Thursday, May 7, 2026 · 2 of 5

1. "Bleeding Llama" — critical Ollama memory leak (CVE-2026-7482, CVSS 9.1)

   (disclosed May 5) — Unauthenticated attackers can leak heap memory containing API keys, prompts, PII from any of ~300k internet-exposed Ollama servers. Patch in 0.17.1 was shipped Feb 25 without a security label — most operators never upgraded.