Vulnerabilities of Red Hat Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-44724	systeminformation is a System and OS information library for node.js	7.8 High	May 27, 2026
CVE-2026-48710	Exploited Kludex Starlette HTTP Request/Response Smuggling Vulnerability	6.5 Medium	May 26, 2026
CVE-2026-48864	Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data	7.8 High	May 26, 2026
CVE-2026-2651	A vulnerability in MLflow…	9.0 Critical	May 25, 2026
CVE-2026-39821	The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label	9.6 Critical	May 22, 2026
CVE-2026-9277	shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`	8.1 High	May 22, 2026
CVE-2026-42508	Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation	9.1 Critical	May 22, 2026
CVE-2026-46595	Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…	10.0 Critical	May 22, 2026
CVE-2026-39829	The RSA and DSA public key parsers did not enforce size limits on key parameters	7.5 High	May 22, 2026
CVE-2026-39830	A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the…	9.1 Critical	May 22, 2026
CVE-2026-39835	SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be…	5.3 Medium	May 22, 2026
CVE-2026-39828	When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were…	6.3 Medium	May 22, 2026
CVE-2026-39832	When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not…	9.1 Critical	May 22, 2026
CVE-2026-47102	LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint	8.7 High	May 21, 2026
CVE-2026-47101	LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their…	8.7 High	May 21, 2026
CVE-2026-9149	Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file	6.5 Medium	May 20, 2026
CVE-2026-9150	Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums	6.5 Medium	May 20, 2026
CVE-2026-2611	In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints	9.6 Critical	May 19, 2026
CVE-2025-51427	An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in…	7.3 High	May 19, 2026
CVE-2026-45736	ws is an open source WebSocket client and server for Node.js	4.4 Medium	May 15, 2026
CVE-2026-44513	Diffusers is the a library for pretrained diffusion models	8.8 High	May 14, 2026
CVE-2026-44484	PyTorch Lightning is a deep learning framework to pretrain and finetune AI models	9.3 Critical	May 14, 2026
CVE-2026-42561	Python-Multipart is a streaming multipart parser for Python	7.5 High	May 13, 2026
CVE-2026-42587	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42584	Netty is an asynchronous, event-driven network application framework	7.3 High	May 13, 2026

Other Red Hat products