This session explores the uniqueness and prevalence of vulnerabilities in open-source AI/ML projects, drawing on empirical data from bug bounty reports. We examine how AI/ML vulnerabilities differ from traditional OSS issues, why they are harder to fix, and how other gaps in disclosure pipelines (e.g., missing NVD entries) impact ecosystem security. The talk highlights key challenges, such as patching rates and taxonomy mismatches, and proposes research directions to improve vulnerability visibility, remediation, and tooling support. Attendees will gain overarching insights into emerging security risks of AI/ML OSS vulnerabilities and high-level actionable strategies to strengthen the ecosystem.