDK TracingMiddleware","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59152"],"affected":"langchain-ai/langsmith-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59152"},{"id":"INC-16392","date":"2026-07","year":2026,"title":"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59206"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59206"},{"id":"INC-16393","date":"2026-07","year":2026,"title":"n8n: \"Allowed HTTP Request Domains\" Restriction Bypass via AI Agents MCP Connector","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59207"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59207"},{"id":"INC-16394","date":"2026-07","year":2026,"title":"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59208"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59208"},{"id":"INC-16395","date":"2026-07","year":2026,"title":"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59209"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59209"},{"id":"INC-16396","date":"2026-07","year":2026,"title":"Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59212"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59212"},{"id":"INC-16397","date":"2026-07","year":2026,"title":"Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59213"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59213"},{"id":"INC-16398","date":"2026-07","year":2026,"title":"Open WebUI: Stored web worker XSS via Pyodide","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59214"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59214"},{"id":"INC-16399","date":"2026-07","year":2026,"title":"Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59215"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59215"},{"id":"INC-16400","date":"2026-07","year":2026,"title":"Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59216"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59216"},{"id":"INC-16401","date":"2026-07","year":2026,"title":"Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59217"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59217"},{"id":"INC-16402","date":"2026-07","year":2026,"title":"Open WebUI: Account enumeration via observable login timing discrepancy","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59218"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59218"},{"id":"INC-16403","date":"2026-07","year":2026,"title":"Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59219"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59219"},{"id":"INC-16404","date":"2026-07","year":2026,"title":"Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59220"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59220"},{"id":"INC-16405","date":"2026-07","year":2026,"title":"open-webui terminal proxy path traversal guard bypass via 9x encoded traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59221"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59221"},{"id":"INC-16406","date":"2026-07","year":2026,"title":"Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59222"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59222"},{"id":"INC-16407","date":"2026-07","year":2026,"title":"Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59223"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59223"},{"id":"INC-16408","date":"2026-07","year":2026,"title":"Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59224"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59224"},{"id":"INC-16409","date":"2026-07","year":2026,"title":"Open WebUI: Arena task endpoints can bypass underlying model access controls","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59225"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59225"},{"id":"INC-16410","date":"2026-07","year":2026,"title":"Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59226"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59226"},{"id":"INC-16411","date":"2026-07","year":2026,"title":"Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59227"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59227"},{"id":"INC-16412","date":"2026-07","year":2026,"title":"n8n - Improper Authorization in Workflow Assignment to Folders","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59253"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59253"},{"id":"INC-16413","date":"2026-07","year":2026,"title":"n8n - External Secrets Disclosure via Workflow Node Expressions","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-59254"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59254"},{"id":"INC-16414","date":"2026-07","year":2026,"title":"n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-59257"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59257"},{"id":"INC-16415","date":"2026-07","year":2026,"title":"n8n - Permission Bypass via Expression Parser Mismatch in External Secrets","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59259"],"affected":"n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59259"},{"id":"INC-16416","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59261"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59261"},{"id":"INC-16417","date":"2026-09","year":2026,"title":"HMAC Confirmation Token Unbinding in zscaler-mcp-server","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59563"],"affected":"Zscaler/zscaler-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59563"},{"id":"INC-16418","date":"2026-07","year":2026,"title":"mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59705"],"affected":"mem0","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59705"},{"id":"INC-16419","date":"2026-07","year":2026,"title":"mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-59706"],"affected":"mem0","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59706"},{"id":"INC-16420","date":"2026-07","year":2026,"title":"LocalAI - Server-Side Request Forgery via POST /models/apply","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-59707"],"affected":"LocalAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59707"},{"id":"INC-16421","date":"2026-08","year":2026,"title":"Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59714"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59714"},{"id":"INC-16422","date":"2026-07","year":2026,"title":"Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59715"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59715"},{"id":"INC-16423","date":"2026-07","year":2026,"title":"Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59726"],"affected":"ruvnet/ruflo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59726"},{"id":"INC-16424","date":"2026-07","year":2026,"title":"9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-59800"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59800"},{"id":"INC-16425","date":"2026-07","year":2026,"title":"9Router 0.4.41 - Unauthenticated API Exposure via /api/providers","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59801"],"affected":"decolua/9Router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59801"},{"id":"INC-16426","date":"2026-07","year":2026,"title":"Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-59806"],"affected":"gradio-app/gradio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59806"},{"id":"INC-16427","date":"2026-07","year":2026,"title":"Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-59807"],"affected":"ComposioHQ/composio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59807"},{"id":"INC-16428","date":"2026-07","year":2026,"title":"LiteLLM: Local file read via request-supplied OIDC file references","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59819"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59819"},{"id":"INC-16429","date":"2026-07","year":2026,"title":"LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-59820"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59820"},{"id":"INC-16430","date":"2026-07","year":2026,"title":"LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks","severity":"Low","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-59821"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59821"},{"id":"INC-16431","date":"2026-07","year":2026,"title":"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59822"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59822"},{"id":"INC-16432","date":"2026-09","year":2026,"title":"LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59823"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59823"},{"id":"INC-16433","date":"2026-07","year":2026,"title":"MCP Python SDK: WebSocket server transport does not support Host/Origin validation","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59950"],"affected":"modelcontextprotocol/python-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59950"},{"id":"INC-16434","date":"2026-09","year":2026,"title":"MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-59971"],"affected":"designcomputer/mysql_mcp_server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59971"},{"id":"INC-16435","date":"2026-09","year":2026,"title":"mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-59973"],"affected":"agentfront/frontmcp, agentfront/mcp-from-openapi, @frontmcp/adapters","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-59973"},{"id":"INC-16436","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-60085"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60085"},{"id":"INC-16437","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Prompt Injection Defense Bypass","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-60086"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60086"},{"id":"INC-16438","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Tool Approval Cache Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-60087"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60087"},{"id":"INC-16439","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Path Traversal via Custom Commands","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-60088"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60088"},{"id":"INC-16440","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Path Traversal via config.toml","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-60089"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60089"},{"id":"INC-16441","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension","severity":"Critical","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-60090"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60090"},{"id":"INC-16442","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-60091"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-60091"},{"id":"INC-16443","date":"2026-04","year":2026,"title":"1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6106"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6106"},{"id":"INC-16444","date":"2026-04","year":2026,"title":"1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6107"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6107"},{"id":"INC-16445","date":"2026-04","year":2026,"title":"AstrBotDevs AstrBot install-upload Endpoint plugin.py install_plugin_upload sandbox","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6117"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6117"},{"id":"INC-16446","date":"2026-04","year":2026,"title":"AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6118"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6118"},{"id":"INC-16447","date":"2026-04","year":2026,"title":"AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6119"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6119"},{"id":"INC-16448","date":"2026-07","year":2026,"title":"PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61426"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61426"},{"id":"INC-16449","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61427"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61427"},{"id":"INC-16450","date":"2026-07","year":2026,"title":"PraisonAI AgentMail before 4.6.78 Message Injection via Webhook","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61428"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61428"},{"id":"INC-16451","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61429"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61429"},{"id":"INC-16452","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61430"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61430"},{"id":"INC-16453","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Path Traversal via ContextGatherer","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61431"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61431"},{"id":"INC-16454","date":"2026-07","year":2026,"title":"PraisonAI FastContext before 1.6.78 Path Traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61432"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61432"},{"id":"INC-16455","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Code Injection via API deployment generator","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61433"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61433"},{"id":"INC-16456","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Allowlist Bypass via find -exec","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61434"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61434"},{"id":"INC-16457","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61435"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61435"},{"id":"INC-16458","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Missing Webhook Signature Verification","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61436"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61436"},{"id":"INC-16459","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Remote Code Execution via tools.py","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61437"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61437"},{"id":"INC-16460","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61438"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61438"},{"id":"INC-16461","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Prompt Injection Defense Bypass","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-61439"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61439"},{"id":"INC-16462","date":"2026-07","year":2026,"title":"PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61440"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61440"},{"id":"INC-16463","date":"2026-07","year":2026,"title":"PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61441"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61441"},{"id":"INC-16464","date":"2026-07","year":2026,"title":"PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61442"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61442"},{"id":"INC-16465","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Remote Code Execution via SkillTools","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61443"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61443"},{"id":"INC-16466","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Code Injection via f-string","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61444"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61444"},{"id":"INC-16467","date":"2026-07","year":2026,"title":"PraisonAI before 4.6.78 Arbitrary File Write and Command Execution","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61445"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61445"},{"id":"INC-16468","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61446"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61446"},{"id":"INC-16469","date":"2026-07","year":2026,"title":"PraisonAI before 1.6.78 Remote Code Execution via CodeAgent","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-61447"],"affected":"MervinPraison/PraisonAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61447"},{"id":"INC-16470","date":"2026-07","year":2026,"title":"MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61459"],"affected":"Flux159/mcp-server-kubernetes","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61459"},{"id":"INC-16471","date":"2026-07","year":2026,"title":"Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61461"],"affected":"langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61461"},{"id":"INC-16472","date":"2026-07","year":2026,"title":"mcp-gitlab Path Traversal via job_id Parameter","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61462"],"affected":"zereight/mcp-gitlab","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61462"},{"id":"INC-16473","date":"2026-07","year":2026,"title":"Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61536"],"affected":"masci/banks","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61536"},{"id":"INC-16474","date":"2026-08","year":2026,"title":"Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61539"],"affected":"xorbitsai/inference","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61539"},{"id":"INC-16475","date":"2026-09","year":2026,"title":"@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61559"],"affected":"zereight/gitlab-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61559"},{"id":"INC-16476","date":"2026-09","year":2026,"title":"@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61560"],"affected":"zereight/gitlab-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61560"},{"id":"INC-16477","date":"2026-09","year":2026,"title":"@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61568"],"affected":"zereight/gitlab-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61568"},{"id":"INC-16478","date":"2026-09","year":2026,"title":"@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61612"],"affected":"ondata/ckan-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61612"},{"id":"INC-16479","date":"2026-07","year":2026,"title":"FastGPT: workflow runtime can execute another user's private HTTP toolset","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61643"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61643"},{"id":"INC-16480","date":"2026-07","year":2026,"title":"FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61644"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61644"},{"id":"INC-16481","date":"2026-07","year":2026,"title":"FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61646"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61646"},{"id":"INC-16482","date":"2026-09","year":2026,"title":"@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61647"],"affected":"roomi-fields/notebooklm-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61647"},{"id":"INC-16483","date":"2026-07","year":2026,"title":"FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61684"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61684"},{"id":"INC-16484","date":"2026-09","year":2026,"title":"Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-61732"],"affected":"BitterSecurity/Decepticon, BitterSecurity/decepticon-core, BitterSecurity/decepticon-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61732"},{"id":"INC-16485","date":"2026-07","year":2026,"title":"LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61736"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61736"},{"id":"INC-16486","date":"2026-07","year":2026,"title":"LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-61740"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61740"},{"id":"INC-16487","date":"2026-09","year":2026,"title":"DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-61742"],"affected":"bytebase/dbhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61742"},{"id":"INC-16488","date":"2026-09","year":2026,"title":"@bytebase/dbhub's read-only mode does not prevent database writes","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-61788"],"affected":"bytebase/dbhub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61788"},{"id":"INC-16489","date":"2026-08","year":2026,"title":"LightRAG: Missing Authentication for Critical API Functions in Default Configuration","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-61808"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-61808"},{"id":"INC-16490","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62186"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62186"},{"id":"INC-16491","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.9 Feishu tools Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62187"],"affected":"openclaw/feishu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62187"},{"id":"INC-16492","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.9 Feishu Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62188"],"affected":"openclaw/feishu","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62188"},{"id":"INC-16493","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.9 Symlink Following via Mirror Sync","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62189"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62189"},{"id":"INC-16494","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62190"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62190"},{"id":"INC-16495","date":"2026-07","year":2026,"title":"OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62191"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62191"},{"id":"INC-16496","date":"2026-07","year":2026,"title":"OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62192"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62192"},{"id":"INC-16497","date":"2026-07","year":2026,"title":"OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62193"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62193"},{"id":"INC-16498","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62194"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62194"},{"id":"INC-16499","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62195"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62195"},{"id":"INC-16500","date":"2026-07","year":2026,"title":"OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62196"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62196"},{"id":"INC-16501","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62197"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62197"},{"id":"INC-16502","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62198"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62198"},{"id":"INC-16503","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62199"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62199"},{"id":"INC-16504","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62200"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62200"},{"id":"INC-16505","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.6 Network Policy Bypass via exec-server","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62201"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62201"},{"id":"INC-16506","date":"2026-07","year":2026,"title":"OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62202"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62202"},{"id":"INC-16507","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.6 Environment Variable Injection via rustup","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62203"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62203"},{"id":"INC-16508","date":"2026-07","year":2026,"title":"OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62205"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62205"},{"id":"INC-16509","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62206"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62206"},{"id":"INC-16510","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62207"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62207"},{"id":"INC-16511","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62209"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62209"},{"id":"INC-16512","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62210"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62210"},{"id":"INC-16513","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62211"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62211"},{"id":"INC-16514","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.28 Authentication Bypass via safeFetch","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62212"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62212"},{"id":"INC-16515","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62213"],"affected":"openclaw/msteams","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62213"},{"id":"INC-16516","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62214"],"affected":"openclaw/msteams","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62214"},{"id":"INC-16517","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62215"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62215"},{"id":"INC-16518","date":"2026-07","year":2026,"title":"OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-62216"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62216"},{"id":"INC-16519","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62217"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62217"},{"id":"INC-16520","date":"2026-07","year":2026,"title":"OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62218"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62218"},{"id":"INC-16521","date":"2026-07","year":2026,"title":"OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62219"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62219"},{"id":"INC-16522","date":"2026-07","year":2026,"title":"OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62220"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62220"},{"id":"INC-16523","date":"2026-07","year":2026,"title":"OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62221"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62221"},{"id":"INC-16524","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62222"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62222"},{"id":"INC-16525","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.18 Authorization Bypass via Device-pair","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62223"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62223"},{"id":"INC-16526","date":"2026-07","year":2026,"title":"OpenClaw MS Teams < 2026.5.12 Authorization Bypass","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62224"],"affected":"openclaw/msteams","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62224"},{"id":"INC-16527","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62225"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62225"},{"id":"INC-16528","date":"2026-07","year":2026,"title":"OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62226"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62226"},{"id":"INC-16529","date":"2026-07","year":2026,"title":"OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-62227"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62227"},{"id":"INC-16530","date":"2026-07","year":2026,"title":"OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62228"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62228"},{"id":"INC-16531","date":"2026-07","year":2026,"title":"OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-62229"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62229"},{"id":"INC-16532","date":"2026-07","year":2026,"title":"CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-62240"],"affected":"crewAIInc/crewAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62240"},{"id":"INC-16533","date":"2026-07","year":2026,"title":"9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-62312"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62312"},{"id":"INC-16534","date":"2026-07","year":2026,"title":"9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62327"],"affected":"decolua/9Router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62327"},{"id":"INC-16535","date":"2026-07","year":2026,"title":"9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-62328"],"affected":"decolua/9Router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62328"},{"id":"INC-16536","date":"2026-08","year":2026,"title":"Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-62674"],"affected":"omnigent-ai/omnigent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62674"},{"id":"INC-16537","date":"2026-09","year":2026,"title":"Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-62997"],"affected":"kedro-org/kedro-plugins","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-62997"},{"id":"INC-16538","date":"2026-07","year":2026,"title":"text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-63086"],"affected":"huggingface/text-generation-inference","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63086"},{"id":"INC-16539","date":"2026-07","year":2026,"title":"Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-63108"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63108"},{"id":"INC-16540","date":"2026-07","year":2026,"title":"MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-63118"],"affected":"modelcontextprotocol/ruby-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63118"},{"id":"INC-16541","date":"2026-07","year":2026,"title":"MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-63119"],"affected":"modelcontextprotocol/ruby-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63119"},{"id":"INC-16542","date":"2026-09","year":2026,"title":"RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery","severity":"High","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-63127"],"affected":"modelcontextprotocol/rust-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63127"},{"id":"INC-16543","date":"2026-09","year":2026,"title":"RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-63128"],"affected":"modelcontextprotocol/rust-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63128"},{"id":"INC-16544","date":"2026-07","year":2026,"title":"9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-63313"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63313"},{"id":"INC-16545","date":"2026-08","year":2026,"title":"ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-63632"],"affected":"onnx","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63632"},{"id":"INC-16546","date":"2026-07","year":2026,"title":"9router before 0.4.60 Remote Code Execution via default password","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-63732"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63732"},{"id":"INC-16547","date":"2026-07","year":2026,"title":"LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-63764"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-63764"},{"id":"INC-16548","date":"2026-07","year":2026,"title":"AI SDK Codex Harness Tool Relay Authorization Bypass","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-64650"],"affected":"vercel/@ai-sdk/harness-codex","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64650"},{"id":"INC-16549","date":"2026-09","year":2026,"title":"RMCP: Custom HTTP headers leak to cross-origin redirect targets","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-64684"],"affected":"modelcontextprotocol/rust-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64684"},{"id":"INC-16550","date":"2026-08","year":2026,"title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64849"],"affected":"mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64849"},{"id":"INC-16551","date":"2026-08","year":2026,"title":"New API: User List API Leaks Root User Access Token Leading to Privilege Escalation","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64859"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64859"},{"id":"INC-16552","date":"2026-08","year":2026,"title":"New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64865"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64865"},{"id":"INC-16553","date":"2026-08","year":2026,"title":"New API: Admin can reset passkeys for same-level or higher-privileged users","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64866"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64866"},{"id":"INC-16554","date":"2026-08","year":2026,"title":"New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64868"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64868"},{"id":"INC-16555","date":"2026-07","year":2026,"title":"MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-64870"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-64870"},{"id":"INC-16556","date":"2026-07","year":2026,"title":"Datasets Symlink-following Arbitrary File Write via Extractor.extract()","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65010"],"affected":"huggingface/datasets","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65010"},{"id":"INC-16557","date":"2026-07","year":2026,"title":"InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65012"],"affected":"invoke-ai/InvokeAI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65012"},{"id":"INC-16558","date":"2026-07","year":2026,"title":"n8n before 2.28.0 Authentication Bypass via test-webhook","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65014"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65014"},{"id":"INC-16559","date":"2026-07","year":2026,"title":"n8n before 2.30.1 Privilege Escalation via run_node_tool","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65015"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65015"},{"id":"INC-16560","date":"2026-07","year":2026,"title":"n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65016"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65016"},{"id":"INC-16561","date":"2026-07","year":2026,"title":"mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-65056"],"affected":"mzxrai/mcp-webresearch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65056"},{"id":"INC-16562","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65081"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65081"},{"id":"INC-16563","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65082"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65082"},{"id":"INC-16564","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65084"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65084"},{"id":"INC-16565","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials .","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-65087"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65087"},{"id":"INC-16566","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information.","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65088"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65088"},{"id":"INC-16567","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65089"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65089"},{"id":"INC-16568","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65090"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65090"},{"id":"INC-16569","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65096"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65096"},{"id":"INC-16570","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65097"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65097"},{"id":"INC-16571","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65098"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65098"},{"id":"INC-16572","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection.","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65099"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65099"},{"id":"INC-16573","date":"2026-08","year":2026,"title":"NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authentication.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65105"],"affected":"NVIDIA/NemoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65105"},{"id":"INC-16574","date":"2026-09","year":2026,"title":"NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65111"],"affected":"NVIDIA/NeMo Speech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65111"},{"id":"INC-16575","date":"2026-09","year":2026,"title":"NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters.","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04","LLM05"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-65178"],"affected":"NVIDIA/NeMo Speech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65178"},{"id":"INC-16576","date":"2026-09","year":2026,"title":"NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation.","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65179"],"affected":"NVIDIA/NeMo Speech","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65179"},{"id":"INC-16577","date":"2026-07","year":2026,"title":"Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65315"],"affected":"Ollama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65315"},{"id":"INC-16578","date":"2026-07","year":2026,"title":"Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65317"],"affected":"Weaviate/Verba","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65317"},{"id":"INC-16579","date":"2026-07","year":2026,"title":"Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-65318"],"affected":"Weaviate/Verba","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65318"},{"id":"INC-16580","date":"2026-07","year":2026,"title":"n8n before 1.123.64 Credential Exposure via LLM Node Execution Data","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65589"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65589"},{"id":"INC-16581","date":"2026-07","year":2026,"title":"n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65590"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65590"},{"id":"INC-16582","date":"2026-07","year":2026,"title":"n8n before 1.123.64 Sanitizer Bypass Remote Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65591"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65591"},{"id":"INC-16583","date":"2026-07","year":2026,"title":"n8n before 1.123.64 Stored DOM XSS via cachedResultUrl","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65592"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65592"},{"id":"INC-16584","date":"2026-07","year":2026,"title":"n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65593"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65593"},{"id":"INC-16585","date":"2026-07","year":2026,"title":"n8n before 2.30.1 Missing OAuth Authorization Check","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65594"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65594"},{"id":"INC-16586","date":"2026-07","year":2026,"title":"n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-65595"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65595"},{"id":"INC-16587","date":"2026-07","year":2026,"title":"n8n before 1.123.64 Credential Exfiltration via GraphQL Node","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65596"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65596"},{"id":"INC-16588","date":"2026-07","year":2026,"title":"n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65597"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65597"},{"id":"INC-16589","date":"2026-07","year":2026,"title":"n8n before 1.123.64 Remote Code Execution via Git Clone","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65598"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65598"},{"id":"INC-16590","date":"2026-07","year":2026,"title":"n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header","severity":"Medium","attack_vector":"deepfake","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-65599"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65599"},{"id":"INC-16591","date":"2026-08","year":2026,"title":"CoPilot Chat Security Feature Bypass Vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65675"],"affected":"Microsoft/Microsoft Visual Studio Code CoPilot Chat Extension","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65675"},{"id":"INC-16592","date":"2026-07","year":2026,"title":"Office-Word-MCP-Server 1.1.11 Path Traversal via document tools","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65695"],"affected":"GongRzhe/Office-Word-MCP-Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65695"},{"id":"INC-16593","date":"2026-07","year":2026,"title":"Void 1.3.4 Path Traversal via AI Agent File-Reading Tools","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-65698"],"affected":"voideditor/void","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65698"},{"id":"INC-16594","date":"2026-07","year":2026,"title":"h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-65700"],"affected":"h2oai/h2ogpt","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65700"},{"id":"INC-16595","date":"2026-07","year":2026,"title":"Vanna 2.0.2 Path Traversal via FileSystemConversationStore","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65702"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65702"},{"id":"INC-16596","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6583"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6583"},{"id":"INC-16597","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6584"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6584"},{"id":"INC-16598","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6585"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6585"},{"id":"INC-16599","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6586"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6586"},{"id":"INC-16600","date":"2026-07","year":2026,"title":"PyTorch torchvision GIF Decoder Out-of-bounds Heap Read","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65918"],"affected":"pytorch/vision","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65918"},{"id":"INC-16601","date":"2026-07","year":2026,"title":"Diffusers Path Traversal via weight_map Arbitrary File Read","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65920"],"affected":"huggingface/diffusers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65920"},{"id":"INC-16602","date":"2026-07","year":2026,"title":"Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-65975"],"affected":"pydantic/pydantic-ai, pydantic/pydantic-ai-slim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65975"},{"id":"INC-16603","date":"2026-08","year":2026,"title":"CVAT has stored XSS via annotation guide assets","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-65986"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-65986"},{"id":"INC-16604","date":"2026-07","year":2026,"title":"BlenderMCP Path Traversal via download_polyhaven_asset API","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-66004"],"affected":"ahujasid/blender-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-66004"},{"id":"INC-16605","date":"2026-07","year":2026,"title":"Datasets Path Traversal via Unsanitized file_name Metadata","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-66007"],"affected":"huggingface/datasets","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-66007"},{"id":"INC-16606","date":"2026-04","year":2026,"title":"lm-sys fastchat Worker API Endpoint api_generate resource consumption","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6607"],"affected":"lm-sys/fastchat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6607"},{"id":"INC-16607","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6612"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6612"},{"id":"INC-16608","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI agent.py get_schedule_data authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6613"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6613"},{"id":"INC-16609","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI project.py get_projects_organisation authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6614"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6614"},{"id":"INC-16610","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6615"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6615"},{"id":"INC-16611","date":"2026-04","year":2026,"title":"TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6616"],"affected":"TransformerOptimus/SuperAGI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6616"},{"id":"INC-16612","date":"2026-08","year":2026,"title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-6639"],"affected":"wupsales/AI Copilot – Content Generator","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6639"},{"id":"INC-16613","date":"2026-07","year":2026,"title":"OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-66418"],"affected":"tugcantopaloglu/openclaw-dashboard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-66418"},{"id":"INC-16614","date":"2026-07","year":2026,"title":"OpenClaw Dashboard Stored XSS via lastMessage Session Field","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-66421"],"affected":"tugcantopaloglu/openclaw-dashboard","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-66421"},{"id":"INC-16615","date":"2026-07","year":2026,"title":"Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-67425"],"affected":"flytohub/flyto-core","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67425"},{"id":"INC-16616","date":"2026-07","year":2026,"title":"MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67430"],"affected":"modelcontextprotocol/ruby-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67430"},{"id":"INC-16617","date":"2026-07","year":2026,"title":"MCP Ruby SDK: Ruby SSE Session Poisoning","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67431"],"affected":"modelcontextprotocol/ruby-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67431"},{"id":"INC-16618","date":"2026-07","year":2026,"title":"MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67432"],"affected":"modelcontextprotocol/ruby-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67432"},{"id":"INC-16619","date":"2026-08","year":2026,"title":"FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-67531"],"affected":"agentfront/frontmcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67531"},{"id":"INC-16620","date":"2026-08","year":2026,"title":"Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-67598"],"affected":"emlog","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67598"},{"id":"INC-16621","date":"2026-08","year":2026,"title":"Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-67620"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67620"},{"id":"INC-16622","date":"2026-08","year":2026,"title":"Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67621"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67621"},{"id":"INC-16623","date":"2026-08","year":2026,"title":"Flowise 3.1.4 IDOR in OpenAI Assistants Integration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-67622"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67622"},{"id":"INC-16624","date":"2026-08","year":2026,"title":"Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-67623"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67623"},{"id":"INC-16625","date":"2026-09","year":2026,"title":"crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67987"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67987"},{"id":"INC-16626","date":"2026-10","year":2026,"title":"crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67989"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67989"},{"id":"INC-16627","date":"2026-08","year":2026,"title":"crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby ...","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-67991"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-67991"},{"id":"INC-16628","date":"2026-04","year":2026,"title":"nesquena hermes-webui Arbitrary Workspace Directory Access","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6829"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6829"},{"id":"INC-16629","date":"2026-04","year":2026,"title":"Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6830"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6830"},{"id":"INC-16630","date":"2026-04","year":2026,"title":"Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6832"],"affected":"nesquena/hermes-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6832"},{"id":"INC-16631","date":"2026-07","year":2026,"title":"sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-68770"],"affected":"Hugging Face/sentence-transformers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-68770"},{"id":"INC-16632","date":"2026-07","year":2026,"title":"ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-68771"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-68771"},{"id":"INC-16633","date":"2026-08","year":2026,"title":"ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-68772"],"affected":"ZenML","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-68772"},{"id":"INC-16634","date":"2026-08","year":2026,"title":"FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-68929"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-68929"},{"id":"INC-16635","date":"2026-08","year":2026,"title":"Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69111"],"affected":"milvus-io/milvus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69111"},{"id":"INC-16636","date":"2026-08","year":2026,"title":"Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-69112"],"affected":"huggingface/accelerate","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69112"},{"id":"INC-16637","date":"2026-08","year":2026,"title":"MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69146"],"affected":"mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69146"},{"id":"INC-16638","date":"2026-09","year":2026,"title":"vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69147"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69147"},{"id":"INC-16639","date":"2026-08","year":2026,"title":"MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69148"],"affected":"mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69148"},{"id":"INC-16640","date":"2026-08","year":2026,"title":"Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-69250"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69250"},{"id":"INC-16641","date":"2026-08","year":2026,"title":"Flowise RCE via TypeORM DataSource","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-69251"],"affected":"FlowiseAI/Flowise, FlowiseAI/flowise-components","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69251"},{"id":"INC-16642","date":"2026-08","year":2026,"title":"Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-69252"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69252"},{"id":"INC-16643","date":"2026-08","year":2026,"title":"Flowise Sandbox Escape to RCE","severity":"Critical","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-69253"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69253"},{"id":"INC-16644","date":"2026-08","year":2026,"title":"Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69254"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69254"},{"id":"INC-16645","date":"2026-08","year":2026,"title":"Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69255"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69255"},{"id":"INC-16646","date":"2026-08","year":2026,"title":"Flowise: Remote Code Execution Vulnerability in CSVAgent","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-69256"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69256"},{"id":"INC-16647","date":"2026-08","year":2026,"title":"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69257"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69257"},{"id":"INC-16648","date":"2026-08","year":2026,"title":"Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69258"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69258"},{"id":"INC-16649","date":"2026-08","year":2026,"title":"Flowise RCE via SQLite Record Manager Node","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69259"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69259"},{"id":"INC-16650","date":"2026-08","year":2026,"title":"Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69262"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69262"},{"id":"INC-16651","date":"2026-08","year":2026,"title":"Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-69263"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69263"},{"id":"INC-16652","date":"2026-08","year":2026,"title":"Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-69264"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-69264"},{"id":"INC-16653","date":"2026-04","year":2026,"title":"radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6942"],"affected":"radareorg/radare2-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6942"},{"id":"INC-16654","date":"2026-04","year":2026,"title":"vanna-ai vanna Legacy Flask API improper authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-6977"],"affected":"vanna-ai/vanna","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6977"},{"id":"INC-16655","date":"2026-04","year":2026,"title":"Divyanshu-hash GitPilot-MCP main.py repo_path command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-6980"],"affected":"Divyanshu-hash/GitPilot-MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6980"},{"id":"INC-16656","date":"2026-04","year":2026,"title":"AstrBotDevs AstrBot Dashboard API t2i.py create_template special elements used in a template engine","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-6984"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-6984"},{"id":"INC-16657","date":"2026-04","year":2026,"title":"tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7038"],"affected":"tufantunc/ssh-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7038"},{"id":"INC-16658","date":"2026-04","year":2026,"title":"tufantunc ssh-mcp index.ts shell.write command injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7039"],"affected":"tufantunc/ssh-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7039"},{"id":"INC-16659","date":"2026-08","year":2026,"title":"Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-70470"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70470"},{"id":"INC-16660","date":"2026-08","year":2026,"title":"Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-70471"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70471"},{"id":"INC-16661","date":"2026-08","year":2026,"title":"Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70472"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70472"},{"id":"INC-16662","date":"2026-08","year":2026,"title":"Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70473"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70473"},{"id":"INC-16663","date":"2026-08","year":2026,"title":"Flowise: Cross-Workspace OAuth2 Credential Metadata Leak","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70474"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70474"},{"id":"INC-16664","date":"2026-08","year":2026,"title":"Flowise: Missing Authorization on Execution Update Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70475"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70475"},{"id":"INC-16665","date":"2026-08","year":2026,"title":"Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70476"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70476"},{"id":"INC-16666","date":"2026-08","year":2026,"title":"Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-70477"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70477"},{"id":"INC-16667","date":"2026-08","year":2026,"title":"Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service","severity":"Critical","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70478"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70478"},{"id":"INC-16668","date":"2026-08","year":2026,"title":"Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70479"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70479"},{"id":"INC-16669","date":"2026-08","year":2026,"title":"Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70480"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70480"},{"id":"INC-16670","date":"2026-08","year":2026,"title":"Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70481"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70481"},{"id":"INC-16671","date":"2026-08","year":2026,"title":"Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70482"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70482"},{"id":"INC-16672","date":"2026-08","year":2026,"title":"Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint","severity":"Low","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70483"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70483"},{"id":"INC-16673","date":"2026-08","year":2026,"title":"Open WebUI: Users denied the image-generation permission can still generate images via chat completions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70484"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70484"},{"id":"INC-16674","date":"2026-08","year":2026,"title":"Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70485"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70485"},{"id":"INC-16675","date":"2026-08","year":2026,"title":"Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-70486"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70486"},{"id":"INC-16676","date":"2026-08","year":2026,"title":"Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70487"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70487"},{"id":"INC-16677","date":"2026-08","year":2026,"title":"Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70488"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70488"},{"id":"INC-16678","date":"2026-08","year":2026,"title":"Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70489"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70489"},{"id":"INC-16679","date":"2026-08","year":2026,"title":"Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70490"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70490"},{"id":"INC-16680","date":"2026-08","year":2026,"title":"Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70491"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70491"},{"id":"INC-16681","date":"2026-08","year":2026,"title":"Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70492"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70492"},{"id":"INC-16682","date":"2026-08","year":2026,"title":"Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70493"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70493"},{"id":"INC-16683","date":"2026-08","year":2026,"title":"Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70494"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70494"},{"id":"INC-16684","date":"2026-08","year":2026,"title":"Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-70636"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70636"},{"id":"INC-16685","date":"2026-08","year":2026,"title":"llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-70638"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70638"},{"id":"INC-16686","date":"2026-08","year":2026,"title":"llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-70639"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70639"},{"id":"INC-16687","date":"2026-04","year":2026,"title":"AgentDeskAI browser-tools-mcp browser-connector.ts os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7064"],"affected":"AgentDeskAI/browser-tools-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7064"},{"id":"INC-16688","date":"2026-08","year":2026,"title":"llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-70640"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-70640"},{"id":"INC-16689","date":"2026-04","year":2026,"title":"choieastsea simple-openstack-mcp server.py exec_openstack os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7066"],"affected":"choieastsea/simple-openstack-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7066"},{"id":"INC-16690","date":"2026-04","year":2026,"title":"NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7112"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7112"},{"id":"INC-16691","date":"2026-04","year":2026,"title":"NousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7113"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7113"},{"id":"INC-16692","date":"2026-08","year":2026,"title":"mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-71211"],"affected":"mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71211"},{"id":"INC-16693","date":"2026-08","year":2026,"title":"peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-71281"],"affected":"huggingface/peft","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71281"},{"id":"INC-16694","date":"2026-09","year":2026,"title":"Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-71416"],"affected":"headroomlabs-ai/headroom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71416"},{"id":"INC-16695","date":"2026-08","year":2026,"title":"LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-71433"],"affected":"langchain-ai/langgraph, langchain-ai/langgraph-checkpoint-sqlite, langchain-ai/langgraph-checkpoint-postgres","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71433"},{"id":"INC-16696","date":"2026-04","year":2026,"title":"AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7146"],"affected":"AlejandroArciniegas/mcp-data-vis","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7146"},{"id":"INC-16697","date":"2026-08","year":2026,"title":"New API: Integer overflow in quota billing yields negative charges (self-crediting)","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-71479"],"affected":"QuantumNous/new-api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71479"},{"id":"INC-16698","date":"2026-08","year":2026,"title":"vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-71486"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71486"},{"id":"INC-16699","date":"2026-08","year":2026,"title":"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-71539"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71539"},{"id":"INC-16700","date":"2026-04","year":2026,"title":"disler aider-mcp-server aider_ai_code server.py command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7157"],"affected":"disler/aider-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7157"},{"id":"INC-16701","date":"2026-04","year":2026,"title":"dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7158"],"affected":"dmitryglhf/mcp-url-downloader","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7158"},{"id":"INC-16702","date":"2026-04","year":2026,"title":"douinc mkdocs-mcp-plugin server.py list_documents path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7159"],"affected":"douinc/mkdocs-mcp-plugin","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7159"},{"id":"INC-16703","date":"2026-08","year":2026,"title":"Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-71962"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71962"},{"id":"INC-16704","date":"2026-09","year":2026,"title":"Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-71963"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-71963"},{"id":"INC-16705","date":"2026-04","year":2026,"title":"duartium papers-mcp-server main.py search_papers path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7205"],"affected":"duartium/papers-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7205"},{"id":"INC-16706","date":"2026-04","year":2026,"title":"dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7211"],"affected":"dvladimirov/MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7211"},{"id":"INC-16707","date":"2026-04","year":2026,"title":"ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7213"],"affected":"ef10007/MLOps_MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7213"},{"id":"INC-16708","date":"2026-04","year":2026,"title":"eghuzefa engineer-your-data server.py file_inf path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7214"],"affected":"eghuzefa/engineer-your-data","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7214"},{"id":"INC-16709","date":"2026-04","year":2026,"title":"egtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7215"],"affected":"egtai/gmx-vmd-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7215"},{"id":"INC-16710","date":"2026-04","year":2026,"title":"donchelo processing-claude-mcp-bridge create_sketch Tool processing_server.py path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7216"],"affected":"donchelo/processing-claude-mcp-bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7216"},{"id":"INC-16711","date":"2026-04","year":2026,"title":"AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7237"],"affected":"AgiFlow/scaffold-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7237"},{"id":"INC-16712","date":"2026-08","year":2026,"title":"HumanSignal Label Studio - Server-Side Request Forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72560"],"affected":"HumanSignal/Label Studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72560"},{"id":"INC-16713","date":"2026-08","year":2026,"title":"lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72594"],"affected":"lobehub/lobe-chat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72594"},{"id":"INC-16714","date":"2026-04","year":2026,"title":"WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7272"],"affected":"WilliamCloudQi/matlab-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7272"},{"id":"INC-16715","date":"2026-08","year":2026,"title":"DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing","severity":"Critical","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72742"],"affected":"Stanford NLP/DSPy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72742"},{"id":"INC-16716","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Prototype Pollution via Edit Fields","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72749"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72749"},{"id":"INC-16717","date":"2026-08","year":2026,"title":"n8n before 1.123.67 SQL Injection via executeQuery Operation","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72750"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72750"},{"id":"INC-16718","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Arbitrary File Write via Edit Image Node","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72762"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72762"},{"id":"INC-16719","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Credential Exfiltration via Sub-Workflow","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-72763"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72763"},{"id":"INC-16720","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Module Cache Poisoning via Code Node","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72764"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72764"},{"id":"INC-16721","date":"2026-08","year":2026,"title":"n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72765"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72765"},{"id":"INC-16722","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Arbitrary File Read via Send Email Node","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-72766"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72766"},{"id":"INC-16723","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Remote Code Execution via Git node","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72767"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72767"},{"id":"INC-16724","date":"2026-08","year":2026,"title":"n8n before 2.32.1 SSRF Protection Bypass via MCP Client","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72768"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72768"},{"id":"INC-16725","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Prototype Pollution via VM Expression Engine","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72769"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72769"},{"id":"INC-16726","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Path Traversal via Git Node Operations","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72770"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72770"},{"id":"INC-16727","date":"2026-08","year":2026,"title":"n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-72771"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72771"},{"id":"INC-16728","date":"2026-08","year":2026,"title":"n8n before 2.32.1 Authentication Bypass via Token Exchange","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72772"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72772"},{"id":"INC-16729","date":"2026-08","year":2026,"title":"n8n before 2.32.1 Path Traversal via computer-use search_files","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72773"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72773"},{"id":"INC-16730","date":"2026-08","year":2026,"title":"n8n before 1.123.67 Authentication Bypass via HTTP Request Node","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-72774"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72774"},{"id":"INC-16731","date":"2026-08","year":2026,"title":"n8n before 1.123.67 SQL Injection via PostgresTrigger Node","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-72775"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72775"},{"id":"INC-16732","date":"2026-08","year":2026,"title":"Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72846"],"affected":"lightdash","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72846"},{"id":"INC-16733","date":"2026-08","year":2026,"title":"langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72848"],"affected":"langchain-ai/langchain-community","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72848"},{"id":"INC-16734","date":"2026-08","year":2026,"title":"9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72860"],"affected":"decolua/9router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72860"},{"id":"INC-16735","date":"2026-08","year":2026,"title":"Firecrawl: Arbitrary file read via JSON Schema $ref expansion","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-72904"],"affected":"firecrawl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72904"},{"id":"INC-16736","date":"2026-08","year":2026,"title":"AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-72917"],"affected":"Mintplex-Labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72917"},{"id":"INC-16737","date":"2026-08","year":2026,"title":"AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-72922"],"affected":"Significant-Gravitas/AutoGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-72922"},{"id":"INC-16738","date":"2026-08","year":2026,"title":"PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-73032"],"affected":"papersgpt/papersgpt-for-zotero","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73032"},{"id":"INC-16739","date":"2026-08","year":2026,"title":"DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73034"],"affected":"eosphoros-ai/DB-GPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73034"},{"id":"INC-16740","date":"2026-08","year":2026,"title":"Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-73079"],"affected":"Wei-Shaw/sub2api","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73079"},{"id":"INC-16741","date":"2026-04","year":2026,"title":"eiceblue spire-doc-mcp-server base.py get_doc_path path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7314"],"affected":"eiceblue/spire-doc-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7314"},{"id":"INC-16742","date":"2026-04","year":2026,"title":"eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7315"],"affected":"eiceblue/spire-pdf-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7315"},{"id":"INC-16743","date":"2026-04","year":2026,"title":"eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7316"],"affected":"eiliyaabedini/aider-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7316"},{"id":"INC-16744","date":"2026-04","year":2026,"title":"elie mcp-project research_server.py search_papers path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7318"],"affected":"elie/mcp-project","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7318"},{"id":"INC-16745","date":"2026-04","year":2026,"title":"elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7319"],"affected":"elinsky/execution-system-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7319"},{"id":"INC-16746","date":"2026-08","year":2026,"title":"CVAT: Denial of service with regards to automatic annotation","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73219"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73219"},{"id":"INC-16747","date":"2026-08","year":2026,"title":"CVAT: Stored XSS via annotation guides in audio tasks","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73220"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73220"},{"id":"INC-16748","date":"2026-08","year":2026,"title":"CVAT: Flawed authorization logic in endpoints related to lambda requests","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73221"],"affected":"cvat-ai/cvat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73221"},{"id":"INC-16749","date":"2026-08","year":2026,"title":"Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-73222"],"affected":"davila7/claude-code-templates","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73222"},{"id":"INC-16750","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Sandbox Escape via Puppeteer","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73483"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73483"},{"id":"INC-16751","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Sandbox Escape via Pandas Methods","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73484"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73484"},{"id":"INC-16752","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Remote Code Execution via Airtable Agent","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73485"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73485"},{"id":"INC-16753","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73486"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73486"},{"id":"INC-16754","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Prompt Injection RCE via CSV Agent","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM05","LLM10"],"owasp_asi":["ASI01","ASI04","ASI05"],"cve_ids":["CVE-2026-73487"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73487"},{"id":"INC-16755","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 IDOR via customer-default-source endpoint","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-73488"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73488"},{"id":"INC-16756","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary server-side file read via attachment upload","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-73496"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73496"},{"id":"INC-16757","date":"2026-09","year":2026,"title":"MCP Atlassian — Ssrf (CVE-2026-73497)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73497"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73497"},{"id":"INC-16758","date":"2026-08","year":2026,"title":"MCP Atlassian — Data Exfiltration (CVE-2026-73498)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-73498"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73498"},{"id":"INC-16759","date":"2026-08","year":2026,"title":"vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73555"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73555"},{"id":"INC-16760","date":"2026-08","year":2026,"title":"vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73556"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73556"},{"id":"INC-16761","date":"2026-08","year":2026,"title":"vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73557"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73557"},{"id":"INC-16762","date":"2026-08","year":2026,"title":"vLLM: Cross-User Data Leak Vulnerability","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73558"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73558"},{"id":"INC-16763","date":"2026-08","year":2026,"title":"vLLM: Completion prompt lists fan out into unbounded engine requests","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73559"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73559"},{"id":"INC-16764","date":"2026-08","year":2026,"title":"vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73560"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73560"},{"id":"INC-16765","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Remote Code Execution via Custom MCP","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73601"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73601"},{"id":"INC-16766","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Sandbox Escape to RCE","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73602"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73602"},{"id":"INC-16767","date":"2026-08","year":2026,"title":"Flowise before 3.1.4 Credential Abuse via Text-to-Speech","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-73603"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73603"},{"id":"INC-16768","date":"2026-08","year":2026,"title":"Flowise before 3.1.3 Credential Exposure via API","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-73604"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73604"},{"id":"INC-16769","date":"2026-08","year":2026,"title":"Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73614"],"affected":"Jovancoding/Network-AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73614"},{"id":"INC-16770","date":"2026-08","year":2026,"title":"MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-73678"],"affected":"MindsDB/Minds Platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73678"},{"id":"INC-16771","date":"2026-04","year":2026,"title":"ezequiroga mcp-bases research_server.py search_papers path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7384"],"affected":"ezequiroga/mcp-bases","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7384"},{"id":"INC-16772","date":"2026-08","year":2026,"title":"CKAN MCP Server: Information disclosure via verbose error reflection","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-73844"],"affected":"ondata/ckan-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73844"},{"id":"INC-16773","date":"2026-08","year":2026,"title":"CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73845"],"affected":"ondata/ckan-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73845"},{"id":"INC-16774","date":"2026-08","year":2026,"title":"CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-73846"],"affected":"ondata/ckan-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-73846"},{"id":"INC-16775","date":"2026-04","year":2026,"title":"fatbobman mail-mcp-bridge mail_mcp_server.py path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7386"],"affected":"fatbobman/mail-mcp-bridge","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7386"},{"id":"INC-16776","date":"2026-04","year":2026,"title":"NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7396"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7396"},{"id":"INC-16777","date":"2026-04","year":2026,"title":"NousResearch hermes-agent file_tools.py _check_sensitive_path symlink","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7397"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7397"},{"id":"INC-16778","date":"2026-04","year":2026,"title":"geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7400"],"affected":"geekgod382/filesystem-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7400"},{"id":"INC-16779","date":"2026-04","year":2026,"title":"geldata gel-mcp server.py fetch_rule path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7403"],"affected":"geldata/gel-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7403"},{"id":"INC-16780","date":"2026-04","year":2026,"title":"PolarVista xcode-mcp-server MCP index.ts run_tests os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7416"],"affected":"PolarVista/xcode-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7416"},{"id":"INC-16781","date":"2026-04","year":2026,"title":"BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7443"],"affected":"BurtTheCoder/mcp-dnstwist","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7443"},{"id":"INC-16782","date":"2026-08","year":2026,"title":"jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-74858"],"affected":"jae-jae/fetcher-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-74858"},{"id":"INC-16783","date":"2026-08","year":2026,"title":"Hugging Face Transformers Path Traversal via Checkpoint Index","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-75104"],"affected":"huggingface/transformers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75104"},{"id":"INC-16784","date":"2026-08","year":2026,"title":"MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-75110"],"affected":"MemTensor/MemOS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75110"},{"id":"INC-16785","date":"2026-08","year":2026,"title":"Context7 2.1.2 Prompt Injection via Custom AI Instructions","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-75130"],"affected":"Uptash/Context7","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75130"},{"id":"INC-16786","date":"2026-08","year":2026,"title":"marimo < 0.23.15 Code Injection via MCP Server Configuration","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-75149"],"affected":"marimo-team/marimo","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75149"},{"id":"INC-16787","date":"2026-05","year":2026,"title":"AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-7579"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7579"},{"id":"INC-16788","date":"2026-08","year":2026,"title":"ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-75845"],"affected":"ArcadeData/arcadedb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75845"},{"id":"INC-16789","date":"2026-08","year":2026,"title":"CodeWhale rlm_eval before 0.8.64 Remote Code Execution","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-75858"],"affected":"Hmbown/CodeWhale","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75858"},{"id":"INC-16790","date":"2026-05","year":2026,"title":"ggerve coding-standards-mcp server.py get_best_practices path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7588"],"affected":"ggerve/coding-standards-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7588"},{"id":"INC-16791","date":"2026-05","year":2026,"title":"ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7589"],"affected":"ghantakiran/splunk-mcp-integration","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7589"},{"id":"INC-16792","date":"2026-08","year":2026,"title":"RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-75898"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75898"},{"id":"INC-16793","date":"2026-05","year":2026,"title":"eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7590"],"affected":"eyal-gor/p_69_branch_monkey_mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7590"},{"id":"INC-16794","date":"2026-05","year":2026,"title":"TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7591"],"affected":"TimBroddin/astro-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7591"},{"id":"INC-16795","date":"2026-08","year":2026,"title":"CodeWhale before 0.8.64 Argument Injection via git_show","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-75913"],"affected":"Hmbown/CodeWhale","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-75913"},{"id":"INC-16796","date":"2026-05","year":2026,"title":"Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7593"],"affected":"Sunwood-ai-labs/command-executor-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7593"},{"id":"INC-16797","date":"2026-05","year":2026,"title":"Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7594"],"affected":"Flux159/mcp-game-asset-gen","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7594"},{"id":"INC-16798","date":"2026-05","year":2026,"title":"Dayoooun hwpx-mcp MCP index.ts export_to_html path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7599"],"affected":"Dayoooun/hwpx-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7599"},{"id":"INC-16799","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-76059"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76059"},{"id":"INC-16800","date":"2026-08","year":2026,"title":"Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-76072"],"affected":"continuedev/continue","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76072"},{"id":"INC-16801","date":"2026-08","year":2026,"title":"Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-76073"],"affected":"HumanSignal/label-studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76073"},{"id":"INC-16802","date":"2026-05","year":2026,"title":"8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7627"],"affected":"8nite/metatrader-4-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7627"},{"id":"INC-16803","date":"2026-05","year":2026,"title":"crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7628"],"affected":"crazyrabbitLTC/mcp-code-review-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7628"},{"id":"INC-16804","date":"2026-08","year":2026,"title":"Race Condition during Model Upload through the REST API in Splunk AI Toolkit","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-76393"],"affected":"Splunk/Splunk AI Toolkit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76393"},{"id":"INC-16805","date":"2026-08","year":2026,"title":"Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-76394"],"affected":"Splunk/Splunk AI Toolkit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76394"},{"id":"INC-16806","date":"2026-08","year":2026,"title":"Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-76395"],"affected":"Splunk/Splunk AI Toolkit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76395"},{"id":"INC-16807","date":"2026-08","year":2026,"title":"Improper Access Control through Scheduled Searches in Splunk AI Toolkit","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-76396"],"affected":"Splunk/Splunk AI Toolkit","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76396"},{"id":"INC-16808","date":"2026-08","year":2026,"title":"Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-76404"],"affected":"Splunk/Splunk MCP Server app","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76404"},{"id":"INC-16809","date":"2026-08","year":2026,"title":"Langflow is affected by security vulnerabilities in Model Context Protocol features","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-7646"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7646"},{"id":"INC-16810","date":"2026-05","year":2026,"title":"r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7653"],"affected":"r-huijts/mcp-server-rijksmuseum","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7653"},{"id":"INC-16811","date":"2026-08","year":2026,"title":"Langflow OSS is affected by server-side request forgery in provider validation and API request functionality","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7657"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7657"},{"id":"INC-16812","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7658"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7658"},{"id":"INC-16813","date":"2026-07","year":2026,"title":"Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7667"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7667"},{"id":"INC-16814","date":"2026-08","year":2026,"title":"Agno PythonTools Path Traversal via joinpath file_name argument","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-76832"],"affected":"Agno AGI/Agno","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76832"},{"id":"INC-16815","date":"2026-08","year":2026,"title":"Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-76841"],"affected":"xorbitsai/inference","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76841"},{"id":"INC-16816","date":"2026-08","year":2026,"title":"LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-76850"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-76850"},{"id":"INC-16817","date":"2026-08","year":2026,"title":"n8n before 2.34.1 Remote Code Execution via Path Traversal","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77068"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77068"},{"id":"INC-16818","date":"2026-08","year":2026,"title":"n8n before 1.123.69 SSRF Protection Bypass via OAuth2","severity":"Low","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-77069"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77069"},{"id":"INC-16819","date":"2026-08","year":2026,"title":"n8n before 1.123.69 NoSQL Injection via MongoDB Node","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77070"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77070"},{"id":"INC-16820","date":"2026-08","year":2026,"title":"n8n before 1.123.69 PostgREST Filter Injection via Supabase","severity":"High","attack_vector":"sql-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77071"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77071"},{"id":"INC-16821","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Stored XSS via Form Completion Page","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77072"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77072"},{"id":"INC-16822","date":"2026-08","year":2026,"title":"n8n before 2.34.1 Cross-Project Credential Access via MCP","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77073"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77073"},{"id":"INC-16823","date":"2026-08","year":2026,"title":"n8n before 1.123.69 SSRF via Edit Image Node","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77074"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77074"},{"id":"INC-16824","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Expression Injection via Resource Locator","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77075"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77075"},{"id":"INC-16825","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Credential Leak via GraphQL Node Error","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-77076"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77076"},{"id":"INC-16826","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77077"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77077"},{"id":"INC-16827","date":"2026-08","year":2026,"title":"n8n before 2.34.1 Authorization Bypass via Custom Role Deletion","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77079"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77079"},{"id":"INC-16828","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Arbitrary File Read and Write via Snowflake","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-77080"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77080"},{"id":"INC-16829","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77081"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77081"},{"id":"INC-16830","date":"2026-08","year":2026,"title":"n8n before 1.123.69 ReDoS via Filter and Switch Node","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77082"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77082"},{"id":"INC-16831","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution","severity":"Medium","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77083"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77083"},{"id":"INC-16832","date":"2026-08","year":2026,"title":"n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77084"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77084"},{"id":"INC-16833","date":"2026-08","year":2026,"title":"n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-77085"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77085"},{"id":"INC-16834","date":"2026-05","year":2026,"title":"MindsDB Engine proc_wrapper.py exec unrestricted upload","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7711"],"affected":"MindsDB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7711"},{"id":"INC-16835","date":"2026-05","year":2026,"title":"MindsDB Pickle pickle.loads deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7712"],"affected":"MindsDB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7712"},{"id":"INC-16836","date":"2026-05","year":2026,"title":"ravenwits mcp-server-arangodb MCP tools.ts arango_backup path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7715"],"affected":"ravenwits/mcp-server-arangodb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7715"},{"id":"INC-16837","date":"2026-09","year":2026,"title":"Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template sy...","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-77177"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77177"},{"id":"INC-16838","date":"2026-09","year":2026,"title":"MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77242"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77242"},{"id":"INC-16839","date":"2026-09","year":2026,"title":"MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77243"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77243"},{"id":"INC-16840","date":"2026-09","year":2026,"title":"[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77244"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77244"},{"id":"INC-16841","date":"2026-09","year":2026,"title":"MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77246"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77246"},{"id":"INC-16842","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77247"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77247"},{"id":"INC-16843","date":"2026-09","year":2026,"title":"MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77248"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77248"},{"id":"INC-16844","date":"2026-09","year":2026,"title":"MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77249"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77249"},{"id":"INC-16845","date":"2026-09","year":2026,"title":"MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77250"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77250"},{"id":"INC-16846","date":"2026-09","year":2026,"title":"MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77251"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77251"},{"id":"INC-16847","date":"2026-09","year":2026,"title":"MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77252"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77252"},{"id":"INC-16848","date":"2026-09","year":2026,"title":"MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77253"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77253"},{"id":"INC-16849","date":"2026-09","year":2026,"title":"MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77254"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77254"},{"id":"INC-16850","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77255"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77255"},{"id":"INC-16851","date":"2026-09","year":2026,"title":"MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77256"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77256"},{"id":"INC-16852","date":"2026-09","year":2026,"title":"MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77257"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77257"},{"id":"INC-16853","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77258"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77258"},{"id":"INC-16854","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77259"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77259"},{"id":"INC-16855","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77260"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77260"},{"id":"INC-16856","date":"2026-09","year":2026,"title":"MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77261"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77261"},{"id":"INC-16857","date":"2026-09","year":2026,"title":"MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77262"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77262"},{"id":"INC-16858","date":"2026-09","year":2026,"title":"MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77265"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77265"},{"id":"INC-16859","date":"2026-09","year":2026,"title":"MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77266"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77266"},{"id":"INC-16860","date":"2026-09","year":2026,"title":"mcp-atlassian has an incomplete SSRF remediation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77267"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77267"},{"id":"INC-16861","date":"2026-09","year":2026,"title":"MCP Atlassian: Insecure File Permissions on OAuth Token Storage","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77268"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77268"},{"id":"INC-16862","date":"2026-09","year":2026,"title":"MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77269"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77269"},{"id":"INC-16863","date":"2026-09","year":2026,"title":"MCP Atlassian: Arbitrary File Read via Upload Attachment Tools","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77270"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77270"},{"id":"INC-16864","date":"2026-09","year":2026,"title":"MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77271"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77271"},{"id":"INC-16865","date":"2026-09","year":2026,"title":"MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77272"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77272"},{"id":"INC-16866","date":"2026-09","year":2026,"title":"MCP Atlassian: SSRF Protection Bypass","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77274"],"affected":"sooperset/mcp-atlassian","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77274"},{"id":"INC-16867","date":"2026-05","year":2026,"title":"ryanjoachim mcp-rtfm MCP update_doc path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7728"],"affected":"ryanjoachim/mcp-rtfm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7728"},{"id":"INC-16868","date":"2026-09","year":2026,"title":"TREK: Server-Side Request Forgery via User-Configurable LLM Base URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-77294"],"affected":"mauriceboe/TREK","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77294"},{"id":"INC-16869","date":"2026-05","year":2026,"title":"privsim mcp-test-runner MCP index.ts child_process.spawn os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7730"],"affected":"privsim/mcp-test-runner","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7730"},{"id":"INC-16870","date":"2026-09","year":2026,"title":"MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77516"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77516"},{"id":"INC-16871","date":"2026-09","year":2026,"title":"MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77517"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77517"},{"id":"INC-16872","date":"2026-09","year":2026,"title":"MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77518"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77518"},{"id":"INC-16873","date":"2026-09","year":2026,"title":"MaxKB: Expired application API keys remain usable on `/chat/api/mcp`","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-77519"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77519"},{"id":"INC-16874","date":"2026-09","year":2026,"title":"MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77520"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77520"},{"id":"INC-16875","date":"2026-09","year":2026,"title":"MaxKB: Prompt-injectable agent can lead to command execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77521"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77521"},{"id":"INC-16876","date":"2026-09","year":2026,"title":"MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77522"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77522"},{"id":"INC-16877","date":"2026-09","year":2026,"title":"MaxKB: Cross-workspace model parameter form write","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77523"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77523"},{"id":"INC-16878","date":"2026-09","year":2026,"title":"MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77525"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77525"},{"id":"INC-16879","date":"2026-07","year":2026,"title":"SSRF Protection Configuration Vulnerability","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7754"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7754"},{"id":"INC-16880","date":"2026-07","year":2026,"title":"MCP Server Configuration Validator Bypass via File Upload API","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7755"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7755"},{"id":"INC-16881","date":"2026-08","year":2026,"title":"Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77775"],"affected":"Headroom Labs/Headroom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77775"},{"id":"INC-16882","date":"2026-08","year":2026,"title":"Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-77776"],"affected":"Headroom Labs/Headroom","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77776"},{"id":"INC-16883","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77822"],"affected":"IBM/ContextForge MCP Gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77822"},{"id":"INC-16884","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-77825"],"affected":"IBM/ContextForge MCP Gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-77825"},{"id":"INC-16885","date":"2026-05","year":2026,"title":"A-G-U-P-T-A wireshark-mcp pyshark_mcp.py quick_capture os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7785"],"affected":"A-G-U-P-T-A/wireshark-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7785"},{"id":"INC-16886","date":"2026-05","year":2026,"title":"Axle-Bucamp MCP-Docusaurus document.py get_content path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7788"],"affected":"Axle-Bucamp/MCP-Docusaurus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7788"},{"id":"INC-16887","date":"2026-05","year":2026,"title":"UsamaK98 python-notebook-mcp server.py add_cell path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7810"],"affected":"UsamaK98/python-notebook-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7810"},{"id":"INC-16888","date":"2026-05","year":2026,"title":"54yyyu code-mcp MCP File server.py is_safe_path path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7811"],"affected":"54yyyu/code-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7811"},{"id":"INC-16889","date":"2026-05","year":2026,"title":"54yyyu code-mcp MCP Tool server.py git_operation command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7812"],"affected":"54yyyu/code-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7812"},{"id":"INC-16890","date":"2026-08","year":2026,"title":"ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78147"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78147"},{"id":"INC-16891","date":"2026-08","year":2026,"title":"ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-78148"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78148"},{"id":"INC-16892","date":"2026-08","year":2026,"title":"BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78205"],"affected":"BentoML","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78205"},{"id":"INC-16893","date":"2026-09","year":2026,"title":"AshAi aggregate tool can read field-policy-protected fields","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-78230"],"affected":"ash-project/ash_ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78230"},{"id":"INC-16894","date":"2026-08","year":2026,"title":"sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78430"],"affected":"sworddut/mcp-ffmpeg-helper","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78430"},{"id":"INC-16895","date":"2026-09","year":2026,"title":"Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78501"],"affected":"Microsoft/Microsoft 365 Copilot's Business Chat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78501"},{"id":"INC-16896","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78569"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78569"},{"id":"INC-16897","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78571"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78571"},{"id":"INC-16898","date":"2026-09","year":2026,"title":"IBM ContextForge MCP Gateway is affected by use of default credentials","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-78573"],"affected":"IBM/ContextForge MCP Gateway","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78573"},{"id":"INC-16899","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-78575"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78575"},{"id":"INC-16900","date":"2026-08","year":2026,"title":"vLLM before 0.27.0 Denial of Service via DeepStream Backend","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-78684"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-78684"},{"id":"INC-16901","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-7869"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7869"},{"id":"INC-16902","date":"2026-07","year":2026,"title":"Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7872"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7872"},{"id":"INC-16903","date":"2026-05","year":2026,"title":"NanoClaw Host/Container Filesystem Boundary Vulnerability via Outbound Attachment Handling","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-7875"],"affected":"Qwibit/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-7875"},{"id":"INC-16904","date":"2026-08","year":2026,"title":"A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_dat...","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79407"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79407"},{"id":"INC-16905","date":"2026-08","year":2026,"title":"An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo...","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79408"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79408"},{"id":"INC-16906","date":"2026-08","year":2026,"title":"FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.","severity":"Medium","attack_vector":"sql-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79483"],"affected":"","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79483"},{"id":"INC-16907","date":"2026-08","year":2026,"title":"dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79622"],"affected":"dekdee/adobe-xd-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79622"},{"id":"INC-16908","date":"2026-09","year":2026,"title":"Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end use...","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79721"],"affected":"mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79721"},{"id":"INC-16909","date":"2026-09","year":2026,"title":"Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-79723"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79723"},{"id":"INC-16910","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79724"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79724"},{"id":"INC-16911","date":"2026-09","year":2026,"title":"Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-79725"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79725"},{"id":"INC-16912","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79742"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79742"},{"id":"INC-16913","date":"2026-08","year":2026,"title":"MCPHub: Path Traversal via Malicious MCPB Manifest Name","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79743"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79743"},{"id":"INC-16914","date":"2026-08","year":2026,"title":"MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79744"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79744"},{"id":"INC-16915","date":"2026-08","year":2026,"title":"MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-79745"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79745"},{"id":"INC-16916","date":"2026-08","year":2026,"title":"MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79746"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79746"},{"id":"INC-16917","date":"2026-08","year":2026,"title":"MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79747"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79747"},{"id":"INC-16918","date":"2026-08","year":2026,"title":"MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-79749"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79749"},{"id":"INC-16919","date":"2026-08","year":2026,"title":"MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-79750"],"affected":"samanhappy/mcphub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79750"},{"id":"INC-16920","date":"2026-08","year":2026,"title":"Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79784"],"affected":"gemelo-ai/vocos","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79784"},{"id":"INC-16921","date":"2026-08","year":2026,"title":"X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79785"],"affected":"CVHub520/X-AnyLabeling","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79785"},{"id":"INC-16922","date":"2026-09","year":2026,"title":"MaxKB AWS Bedrock model credential injection leads to remote code execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-79916"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79916"},{"id":"INC-16923","date":"2026-09","year":2026,"title":"MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-79917"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79917"},{"id":"INC-16924","date":"2026-09","year":2026,"title":"MaxKB: Sandbox escape via unhooked fexecve","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79918"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79918"},{"id":"INC-16925","date":"2026-09","year":2026,"title":"MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-79919"],"affected":"1Panel-dev/MaxKB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-79919"},{"id":"INC-16926","date":"2026-09","year":2026,"title":"Hugging Face Transformers library writes remote code to disk prior to consent check","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-80047"],"affected":"Hugging Face/Transformers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-80047"},{"id":"INC-16927","date":"2026-09","year":2026,"title":"Copilot Studio Elevation of Privilege Vulnerability","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-80098"],"affected":"Microsoft/Microsoft Copilot Studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-80098"},{"id":"INC-16928","date":"2026-08","year":2026,"title":"DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-80104"],"affected":"eosphoros-ai/DB-GPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-80104"},{"id":"INC-16929","date":"2026-08","year":2026,"title":"mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-80347"],"affected":"kazuph/mcp-fetch","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-80347"},{"id":"INC-16930","date":"2026-07","year":2026,"title":"Parameter Injection Vulnerability in API Graph Execution Engine","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8056"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8056"},{"id":"INC-16931","date":"2026-08","year":2026,"title":"mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81091"],"affected":"mcp-use","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81091"},{"id":"INC-16932","date":"2026-08","year":2026,"title":"mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81092"],"affected":"mark3labs/mcp-go","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81092"},{"id":"INC-16933","date":"2026-08","year":2026,"title":"Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-81093"],"affected":"apify/actors-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81093"},{"id":"INC-16934","date":"2026-08","year":2026,"title":"mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81094"],"affected":"mcp-router","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81094"},{"id":"INC-16935","date":"2026-08","year":2026,"title":"Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81095"],"affected":"timescale/pg-aiguide","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81095"},{"id":"INC-16936","date":"2026-08","year":2026,"title":"ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81096"],"affected":"mims-harvard/ToolUniverse","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81096"},{"id":"INC-16937","date":"2026-08","year":2026,"title":"rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81097"],"affected":"maquina-app/rails-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81097"},{"id":"INC-16938","date":"2026-08","year":2026,"title":"Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-81098"],"affected":"team-telnyx/telnyx-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81098"},{"id":"INC-16939","date":"2026-08","year":2026,"title":"Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81099"],"affected":"timescale/tiger-slack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81099"},{"id":"INC-16940","date":"2026-08","year":2026,"title":"Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81100"],"affected":"timescale/tiger-gh-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81100"},{"id":"INC-16941","date":"2026-08","year":2026,"title":"Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-81101"],"affected":"Airtable/airtable-mcp-cli","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81101"},{"id":"INC-16942","date":"2026-08","year":2026,"title":"Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-81102"],"affected":"dropbox/mcp-server-dash","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81102"},{"id":"INC-16943","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81204"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81204"},{"id":"INC-16944","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-81211"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81211"},{"id":"INC-16945","date":"2026-09","year":2026,"title":"Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-81213"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81213"},{"id":"INC-16946","date":"2026-09","year":2026,"title":"Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81265"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81265"},{"id":"INC-16947","date":"2026-09","year":2026,"title":"Langflow is vulnerable to authentication bypass and insufficient session expiration","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-81268"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81268"},{"id":"INC-16948","date":"2026-08","year":2026,"title":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81315"],"affected":"ash-project/ash_ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81315"},{"id":"INC-16949","date":"2026-08","year":2026,"title":"ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81421"],"affected":"ddfourtwo/sentry-selfhosted-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81421"},{"id":"INC-16950","date":"2026-07","year":2026,"title":"Authorization Bypass in mlflow/mlflow","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8147"],"affected":"mlflow/mlflow/mlflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8147"},{"id":"INC-16951","date":"2026-08","year":2026,"title":"danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81485"],"affected":"danielpopamd/linkedin-ads-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81485"},{"id":"INC-16952","date":"2026-08","year":2026,"title":"bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81486"],"affected":"bsmi021/mcp-file-context-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81486"},{"id":"INC-16953","date":"2026-08","year":2026,"title":"boxpositron with-context-mcp index.ts project_folder path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81491"],"affected":"boxpositron/with-context-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81491"},{"id":"INC-16954","date":"2026-08","year":2026,"title":"AlexGladkov claude-in-mobile client.ts execSync os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81562"],"affected":"AlexGladkov/claude-in-mobile","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81562"},{"id":"INC-16955","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-8182"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8182"},{"id":"INC-16956","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8183"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8183"},{"id":"INC-16957","date":"2026-08","year":2026,"title":"RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81833"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81833"},{"id":"INC-16958","date":"2026-08","year":2026,"title":"RooCodeInc Roo-Code README File ExecaTerminalProcess code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81834"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81834"},{"id":"INC-16959","date":"2026-08","year":2026,"title":"RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-81835"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81835"},{"id":"INC-16960","date":"2026-08","year":2026,"title":"RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-81836"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81836"},{"id":"INC-16961","date":"2026-08","year":2026,"title":"RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81837"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81837"},{"id":"INC-16962","date":"2026-08","year":2026,"title":"arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81845"],"affected":"arben-adm/mcp-sequential-thinking","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81845"},{"id":"INC-16963","date":"2026-08","year":2026,"title":"cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81848"],"affected":"cyberchitta/scrapling-fetch-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81848"},{"id":"INC-16964","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-81940"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81940"},{"id":"INC-16965","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-81941"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-81941"},{"id":"INC-16966","date":"2026-08","year":2026,"title":"Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-82020"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82020"},{"id":"INC-16967","date":"2026-08","year":2026,"title":"Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-82021"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82021"},{"id":"INC-16968","date":"2026-08","year":2026,"title":"iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-82111"],"affected":"iswalle/getnote-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82111"},{"id":"INC-16969","date":"2026-08","year":2026,"title":"In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI \"Agent Mode\" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpe...","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-82217"],"affected":"Eclipse Foundation/Eclipse Theia","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82217"},{"id":"INC-16970","date":"2026-08","year":2026,"title":"SiYuan before v3.8.1 Path Traversal via asset.upload","severity":"Medium","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-82233"],"affected":"siyuan-note/siyuan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82233"},{"id":"INC-16971","date":"2026-08","year":2026,"title":"Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-82268"],"affected":"QwenLM/Qwen-Agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82268"},{"id":"INC-16972","date":"2026-08","year":2026,"title":"Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-82275"],"affected":"QwenLM/Qwen-Agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82275"},{"id":"INC-16973","date":"2026-08","year":2026,"title":"Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-82288"],"affected":"AUTOMATIC1111/stable-diffusion-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82288"},{"id":"INC-16974","date":"2026-08","year":2026,"title":"argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-82456"],"affected":"argoproj-labs/argocd-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82456"},{"id":"INC-16975","date":"2026-09","year":2026,"title":"DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-82533"],"affected":"DeepSeek/DeepSeek Harness","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82533"},{"id":"INC-16976","date":"2026-09","year":2026,"title":"Roo-Code 3.54.0 Auto-Approve Bypass via Shell Command Pipe Operator","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-82536"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82536"},{"id":"INC-16977","date":"2026-09","year":2026,"title":"Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-82537"],"affected":"RooCodeInc/Roo-Code","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82537"},{"id":"INC-16978","date":"2026-08","year":2026,"title":"NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-82639"],"affected":"ChatGPTNextWeb/NextChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82639"},{"id":"INC-16979","date":"2026-08","year":2026,"title":"Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-82881"],"affected":"apconw/Aix-DB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-82881"},{"id":"INC-16980","date":"2026-06","year":2026,"title":"Missing authentication in Aix-DB","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8335"],"affected":"Aix-DB","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8335"},{"id":"INC-16981","date":"2026-09","year":2026,"title":"Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-83551"],"affected":"AWS/sagemaker-python-sdk","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-83551"},{"id":"INC-16982","date":"2026-07","year":2026,"title":"Relative Path Traversal in allegroai/clearml","severity":"Low","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8387"],"affected":"allegroai/allegroai/clearml","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8387"},{"id":"INC-16983","date":"2026-09","year":2026,"title":"appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84201"],"affected":"argneshu/appium-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84201"},{"id":"INC-16984","date":"2026-09","year":2026,"title":"ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-84202"],"affected":"modelscope","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84202"},{"id":"INC-16985","date":"2026-09","year":2026,"title":"NousResearch hermes-agent Session Chat api_server.py denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84287"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84287"},{"id":"INC-16986","date":"2026-09","year":2026,"title":"NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84288"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84288"},{"id":"INC-16987","date":"2026-09","year":2026,"title":"NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84289"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84289"},{"id":"INC-16988","date":"2026-09","year":2026,"title":"FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84301"],"affected":"labring/FastGPT","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84301"},{"id":"INC-16989","date":"2026-09","year":2026,"title":"LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-84377"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84377"},{"id":"INC-16990","date":"2026-09","year":2026,"title":"zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84425"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84425"},{"id":"INC-16991","date":"2026-09","year":2026,"title":"zhayujie CowAgent Bash Tool bash.py denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84427"],"affected":"zhayujie/CowAgent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84427"},{"id":"INC-16992","date":"2026-08","year":2026,"title":"Langflow is affected by security vulnerabilities in Model Context Protocol features","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8446"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8446"},{"id":"INC-16993","date":"2026-09","year":2026,"title":"Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8447"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8447"},{"id":"INC-16994","date":"2026-08","year":2026,"title":"Langflow is affected by weaknesses in secret handling and sensitive configuration access","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8470"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8470"},{"id":"INC-16995","date":"2026-07","year":2026,"title":"Disk Cache Deserialization Remote Code Execution Vulnerability","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8476"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8476"},{"id":"INC-16996","date":"2026-09","year":2026,"title":"WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-84779"],"affected":"Sheikh Heera/Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84779"},{"id":"INC-16997","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8478"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8478"},{"id":"INC-16998","date":"2026-09","year":2026,"title":"Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-84809"],"affected":"Tencent/AI-Infra-Guard, Tencent/aig-skill-scan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84809"},{"id":"INC-16999","date":"2026-07","year":2026,"title":"Remote Code Execution via Code Validation Endpoint","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8481"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8481"},{"id":"INC-17000","date":"2026-09","year":2026,"title":"claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-84810"],"affected":"claude-world/claude-skill-antivirus","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84810"},{"id":"INC-17001","date":"2026-09","year":2026,"title":"A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-84889"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-84889"},{"id":"INC-17002","date":"2026-09","year":2026,"title":"langgenius dify Splash Layout splash.tsx router.replace cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85021"],"affected":"langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85021"},{"id":"INC-17003","date":"2026-09","year":2026,"title":"langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85022"],"affected":"langgenius/dify","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85022"},{"id":"INC-17004","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85025"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85025"},{"id":"INC-17005","date":"2026-07","year":2026,"title":"Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-8505"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8505"},{"id":"INC-17006","date":"2026-09","year":2026,"title":"NousResearch hermes-agent Session Management s71.py _sess_nowait authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85105"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85105"},{"id":"INC-17007","date":"2026-09","year":2026,"title":"NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85106"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85106"},{"id":"INC-17008","date":"2026-09","year":2026,"title":"NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85107"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85107"},{"id":"INC-17009","date":"2026-09","year":2026,"title":"n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85165"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85165"},{"id":"INC-17010","date":"2026-09","year":2026,"title":"n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node","severity":"High","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85166"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85166"},{"id":"INC-17011","date":"2026-09","year":2026,"title":"n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85167"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85167"},{"id":"INC-17012","date":"2026-09","year":2026,"title":"n8n before 1.123.73 Remote Code Execution via Git Node","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85168"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85168"},{"id":"INC-17013","date":"2026-09","year":2026,"title":"n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak","severity":"High","attack_vector":"sandbox-escape","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85169"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85169"},{"id":"INC-17014","date":"2026-09","year":2026,"title":"n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85170"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85170"},{"id":"INC-17015","date":"2026-09","year":2026,"title":"n8n before 1.123.73 Credential Exposure via Error Logging","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85171"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85171"},{"id":"INC-17016","date":"2026-09","year":2026,"title":"n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85172"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85172"},{"id":"INC-17017","date":"2026-09","year":2026,"title":"n8n before 2.36.2 Missing Authorization via Insights API","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85173"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85173"},{"id":"INC-17018","date":"2026-09","year":2026,"title":"Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85178"],"affected":"helicone","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85178"},{"id":"INC-17019","date":"2026-09","year":2026,"title":"Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85179"],"affected":"HumanSignal/label-studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85179"},{"id":"INC-17020","date":"2026-09","year":2026,"title":"Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85180"],"affected":"ollama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85180"},{"id":"INC-17021","date":"2026-09","year":2026,"title":"Label Studio through 1.23.0 Cross-Organization Storage URI Resolution","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85211"],"affected":"HumanSignal/label-studio","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85211"},{"id":"INC-17022","date":"2026-09","year":2026,"title":"Integer overflow in tensor buffer validation in Deep Java Library","severity":"Critical","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85228"],"affected":"Amazon/Deep Java Library","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85228"},{"id":"INC-17023","date":"2026-09","year":2026,"title":"WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85306"],"affected":"Cascadia Web Services/MountDev AI MCP Connector for WordPress","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85306"},{"id":"INC-17024","date":"2026-09","year":2026,"title":"firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-85606"],"affected":"firecrawl/firecrawl-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85606"},{"id":"INC-17025","date":"2026-09","year":2026,"title":"Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85620"],"affected":"crystaldba/postgres-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85620"},{"id":"INC-17026","date":"2026-09","year":2026,"title":"LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85621"],"affected":"lobehub","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85621"},{"id":"INC-17027","date":"2026-09","year":2026,"title":"git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85626"],"affected":"cyanheads/git-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85626"},{"id":"INC-17028","date":"2026-09","year":2026,"title":"Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85654"],"affected":"Amazon/awslabs.dynamodb-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85654"},{"id":"INC-17029","date":"2026-09","year":2026,"title":"cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85660"],"affected":"MladenSU/cli-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85660"},{"id":"INC-17030","date":"2026-09","year":2026,"title":"excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85661"],"affected":"haris-musa/excel-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85661"},{"id":"INC-17031","date":"2026-09","year":2026,"title":"Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85663"],"affected":"aimhubio/aim","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85663"},{"id":"INC-17032","date":"2026-09","year":2026,"title":"ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85666"],"affected":"ogx-ai/ogx","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85666"},{"id":"INC-17033","date":"2026-09","year":2026,"title":"tokenizers BpeBuilder Buffer Overflow via merge token","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85670"],"affected":"huggingface/tokenizers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85670"},{"id":"INC-17034","date":"2026-09","year":2026,"title":"LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85673"],"affected":"hiyouga/LlamaFactory","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85673"},{"id":"INC-17035","date":"2026-09","year":2026,"title":"OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-85675"],"affected":"camel-ai/owl","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85675"},{"id":"INC-17036","date":"2026-09","year":2026,"title":"ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85686"],"affected":"modelscope/ms-swift","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85686"},{"id":"INC-17037","date":"2026-09","year":2026,"title":"LaVague 0.2.35 Remote Code Execution via eval extraction","severity":"Critical","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-85694"],"affected":"lavague-ai/LaVague","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85694"},{"id":"INC-17038","date":"2026-09","year":2026,"title":"FastChat Unauthenticated Worker Registration SSRF and Model Spoofing","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85695"],"affected":"lm-sys/FastChat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85695"},{"id":"INC-17039","date":"2026-09","year":2026,"title":"LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85709"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85709"},{"id":"INC-17040","date":"2026-09","year":2026,"title":"LightRAG: Plaintext Passwords Compared Without Constant-Time Function","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85725"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85725"},{"id":"INC-17041","date":"2026-09","year":2026,"title":"LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-85734"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85734"},{"id":"INC-17042","date":"2026-09","year":2026,"title":"LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85740"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85740"},{"id":"INC-17043","date":"2026-09","year":2026,"title":"An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85787"],"affected":"Amazon/postgres-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85787"},{"id":"INC-17044","date":"2026-09","year":2026,"title":"Incomplete list of disallowed inputs in awslabs mysql-mcp-server","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85788"],"affected":"AWS/AWS Labs MySQL MCP Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85788"},{"id":"INC-17045","date":"2026-09","year":2026,"title":"Microsoft 365 Copilot Elevation of Privilege Vulnerability","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-85885"],"affected":"Microsoft/Microsoft 365 Copilot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85885"},{"id":"INC-17046","date":"2026-09","year":2026,"title":"M365 Copilot Information Disclosure Vulnerability","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-85887"],"affected":"Microsoft/Microsoft 365 Copilot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-85887"},{"id":"INC-17047","date":"2026-09","year":2026,"title":"LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86062"],"affected":"HKUDS/LightRAG","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86062"},{"id":"INC-17048","date":"2026-09","year":2026,"title":"n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86073"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86073"},{"id":"INC-17049","date":"2026-09","year":2026,"title":"n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-86074"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86074"},{"id":"INC-17050","date":"2026-09","year":2026,"title":"n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86075"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86075"},{"id":"INC-17051","date":"2026-09","year":2026,"title":"n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-86076"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86076"},{"id":"INC-17052","date":"2026-09","year":2026,"title":"n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86077"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86077"},{"id":"INC-17053","date":"2026-09","year":2026,"title":"n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86078"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86078"},{"id":"INC-17054","date":"2026-09","year":2026,"title":"n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-86079"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86079"},{"id":"INC-17055","date":"2026-09","year":2026,"title":"n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-86080"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86080"},{"id":"INC-17056","date":"2026-09","year":2026,"title":"n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86081"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86081"},{"id":"INC-17057","date":"2026-09","year":2026,"title":"n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-86082"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86082"},{"id":"INC-17058","date":"2026-09","year":2026,"title":"n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86083"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86083"},{"id":"INC-17059","date":"2026-09","year":2026,"title":"n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86084"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86084"},{"id":"INC-17060","date":"2026-09","year":2026,"title":"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86085"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86085"},{"id":"INC-17061","date":"2026-09","year":2026,"title":"Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-86122"],"affected":"rowboatlabs/rowboat","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86122"},{"id":"INC-17062","date":"2026-09","year":2026,"title":"MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-86173"],"affected":"mindsdb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86173"},{"id":"INC-17063","date":"2026-05","year":2026,"title":"Crabbox < v0.12.0 Authentication Bypass via Header Spoofing","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8621"],"affected":"openclaw/crabbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8621"},{"id":"INC-17064","date":"2026-09","year":2026,"title":"Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86289"],"affected":"Ollama","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86289"},{"id":"INC-17065","date":"2026-05","year":2026,"title":"Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8629"],"affected":"openclaw/crabbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8629"},{"id":"INC-17066","date":"2026-09","year":2026,"title":"ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-86317"],"affected":"ggml-org/llama.cpp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86317"},{"id":"INC-17067","date":"2026-05","year":2026,"title":"Crabbox < v0.12.0 Environment Variable Information Disclosure","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-8634"],"affected":"openclaw/crabbox","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8634"},{"id":"INC-17068","date":"2026-07","year":2026,"title":"Arbitrary Code Execution in Python Interpreter Component","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8635"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8635"},{"id":"INC-17069","date":"2026-09","year":2026,"title":"CVE-2026-86793","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-86793"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86793"},{"id":"INC-17070","date":"2026-09","year":2026,"title":"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-86993"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86993"},{"id":"INC-17071","date":"2026-09","year":2026,"title":"n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86994"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86994"},{"id":"INC-17072","date":"2026-09","year":2026,"title":"n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86995"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86995"},{"id":"INC-17073","date":"2026-09","year":2026,"title":"n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-86996"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-86996"},{"id":"INC-17074","date":"2026-09","year":2026,"title":"Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87011"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87011"},{"id":"INC-17075","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87012"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87012"},{"id":"INC-17076","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87013"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87013"},{"id":"INC-17077","date":"2026-09","year":2026,"title":"Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87014"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87014"},{"id":"INC-17078","date":"2026-09","year":2026,"title":"Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87015"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87015"},{"id":"INC-17079","date":"2026-09","year":2026,"title":"Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87016"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87016"},{"id":"INC-17080","date":"2026-09","year":2026,"title":"Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87017"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87017"},{"id":"INC-17081","date":"2026-05","year":2026,"title":"h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-8750"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8750"},{"id":"INC-17082","date":"2026-05","year":2026,"title":"h2oai h2o-3 JAR Model.java importBinaryModel deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8751"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8751"},{"id":"INC-17083","date":"2026-05","year":2026,"title":"h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-8752"],"affected":"h2oai/h2o-3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8752"},{"id":"INC-17084","date":"2026-05","year":2026,"title":"AstrBotDevs AstrBot File Upload chat.py post_file path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8754"],"affected":"AstrBotDevs/AstrBot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8754"},{"id":"INC-17085","date":"2026-05","year":2026,"title":"Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-8786"],"affected":"Tencent/WeKnora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8786"},{"id":"INC-17086","date":"2026-09","year":2026,"title":"Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server","severity":"Critical","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87911"],"affected":"AWS/AWS Labs postgres MCP Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87911"},{"id":"INC-17087","date":"2026-09","year":2026,"title":"Missing S3 bucket ownership verification in the AWS Security Agent MCP server","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-87913"],"affected":"AWS/AWS Security Agent MCP server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87913"},{"id":"INC-17088","date":"2026-09","year":2026,"title":"An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted...","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87983"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87983"},{"id":"INC-17089","date":"2026-09","year":2026,"title":"An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user app...","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87984"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87984"},{"id":"INC-17090","date":"2026-09","year":2026,"title":"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87985"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87985"},{"id":"INC-17091","date":"2026-09","year":2026,"title":"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret.","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87986"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87986"},{"id":"INC-17092","date":"2026-09","year":2026,"title":"An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted com...","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-87987"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87987"},{"id":"INC-17093","date":"2026-09","year":2026,"title":"An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed.","severity":"Critical","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87988"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87988"},{"id":"INC-17094","date":"2026-09","year":2026,"title":"Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87994"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87994"},{"id":"INC-17095","date":"2026-09","year":2026,"title":"Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin","severity":"High","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87995"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87995"},{"id":"INC-17096","date":"2026-09","year":2026,"title":"Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87996"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87996"},{"id":"INC-17097","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87997"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87997"},{"id":"INC-17098","date":"2026-09","year":2026,"title":"Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87998"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87998"},{"id":"INC-17099","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-87999"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-87999"},{"id":"INC-17100","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-88000"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88000"},{"id":"INC-17101","date":"2026-09","year":2026,"title":"Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-88001"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88001"},{"id":"INC-17102","date":"2026-09","year":2026,"title":"Open WebUI: Any authenticated user can hang the server via a cyclic chat message history","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-88002"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88002"},{"id":"INC-17103","date":"2026-09","year":2026,"title":"Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-88005"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88005"},{"id":"INC-17104","date":"2026-09","year":2026,"title":"Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-88006"],"affected":"open-webui","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88006"},{"id":"INC-17105","date":"2026-09","year":2026,"title":"AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-88055"],"affected":"Mintplex-Labs/anything-llm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-88055"},{"id":"INC-17106","date":"2026-07","year":2026,"title":"Path Traversal in APIRequest Component via Content-Disposition Header","severity":"Critical","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-8859"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-8859"},{"id":"INC-17107","date":"2026-09","year":2026,"title":"BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-89032"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-89032"},{"id":"INC-17108","date":"2026-09","year":2026,"title":"GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI03","ASI04"],"cve_ids":["CVE-2026-89278"],"affected":"john-dagelmore/GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-89278"},{"id":"INC-17109","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Broken Access Control via organizationuser","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-90533"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90533"},{"id":"INC-17110","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-90534"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90534"},{"id":"INC-17111","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Denial of Service via text-to-speech/abort","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90535"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90535"},{"id":"INC-17112","date":"2026-09","year":2026,"title":"vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-90553"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90553"},{"id":"INC-17113","date":"2026-09","year":2026,"title":"vLLM before 0.28.0 Denial of Service via audio extraction","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90554"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90554"},{"id":"INC-17114","date":"2026-09","year":2026,"title":"vLLM before 0.28.0 Denial of Service via Audio Header","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90555"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90555"},{"id":"INC-17115","date":"2026-09","year":2026,"title":"FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery","severity":"Medium","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-90580"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90580"},{"id":"INC-17116","date":"2026-09","year":2026,"title":"vllm-project vLLM tiktoken vocab File mod.rs new denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90713"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90713"},{"id":"INC-17117","date":"2026-08","year":2026,"title":"Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9077"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9077"},{"id":"INC-17118","date":"2026-09","year":2026,"title":"nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90807"],"affected":"nanocoai/NanoClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90807"},{"id":"INC-17119","date":"2026-09","year":2026,"title":"HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90808"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90808"},{"id":"INC-17120","date":"2026-09","year":2026,"title":"HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-90809"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90809"},{"id":"INC-17121","date":"2026-08","year":2026,"title":"Langflow OSS is affected by server-side request forgery in provider validation and API request functionality","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9081"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9081"},{"id":"INC-17122","date":"2026-09","year":2026,"title":"vllm-project vLLM Jinja Template Rendering completions resource consumption","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-90878"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-90878"},{"id":"INC-17123","date":"2026-07","year":2026,"title":"Unauthenticated Superuser Token Issuance via Auto-Login Endpoint","severity":"Critical","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-9103"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9103"},{"id":"INC-17124","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-9130"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9130"},{"id":"INC-17125","date":"2026-07","year":2026,"title":"Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9135"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9135"},{"id":"INC-17126","date":"2026-09","year":2026,"title":"Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-9138"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9138"},{"id":"INC-17127","date":"2026-09","year":2026,"title":"WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91750"],"affected":"Tencent/WeKnora","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91750"},{"id":"INC-17128","date":"2026-09","year":2026,"title":"Weights & Biases wandb before 0.29.0 Path Traversal via File Download","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91771"],"affected":"wandb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91771"},{"id":"INC-17129","date":"2026-09","year":2026,"title":"OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91835"],"affected":"OpenClaw/ClawScan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91835"},{"id":"INC-17130","date":"2026-09","year":2026,"title":"OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91836"],"affected":"OpenClaw/ClawScan","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91836"},{"id":"INC-17131","date":"2026-09","year":2026,"title":"Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9186"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9186"},{"id":"INC-17132","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Cross-Tenant Authorization Bypass","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-91929"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91929"},{"id":"INC-17133","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91930"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91930"},{"id":"INC-17134","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Remote Code Execution via Custom MCP npx","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91931"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91931"},{"id":"INC-17135","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Remote Code Execution via cwd Parameter","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91932"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91932"},{"id":"INC-17136","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Authorization Bypass via openai-realtime","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91933"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91933"},{"id":"INC-17137","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Remote Code Execution via SQL Database Chain","severity":"High","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91934"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91934"},{"id":"INC-17138","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-91935"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91935"},{"id":"INC-17139","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Script Injection via Docker Workflows","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-91936"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91936"},{"id":"INC-17140","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 NoSQL Injection via sessionId","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91937"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91937"},{"id":"INC-17141","date":"2026-09","year":2026,"title":"Flowise before 3.1.4 Server-Side Request Forgery via document loaders","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91938"],"affected":"FlowiseAI/Flowise","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91938"},{"id":"INC-17142","date":"2026-09","year":2026,"title":"crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91940"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91940"},{"id":"INC-17143","date":"2026-09","year":2026,"title":"Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-91941"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91941"},{"id":"INC-17144","date":"2026-09","year":2026,"title":"crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91942"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91942"},{"id":"INC-17145","date":"2026-09","year":2026,"title":"Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy","severity":"High","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91943"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91943"},{"id":"INC-17146","date":"2026-09","year":2026,"title":"crawl4ai before 0.9.3 DOM-based XSS via Playground UI","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91944"],"affected":"unclecode/crawl4ai","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91944"},{"id":"INC-17147","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9196"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9196"},{"id":"INC-17148","date":"2026-07","year":2026,"title":"Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9198"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9198"},{"id":"INC-17149","date":"2026-09","year":2026,"title":"atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-91988"],"affected":"dep0we/atomic-agents-stack","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-91988"},{"id":"INC-17150","date":"2026-08","year":2026,"title":"Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9201"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9201"},{"id":"INC-17151","date":"2026-07","year":2026,"title":"Unauthenticated User Registration Could Lead to Remote Code Execution","severity":"Critical","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9202"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9202"},{"id":"INC-17152","date":"2026-08","year":2026,"title":"Langflow is affected by weaknesses in secret handling and sensitive configuration access","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9205"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9205"},{"id":"INC-17153","date":"2026-09","year":2026,"title":"vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92220"],"affected":"vllm-project/vLLM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92220"},{"id":"INC-17154","date":"2026-09","year":2026,"title":"Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-9225"],"affected":"IBM/Langflow OSS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9225"},{"id":"INC-17155","date":"2026-09","year":2026,"title":"vllm-project vllm thinking_budget_state.py algorithmic complexity","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92365"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92365"},{"id":"INC-17156","date":"2026-09","year":2026,"title":"HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool","severity":"Critical","attack_vector":"ssrf","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":["CVE-2026-92576"],"affected":"HKUDS/nanobot","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92576"},{"id":"INC-17157","date":"2026-09","year":2026,"title":"n8n before 1.123.76 Sandbox Escape via Git Relative URL","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92587"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92587"},{"id":"INC-17158","date":"2026-09","year":2026,"title":"n8n before 1.123.76 Improper Authorization via Source Control Push","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-92588"],"affected":"n8n-io/n8n","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92588"},{"id":"INC-17159","date":"2026-09","year":2026,"title":"LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92786"],"affected":"lightgbm-org/LightGBM","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92786"},{"id":"INC-17160","date":"2026-09","year":2026,"title":"ComfyUI before 0.30.0 Path Traversal via dataset save nodes","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-92816"],"affected":"Comfy-Org/ComfyUI","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92816"},{"id":"INC-17161","date":"2026-09","year":2026,"title":"InternLM LMDeploy through 0.17.0 Assertion Denial of Service","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92971"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92971"},{"id":"INC-17162","date":"2026-09","year":2026,"title":"SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92972"],"affected":"sgl-project/sglang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92972"},{"id":"INC-17163","date":"2026-09","year":2026,"title":"InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-92983"],"affected":"InternLM/lmdeploy","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-92983"},{"id":"INC-17164","date":"2026-09","year":2026,"title":"RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-93013"],"affected":"infiniflow/ragflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93013"},{"id":"INC-17165","date":"2026-09","year":2026,"title":"CVE-2026-93088","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-93088"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93088"},{"id":"INC-17166","date":"2026-08","year":2026,"title":"Improper Handling of HDF5 ExternalLinks in keras-team/keras","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM05"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9335"],"affected":"keras-team/keras-team/keras","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9335"},{"id":"INC-17167","date":"2026-09","year":2026,"title":"LiteLLM Weak JWT Authentication via Email-Based User Lookup","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-93355"],"affected":"BerriAI/litellm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93355"},{"id":"INC-17168","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Memory Exhaustion via Rejected Requests","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93436"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93436"},{"id":"INC-17169","date":"2026-05","year":2026,"title":"NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9350"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9350"},{"id":"INC-17170","date":"2026-05","year":2026,"title":"NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9351"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9351"},{"id":"INC-17171","date":"2026-05","year":2026,"title":"NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM02","LLM04"],"owasp_asi":["ASI02","ASI04"],"cve_ids":["CVE-2026-9352"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9352"},{"id":"INC-17172","date":"2026-09","year":2026,"title":"WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-93529"],"affected":"Bilal Naseer/WSP MCP &#8211; AI Agents Connector","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93529"},{"id":"INC-17173","date":"2026-05","year":2026,"title":"NousResearch hermes-agent Slack Agent/Mattermost Agent escape output","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9354"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9354"},{"id":"INC-17174","date":"2026-09","year":2026,"title":"vLLM before 0.28.0 Denial of Service via negative token ID","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93592"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93592"},{"id":"INC-17175","date":"2026-09","year":2026,"title":"ArcadeDB before 26.9.1 ACL Bypass via query_database Tool","severity":"High","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-93595"],"affected":"ArcadeData/arcadedb","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93595"},{"id":"INC-17176","date":"2026-05","year":2026,"title":"NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9367"],"affected":"NousResearch/hermes-agent","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9367"},{"id":"INC-17177","date":"2026-09","year":2026,"title":"SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93688"],"affected":"sgl-project/sglang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93688"},{"id":"INC-17178","date":"2026-09","year":2026,"title":"SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93838"],"affected":"sgl-project/sglang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93838"},{"id":"INC-17179","date":"2026-09","year":2026,"title":"vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93840"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93840"},{"id":"INC-17180","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93841"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93841"},{"id":"INC-17181","date":"2026-09","year":2026,"title":"OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-93982"],"affected":"Openpanel-dev/openpanel","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93982"},{"id":"INC-17182","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-93989"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93989"},{"id":"INC-17183","date":"2026-09","year":2026,"title":"Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-93993"],"affected":"mistralai/mistral-vibe","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-93993"},{"id":"INC-17184","date":"2026-09","year":2026,"title":"0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection","severity":"Medium","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-94031"],"affected":"0-Gaurav-0/nexus-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94031"},{"id":"INC-17185","date":"2026-09","year":2026,"title":"00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-94037"],"affected":"00Kisumi00/mcp-file-analyzer","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94037"},{"id":"INC-17186","date":"2026-09","year":2026,"title":"03-lovepreetSingh MCP route.ts create_file path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-94044"],"affected":"03-lovepreetSingh/MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94044"},{"id":"INC-17187","date":"2026-09","year":2026,"title":"0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-94046"],"affected":"0215AndrewFeng/ACE-MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94046"},{"id":"INC-17188","date":"2026-09","year":2026,"title":"DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization","severity":"Medium","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-94093"],"affected":"DLR-RM/stable-baselines3","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94093"},{"id":"INC-17189","date":"2026-09","year":2026,"title":"OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94094"],"affected":"OpenClaw","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94094"},{"id":"INC-17190","date":"2026-10","year":2026,"title":"Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass","severity":"Medium","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94485"],"affected":"vercel/next.js","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94485"},{"id":"INC-17191","date":"2026-10","year":2026,"title":"Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint","severity":"Low","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94486"],"affected":"vercel/next.js","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94486"},{"id":"INC-17192","date":"2026-09","year":2026,"title":"CVE-2026-94570","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94570"],"affected":"SGLang","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94570"},{"id":"INC-17193","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94622"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94622"},{"id":"INC-17194","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94623"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94623"},{"id":"INC-17195","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions","severity":"High","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94624"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94624"},{"id":"INC-17196","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders","severity":"Medium","attack_vector":"dos","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94625"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94625"},{"id":"INC-17197","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94626"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94626"},{"id":"INC-17198","date":"2026-09","year":2026,"title":"vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-94627"],"affected":"vllm-project/vllm","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-94627"},{"id":"INC-17199","date":"2026-05","year":2026,"title":"debugmcp mcp-debugger server.ts handleGetSourceContext path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9467"],"affected":"debugmcp/mcp-debugger","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9467"},{"id":"INC-17200","date":"2026-05","year":2026,"title":"dazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9468"],"affected":"dazeb/cline-mcp-memory-bank","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9468"},{"id":"INC-17201","date":"2026-05","year":2026,"title":"c-rick jimeng-mcp api.ts generateVideo path traversal","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9473"],"affected":"c-rick/jimeng-mcp","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9473"},{"id":"INC-17202","date":"2026-09","year":2026,"title":"OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging","severity":"High","attack_vector":"info-disclosure","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-95815"],"affected":"OpenClaw/OpenClaw iOS","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-95815"},{"id":"INC-17203","date":"2026-09","year":2026,"title":"MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF","severity":"High","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-96524"],"affected":"Unknown/MCP Server for WordPress","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96524"},{"id":"INC-17204","date":"2026-09","year":2026,"title":"MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-96525"],"affected":"Unknown/MCP Server for WordPress","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96525"},{"id":"INC-17205","date":"2026-09","year":2026,"title":"MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route","severity":"Low","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-96526"],"affected":"Unknown/MCP Server for WordPress","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96526"},{"id":"INC-17206","date":"2026-10","year":2026,"title":"AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection","severity":"High","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI05"],"cve_ids":["CVE-2026-96561"],"affected":"tigroumeow/AI Engine – The Chatbot, AI Framework & MCP for WordPress","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96561"},{"id":"INC-17207","date":"2026-09","year":2026,"title":"MLflow dspy bypasses pickle deserialization control","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-96775"],"affected":"MLflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96775"},{"id":"INC-17208","date":"2026-07","year":2026,"title":"MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-9680"],"affected":"Alibaba/Alibaba Cloud RDS OpenAPI MCP Server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9680"},{"id":"INC-17209","date":"2026-09","year":2026,"title":"CVE-2026-96804","severity":"High","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-96804"],"affected":"MLflow","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-96804"},{"id":"INC-17210","date":"2026-09","year":2026,"title":"Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup","severity":"Low","attack_vector":"prompt-injection","owasp_llm":["LLM01","LLM10"],"owasp_asi":["ASI01","ASI03","ASI05"],"cve_ids":["CVE-2026-97228"],"affected":"Rapid7/Platform","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-97228"},{"id":"INC-17211","date":"2026-09","year":2026,"title":"WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability","severity":"Medium","attack_vector":"auth-bypass","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":["CVE-2026-97239"],"affected":"Jose Conti/MCP Content Manager Lite","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-97239"},{"id":"INC-17212","date":"2026-09","year":2026,"title":"WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":["CVE-2026-97242"],"affected":"phuongwebo/WEBO MCP","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-97242"},{"id":"INC-17213","date":"2026-10","year":2026,"title":"Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace","severity":"High","attack_vector":"command-injection","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-97662"],"affected":"AWS/security-agent-mcp-server","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-97662"},{"id":"INC-17214","date":"2026-09","year":2026,"title":"langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization","severity":"Low","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-97869"],"affected":"langchain4j","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-97869"},{"id":"INC-17215","date":"2026-08","year":2026,"title":"Path Traversal in huggingface/transformers","severity":"High","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":["CVE-2026-9856"],"affected":"huggingface/huggingface/transformers","corpus":"security","quality_tier":"auto","tier":"feed","primary_reference":"https://nvd.nist.gov/vuln/detail/CVE-2026-9856"},{"id":"INC-08226","date":"2026-06","year":2026,"title":"Bugsink: DOS using large numbers of event tags","severity":"Medium","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/bugsink","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-5x67-j5xg-c5gj"},{"id":"INC-08239","date":"2026-06","year":2026,"title":"WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin","severity":"Critical","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"composer/WWBN/AVideo","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-8whc-2wmv-ww35"},{"id":"INC-08463","date":"2026-05","year":2026,"title":"n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass","severity":"Medium","attack_vector":"data-exfiltration","owasp_llm":["LLM04"],"owasp_asi":["ASI03","ASI04"],"cve_ids":[],"affected":"npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-3875-8gcx-7v46"},{"id":"INC-08844","date":"2026-04","year":2026,"title":"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/hono","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-458j-xx4x-4375"},{"id":"INC-08923","date":"2026-04","year":2026,"title":"PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling","severity":"Medium","attack_vector":"path-traversal","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI03","ASI04","ASI05"],"cve_ids":[],"affected":"pip/praisonaiagents","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-766v-q9x3-g744"},{"id":"INC-09063","date":"2026-03","year":2026,"title":"n8n has a Stored XSS Vulnerability in its Form Trigger","severity":"Medium","attack_vector":"xss","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-q4fm-pjq6-m63g"},{"id":"INC-09312","date":"2026-03","year":2026,"title":"PickleScan's pkgutil.resolve_name has a universal blocklist bypass","severity":"Critical","attack_vector":"deserialization","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-vvpj-8cmc-gx39"},{"id":"INC-09356","date":"2026-02","year":2026,"title":"n8n: Webhook Forgery on Github Webhook Trigger","severity":"Medium","attack_vector":"other","owasp_llm":["LLM04"],"owasp_asi":["ASI04"],"cve_ids":[],"affected":"npm/n8n, npm/n8n","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-mqpr-49jj-32rc"},{"id":"INC-09407","date":"2026-02","year":2026,"title":"Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER","severity":"High","attack_vector":"rce","owasp_llm":["LLM04","LLM10"],"owasp_asi":["ASI04","ASI05"],"cve_ids":[],"affected":"pip/picklescan","corpus":"security","quality_tier":"reviewed","tier":"feed","primary_reference":"https://github.com/advisories/GHSA-97f8-7cmv-76j2"}]}