Skip to contentRed Hat Openshift vulnerabilities
- tensorflow, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreTensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2026-2492Fix available7.0 High
- mlflow, red hat openshift ai (rhoai) +1 moreMLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution VulnerabilityCVE-2026-2033Fix available8.1 High
- google cloud vertex ai sdk for python, red hat openshift ai 2.25 +1 moreStored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationCVE-2026-2472Public exploitFix available8.6 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesCVE-2026-25896Fix available9.3 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsingCVE-2026-2243Fix available5.1 Medium
- katacontainers kata containers, kata-containers, red hat confidential compute attestation +1 more +3 moreKata Container to Guest micro VM privilege escalationCVE-2026-24834Fix available9.4 Critical
- nltk, nltk nltk/nltk, red hat openshift lightspeed +2 more +4 moreZip Slip Vulnerability in nltk/nltk Leading to Remote Code ExecutionCVE-2025-14009Fix available10.0 Critical
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)CVE-2026-26278Fix available7.5 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack has a Directory Traversal via Rack:DirectoryCVE-2026-22860Fix available7.5 High
- libssh, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreLibssh: libssh: denial of service due to malformed sftp messageCVE-2026-0968Fix available3.1 Low
- libssh, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreLibssh: libssh: denial of service via inefficient regular expression processingCVE-2026-0967Fix available2.2 Low
- libssh, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreLibssh: libssh: denial of service via zero-length input in ssh_get_hexa()CVE-2026-0966Fix available6.5 Medium
- libssh, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreLibssh: libssh: denial of service via improper configuration file handlingCVE-2026-0965Fix available3.3 Low
- libssh, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreLibssh: improper sanitation of paths received from scp serversCVE-2026-0964Fix available5.0 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik: TCP readTimeout bypass via STARTTLS on PostgresCVE-2026-25949Fix available7.5 High
- google keras, red hat openshift ai (rhoai) +1 moreArbitrary File Read in Keras via HDF5 External DatasetsCVE-2026-1669Fix available7.1 High
- python pillow, red hat openshift lightspeed, ai inference server +24 more +26 morePillow has an out-of-bounds write when loading PSD imagesCVE-2026-25990Fix available8.6 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- red hat ai inference server, enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 more +4 moreDiskCache has unsafe pickle deserializationCVE-2025-698729.8 Critical
- cryptography.io cryptography, red hat openshift lightspeed, advanced cluster management for kubernetes 2 +23 more +25 morecryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007Fix available8.2 High
- libpng, red hat ai inference server 3.3, build of openjdk 1.8 +34 more +36 moreLIBPNG has a heap buffer overflow in png_set_quantizeCVE-2026-25646Fix available8.3 High
- gnu gnutls, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreGnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binderCVE-2026-1584Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639Fix available7.5 High
- red hat cert manager support for red hat openshift release 1.18, ai inference server 3.2, ai inference server 3.3 +23 more +25 moreGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationCVE-2025-14831Fix available5.3 Medium
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- microsoft p11-kit, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +16 more +18 moreP11-kit: null dereference via c_derivekey with specific null parametersCVE-2026-2100Fix available5.3 Medium
- go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 morePotential code smuggling via doc comments in cmd/cgoCVE-2025-61732Fix available8.6 High
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +3 more +5 moreFastify's Content-Type header tab character allows body validation bypassCVE-2026-25223Fix available7.5 High
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus is vulnerable to Prototype PollutionCVE-2026-25521Fix available9.4 Critical
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM leaks a heap address when PIL throws an errorCVE-2026-22778Public exploitFix availableEPSS 18.3%9.8 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreLibsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http responseCVE-2026-1761Fix available8.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibxml2: memory leak leading to local denial of service in xmllint interactive shellCVE-2026-1757Fix available6.2 Medium
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24842Fix available8.2 High
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`CVE-2026-24779Fix available7.1 High
- linuxfoundation pytorch, red hat openshift ai (rhoai), openshift ai 2.25 +2 morePyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint FilesCVE-2026-24747Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreGlib: glib: memory corruption via integer overflow in unicode case conversionCVE-2026-1489Fix available5.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGlib: glib: local denial of service via buffer underflow in content type parsingCVE-2026-1485Fix available2.8 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreGlib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()CVE-2026-1484Fix available4.2 Medium
- openssl, red hat cost management 4, ai inference server 3.2 +316 more +318 moreStack buffer overflow in CMS (Auth)EnvelopedData parsingCVE-2025-15467Public exploitFix availableEPSS 74.8%8.8 High
- fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 morePython-Multipart has Arbitrary File Write via Non-Default ConfigurationCVE-2026-24486Public exploitFix available8.6 High
- red hat openshift virtualization 4Kubevirt: kubevirt: vm administration denial of service via guest agentCVE-2025-145256.4 Medium
- red hat build of quarkus 3.27.2.redhat, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectCVE-2025-14969Fix available4.3 Medium
- red hat openshift virtualization 4, rhel-9-cnv-4.19 +1 moreVirt-cdi-controller: unauthorized pvc cloning via dataimportcronCVE-2025-14459Fix available8.5 High
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionCVE-2026-0603Public exploitFix available8.3 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- google sentencepiece, red hat ai inference server, enterprise linux ai (rhel ai) 3 +3 more +5 moreInvalid Memory Access in Sentencepiece,CVE-2026-1260Fix available8.5 High
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 moreArgo Workflows affected by stored XSS in the artifact directory listingCVE-2026-23960Fix available7.3 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- Show moreLoading…