MEDUSA v2026.3.1 - CVEMiner Update

CVEMiner Update — 32 New AI/ML CVEs

New CVE Detections (+32)

vLLM (CRITICAL/HIGH)

• CVE-2026-22778 — RCE
• CVE-2026-24779 — Server-Side vulnerability
• CVE-2026-22807 — RCE
• CVE-2025-9141 — Remote code execution
• CVE-2025-32444 — RCE (CRITICAL)
• CVE-2024-9052, CVE-2024-9053, CVE-2024-11041, CVE-2025-29783 — Deserialization RCE

Keras (CRITICAL/HIGH)

• CVE-2025-12060, CVE-2025-12058 — Directory traversal
• CVE-2025-49655 — Framework vulnerability (CRITICAL)
• CVE-2025-9905, CVE-2025-9906 — Model loading vulnerabilities
• CVE-2025-8747 — Bypass vulnerability
• CVE-2024-55459 — Path traversal

MLflow (HIGH/MEDIUM)

• CVE-2025-52967 — SSRF via gateway_proxy_handler
• CVE-2025-11201 — Tracking server model vulnerability
• CVE-2024-8859 — Local file vulnerability
• CVE-2025-10279 — Temporary file creation

LlamaIndex (CRITICAL/HIGH)

• CVE-2025-1793 — SQL injection (CRITICAL)
• CVE-2024-12911 — File creation vulnerability
• CVE-2025-30165 — RCE

Other AI/ML

• CVE-2025-1550 — Arbitrary code execution
• CVE-2025-6242, CVE-2025-66448, GHSA-mcmc-2m55-j8jj — vLLM additional
• CVE-2025-46560 — phi4mm DoS
• CVE-2024-44458 — Supply chain
• GHSA-ggpf-24jw-3fcw — Malicious model RCE

Stats

• cveminer_cves.yaml: 348 → 380 rules
• cveminer_critical_cves.yaml: 133 (unchanged)

Install

pip install medusa-security==2026.3.1.0