CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:openshift_ai. Show all products

80 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2024-10963High 7.4Pam: improper hostname interpretation in pam_access leads to access control bypass
Assigned by redhat
Nov 7, 2024
CVE-2024-11831Medium 5.4Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
Assigned by redhat
Feb 10, 2025
CVE-2025-6170Low 2.5Libxml2: stack buffer overflow in xmllint interactive shell command handling
Assigned by redhat
Jun 16, 2025
CVE-2025-6193Medium 5.9Trustyai-explainability: command injection via lmevaljob cr
Assigned by redhat
Jun 20, 2025
CVE-2025-12103Medium 5.0Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace
Assigned by redhat
Oct 28, 2025
CVE-2025-14087Medium 5.6Glib: glib: buffer underflow in gvariant parser leads to heap corruption
Assigned by redhat
Dec 10, 2025
CVE-2025-14512Medium 6.5Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
Assigned by redhat
Dec 11, 2025
CVE-2025-13465Medium 6.9Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Assigned by openjs
Jan 21, 2026
CVE-2026-32981High 7.5Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Assigned by VulnCheck
Mar 17, 2026
CVE-2025-12805High 8.1A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator.Mar 26, 2026
CVE-2026-4800High 8.1lodash vulnerable to Code Injection via `_.template` imports key names
Assigned by openjs
Mar 31, 2026
CVE-2026-4878Medium 6.7Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
Assigned by redhat
Apr 9, 2026
CVE-2026-5483Critical 9.9A flaw was found in odh-dashboard in Red Hat Openshift AI.Apr 10, 2026
CVE-2026-1462High 7.8A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `s…Apr 13, 2026
CVE-2026-3833Medium 6.5Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
Assigned by redhat
Apr 30, 2026
CVE-2026-33845High 7.5Gnutls: gnutls: denial of service via dtls zero-length fragment
Assigned by redhat
Apr 30, 2026
CVE-2026-33846High 7.5Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
Assigned by redhat
May 4, 2026
CVE-2026-42010High 7.1Gnutls: gnutls: authentication bypass via nul character in username
Assigned by redhat
May 7, 2026
CVE-2026-42011High 7.4Gnutls: gnutls: security bypass due to incorrect name constraint handling
Assigned by redhat
May 7, 2026
CVE-2026-42271
Known exploited
High 8.7LiteLLM: Authenticated command execution via MCP stdio test endpoints
Assigned by GitHub_M
May 8, 2026
CVE-2026-42208
Known exploited
Critical 9.3LiteLLM: SQL injection in Proxy API key verification
Assigned by GitHub_M
May 8, 2026
CVE-2026-42009High 7.5Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
Assigned by redhat
May 18, 2026
CVE-2026-47101High 8.8LiteLLM < 1.83.14 Privilege Escalation via API Key Generation
Assigned by VulnCheck
May 21, 2026
CVE-2026-47102High 8.8LiteLLM < 1.83.10 Privilege Escalation via User Update
Assigned by VulnCheck
May 21, 2026
CVE-2026-48864High 7.8Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data
Assigned by redhat
May 26, 2026
CVE-2026-5260High 8.2Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
Assigned by redhat
May 26, 2026
CVE-2026-42012High 7.1Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans
Assigned by redhat
May 26, 2026
CVE-2026-42013High 8.2Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
Assigned by redhat
May 26, 2026
CVE-2026-42015Medium 5.3Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling
Assigned by redhat
May 26, 2026
CVE-2026-48710
Known exploited
Medium 6.5Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Assigned by GitHub_M
May 26, 2026
CVE-2026-5419Low 3.7Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
Assigned by redhat
Jun 1, 2026
CVE-2026-46625High 7.5JavaScript Cookie is a JavaScript API for handling cookies, client-side.Jun 10, 2026
CVE-2026-42014Medium 6.6Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin
Assigned by redhat
Jun 16, 2026
CVE-2026-56209High 7.1Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack
Assigned by redhat
Jun 19, 2026
CVE-2026-56208High 7.6Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
Assigned by redhat
Jun 19, 2026
CVE-2026-56210High 7.1Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
Assigned by redhat
Jun 19, 2026
CVE-2026-56211High 7.1Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames
Assigned by redhat
Jun 19, 2026
CVE-2026-55653Medium 4.3Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
Assigned by redhat
Jun 23, 2026
CVE-2026-55655Medium 5.0Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
Assigned by redhat
Jun 23, 2026
CVE-2023-54365High 7.5Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-…Jun 23, 2026
CVE-2026-12912High 7.3Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
Assigned by redhat
Jun 29, 2026
CVE-2026-14164High 7.5Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
Assigned by redhat
Jun 30, 2026
CVE-2026-58010Medium 6.5Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
Assigned by redhat
Jun 30, 2026
CVE-2026-58011Medium 6.5Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
Assigned by redhat
Jun 30, 2026
CVE-2026-58012Medium 6.5Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
Assigned by redhat
Jun 30, 2026
CVE-2026-58013Medium 6.5Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
Assigned by redhat
Jun 30, 2026
CVE-2026-58014High 7.3Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
Assigned by redhat
Jun 30, 2026
CVE-2026-58015Medium 5.9Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
Assigned by redhat
Jun 30, 2026
CVE-2026-58016High 7.5Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
Assigned by redhat
Jun 30, 2026
CVE-2026-15154Medium 6.5A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI.Jul 8, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.