Skip to content
Noroxi

openshift ai records

51 published records for vendor openshift ai.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
14
With a fix record
86.3%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

51 records
  • CVE-2026-31228
    39Monitor

    The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component.

    CriticalCVSS 9.8No exploitEPSS 0%

    May 12, 2026

  • CVE-2025-69872
    39Monitor

    DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.

    CriticalCVSS 9.8No exploitEPSS 0%

    Feb 11, 2026

  • CVE-2026-31230
    39Monitor

    The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (rob

    CriticalCVSS 9.8No exploitEPSS 0%

    May 12, 2026

  • CVE-2026-31236
    39Monitor

    The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.

    CriticalCVSS 9.8No exploitEPSS 0%

    May 12, 2026

  • CVE-2026-56121
    37Monitor

    Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    feast-dev · feastJun 24, 2026

  • CVE-2026-44990
    37Monitor

    Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

    CriticalCVSS 9.3No exploitEPSS 0%

    apostrophecms · sanitize-htmlJun 12, 2026

  • CVE-2025-14813
    37Monitor

    GOSTCTR implementation unable to process more than 255 blocks correctly

    CriticalCVSS 9.3No exploitEPSS 0%

    legion of the bouncy castle inc. · bc-javaApr 15, 2026

  • CVE-2026-23537
    36Monitor

    Feast: unauthenticated arbitrary file write

    CriticalCVSS 9.1No exploitEPSS 1%

    feast · feast feature serverJul 1, 2026

  • CVE-2026-9277
    36Monitor

    shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    May 22, 2026

  • CVE-2026-8461
    35Monitor

    Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

    HighCVSS 8.8Proof of conceptEPSS 1%

    ffmpeg · ffmpegJun 18, 2026

  • CVE-2026-5598
    35Monitor

    Non-constant time comparisons risk private key leakage in FrodoKEM.

    HighCVSS 8.9No exploitEPSS 1%

    legion of the bouncy castle inc. · bc-javaApr 15, 2026

  • CVE-2026-58049
    35Monitor

    FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

    HighCVSS 8.8No exploitEPSS 0%

    ffmpeg · ffmpegJun 27, 2026

  • CVE-2026-12143
    34Monitor

    form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

    HighCVSS 8.7No exploitEPSS 0%

    form-data · form-dataJun 12, 2026

  • CVE-2026-41673
    34Monitor

    xmldom: Denial of service via uncontrolled recursion in XML serialization

    HighCVSS 8.7No exploitEPSS 0%

    xmldom · xmldomMay 7, 2026

  • CVE-2026-2472
    34Monitor

    Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization

    HighCVSS 8.6Proof of conceptEPSS 0%

    google cloud · vertex ai sdk for pythonFeb 20, 2026

  • CVE-2026-33079
    34Monitor

    Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

    HighCVSS 8.7No exploitEPSS 0%

    lepture · mistuneMay 6, 2026

  • CVE-2026-31812
    34Monitor

    Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

    HighCVSS 8.7No exploitEPSS 0%

    quinn-rs · quinnMar 10, 2026

  • CVE-2026-41674
    34Monitor

    xmldom: XML injection through unvalidated DocumentType serialization

    HighCVSS 8.7No exploitEPSS 0%

    xmldom · xmldomMay 7, 2026

  • CVE-2026-49851
    34Monitor

    Mistune: Potential DoS via quadratic-time parsing in parse_link_text

    HighCVSS 8.7No exploitEPSS 0%

    lepture · mistuneJun 24, 2026

  • CVE-2026-41675
    34Monitor

    xmldom: XML node injection through unvalidated processing instruction serialization

    HighCVSS 8.7No exploitEPSS 0%

    xmldom · xmldomMay 7, 2026

  • CVE-2026-41672
    34Monitor

    xmldom: XML node injection through unvalidated comment serialization

    HighCVSS 8.7No exploitEPSS 0%

    xmldom · xmldomMay 7, 2026

  • CVE-2026-0603
    33Monitor

    Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

    HighCVSS 8.3Proof of conceptEPSS 1%

    red hat · red hat jboss enterprise application platform 7.1 eus for rhel 7Jan 23, 2026

  • CVE-2026-1615
    32Monitor

    Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path ex

    HighCVSS 8.2No exploitEPSS 1%

    Feb 9, 2026

  • CVE-2026-23536
    31Monitor

    Feast: unauthenticated arbitrary file read

    HighCVSS 7.5Proof of conceptEPSS 2%

    red hat · red hat openshift ai (rhoai)Mar 20, 2026

  • CVE-2026-44724
    31Monitor

    systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

    HighCVSS 7.8No exploitEPSS 0%

    sebhildebrandt · systeminformationMay 27, 2026