Vulnerabilities of Red Hat Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2025-67030	Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…	8.8 High	Mar 25, 2026
CVE-2026-33211	Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines	9.6 Critical	Mar 23, 2026
CVE-2026-33228	flatted is a circular JSON parser	8.9 High	Mar 20, 2026
CVE-2026-33236	NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research…	8.1 High	Mar 20, 2026
CVE-2026-33231	NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research…	7.5 High	Mar 20, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2026-23536	A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated…	7.5 High	Mar 20, 2026
CVE-2026-32829	lz4_flex is a pure Rust implementation of LZ4 compression/decompression	8.2 High	Mar 20, 2026
CVE-2025-15031	A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar…	8.1 High	Mar 18, 2026
CVE-2026-30922	pyasn1 is a generic ASN.1 library for Python	7.5 High	Mar 18, 2026
CVE-2026-28500	Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability	8.6 High	Mar 18, 2026
CVE-2026-27459	pyOpenSSL is a Python wrapper around the OpenSSL library	7.2 High	Mar 17, 2026
CVE-2026-32981	A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1	8.7 High	Mar 17, 2026
CVE-2025-69196	FastMCP is the standard framework for building MCP applications	7.4 High	Mar 16, 2026
CVE-2026-28498	Authlib is a Python library which builds OAuth and OpenID Connect servers	8.2 High	Mar 16, 2026
CVE-2026-27962	Authlib is a Python library which builds OAuth and OpenID Connect servers	9.1 Critical	Mar 16, 2026
CVE-2025-14287	A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the…	7.5 High	Mar 15, 2026
CVE-2026-32640	SimpleEval is a library for adding evaluatable expressions into python projects	8.7 High	Mar 13, 2026
CVE-2026-32597	PyJWT is a JSON Web Token implementation in Python	7.5 High	Mar 12, 2026
CVE-2026-2229	ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…	7.5 High	Mar 12, 2026
CVE-2026-1528	ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length	7.5 High	Mar 12, 2026
CVE-2026-1526	The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…	7.5 High	Mar 12, 2026
CVE-2026-32274	Black is the uncompromising Python code formatter	8.7 High	Mar 12, 2026
CVE-2026-32141	flatted is a circular JSON parser	7.5 High	Mar 12, 2026
CVE-2026-28356	multipart is a fast multipart/form-data parser for python	7.5 High	Mar 12, 2026

Other Red Hat products