Skip to content

Distributed Risk A Frontier Desk partner

Desk

Verified notes on questions that are live now.

12 of 33 notesConnect an agent RSS

Entry 09722 Oct 2026OSV · 1 sourceverified
Jupyter Server gateway WebSocket handler bypasses kernel execute authorization
The OSV advisory reports a HIGH-severity authorization bypass in PyPI/jupyter-server (CVE-2026-114135) affecting 2.0.0 through 2.5.0, fixed in 2.6.0.
For: Platform or AI-stack owner · Deal team
Entry 09621 Oct 2026OSV · 1 sourceverified
OSV advisory MAL-2026-2144: malicious litellm versions on PyPI
The OSV advisory reports that litellm versions 1.82.7, 1.82.8, and 1.107.0 on PyPI carry a credential stealer and a remote code execution backdoor not present in the upstream source, and names no fixed version.
For: Platform or AI-stack owner · Deal team
Entry 05423 Sept 2026SEC EDGAR · 1 sourceverified
Astrana Health files 8-K Item 1.05 material cybersecurity incident
Astrana Health, Inc. (ASTH) filed a Form 8-K under Item 1.05 reporting a material cybersecurity incident on 23 September 2026; the filing text at the accession number is the record for any cause, data type, or impact.
For: Deal team · Credit committee · Cyber underwriter
Entry 03910 Sept 2026OSV · 1 sourceverified
Open WebUI sign-in binds to another user via wildcard characters in the OAuth subject claim on SQLite
The OSV advisory reports a HIGH flaw in PyPI/open-webui where a SQLite substring match on the OAuth subject claim lets a sign-in bind to an account the value was never issued for, fixed in 0.11.1.
For: Platform or AI-stack owner · Deal team
Entry 0288 Sept 2026CISA KEV · 3 sourcesverified
N-able N-central Static Code Injection Vulnerability Added to CISA KEV
CISA added CVE-2026-86218, a static code injection vulnerability in N-able N-central, to its Known Exploited Vulnerabilities Catalog with a federal remediation due date of 11 September 2026.
For: Platform or AI-stack owner · Cyber underwriter · Deal team
Entry 0274 Sept 2026CISA · 1 sourceverified
CISA Advisory AA26-251A: China-Based AI Companies Distilling U.S. AI Models
CISA reports China-based AI companies are running industrial-scale knowledge distillation campaigns to extract proprietary capabilities from U.S. AI models.
For: Platform or AI-stack owner · Deal team
Entry 0252 Sept 2026CISA KEV · 3 sourcesverified
BerriAI LiteLLM Improper Authentication Vulnerability Added to CISA KEV
CISA added CVE-2026-59822, an improper authentication vulnerability in BerriAI LiteLLM's MCP Streamable HTTP endpoint, to its Known Exploited Vulnerabilities Catalog with a federal remediation due date of 16 September 2026.
For: Platform or AI-stack owner · Deal team
Entry 0241 Sept 2026SEC EDGAR · 1 sourceverified
Park Dental Partners, Inc. files 8-K Item 1.05 material cybersecurity incident
Park Dental Partners, Inc. (PARK) filed a Form 8-K under Item 1.05 reporting a material cybersecurity incident; the indexed row states filing facts only.
For: Deal team · Credit committee · Cyber underwriter
Entry 0231 Sept 2026OSV · 1 sourceverified
Hugging Face Transformers Downloads Custom Generation Code Before Trust Consent
The OSV advisory reports a HIGH-severity vulnerability in PyPI/transformers (4.49.0, <= 5.8.1) that writes remote Python files to local disk without user consent and names no fixed version.
For: Platform or AI-stack owner · Deal team
Entry 02131 Aug 2026SEC EDGAR · 1 sourceverified
Nutex Health files 8-K Item 1.05 material cybersecurity incident disclosure
Nutex Health Inc. (NUTX) filed an 8-K under Item 1.05 reporting a material cybersecurity incident; the indexed row holds filing facts only, and the filing text is the record.
For: Deal team · Credit committee · Cyber underwriter
Entry 02027 Aug 2026OSV · 1 sourceverified
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
The OSV advisory reports a CRITICAL server-side template injection in PyPI litellm up to 1.82.4, fixed in 1.83.7.
For: Platform or AI-stack owner · Deal team
Entry 01519 Aug 2026CISA KEV · 3 sourcesverified
MLflow Server-Side Request Forgery Vulnerability Added to CISA KEV
CISA added CVE-2026-64849, an MLflow server-side request forgery vulnerability, to its Known Exploited Vulnerabilities catalog with a federal remediation due date of 2 September 2026.
For: Platform or AI-stack owner · Deal team