It's not that AES-CBC in itself is insecure, but without message authentication you are vulnerable to chosen ciphertext attacks.