Vulnerabilities of Red Hat Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-6587	A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3	5.3 Medium	Apr 20, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-40192	Pillow is a Python imaging library	8.7 High	Apr 15, 2026
CVE-2026-6385	A flaw was found in FFmpeg	6.5 Medium	Apr 15, 2026
CVE-2026-33805	@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection…	9.0 Critical	Apr 15, 2026
CVE-2026-5588	Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	6.3 Medium	Apr 15, 2026
CVE-2026-5598	Covert timing channel vulnerability in Legion of the Bouncy Castle Inc	8.9 High	Apr 15, 2026
CVE-2026-0636	Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the…	5.5 Medium	Apr 15, 2026
CVE-2025-14813	: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc	9.3 Critical	Apr 15, 2026
CVE-2026-33806	Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed…	7.5 High	Apr 15, 2026
CVE-2026-1462	A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow…	8.8 High	Apr 13, 2026
CVE-2026-40175	Axios is a promise based HTTP client for the browser and Node.js	4.8 Medium	Apr 10, 2026
CVE-2026-5483	A flaw was found in odh-dashboard in Red Hat Openshift AI	8.5 High	Apr 10, 2026
CVE-2026-40217	LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the…	8.8 High	Apr 10, 2026
CVE-2026-39983	basic-ftp is an FTP client for Node.js	8.6 High	Apr 9, 2026
CVE-2025-62718	Axios is a promise based HTTP client for the browser and Node.js	6.3 Medium	Apr 9, 2026
CVE-2026-39892	cryptography has a buffer overflow if non-contiguous buffers were passed to APIs	6.9 Medium	Apr 8, 2026
CVE-2026-23869	A denial of service vulnerability exists in React Server Components, affecting the following packages:…	7.5 High	Apr 8, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-33810	When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to…	7.5 High	Apr 8, 2026
CVE-2026-33815	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-33816	Memory-safety vulnerability in github.com/jackc/pgx/v5	9.8 Critical	Apr 7, 2026
CVE-2026-35030	LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format	9.4 Critical	Apr 6, 2026
CVE-2026-35029	LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format	8.7 High	Apr 6, 2026

Other Red Hat products