Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-18941] Default authentication mode is no_auth — shared multi-tenant instances deployed without authentication
Default authentication mode is no_auth — shared multi-tenant instances deployed without authentication. Red Hat rates this important (CVSS 7.7). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-feature-server-rhel9:1786110051, rhoai/odh-feature-server-rhel9:1786110033, rhoai/odh-feature-server-rhel9:1786107278. Affected products named by the advisory: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.4.
High [CVE-2026-15581] TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide
TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide. Red Hat rates this important (CVSS 8). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-trustyai-service-operator-rhel9:1784993206, rhoai/odh-trustyai-service-operator-rhel9:1786614608, rhoai/odh-trustyai-service-operator-rhel9:1785187521, rhoai/odh-trustyai-service-operator-rhel9:1785187119. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-15467] LMEvalJob sidecar containers bypass protected environment variable filtering, allowing TRUST_REMOTE_CODE policy override
LMEvalJob sidecar containers bypass protected environment variable filtering, allowing TRUST_REMOTE_CODE policy override. Red Hat rates this important (CVSS 8.1). Weakness: CWE-266. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-trustyai-service-operator-rhel9:1784993206, rhoai/odh-trustyai-service-operator-rhel9:1786614608, rhoai/odh-trustyai-service-operator-rhel9:1785187521, rhoai/odh-trustyai-service-operator-rhel9:1785187119. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-13717] MaaS/llm-d inference Gateway: default allowedRoutes.namespaces.from: All allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
MaaS/llm-d inference Gateway: default allowedRoutes.namespaces.from: All allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs). Red Hat rates this important (CVSS 8.8). Weakness: CWE-284. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-rhel9-operator:1786123541, rhoai/odh-maas-controller-rhel9:1787153684. Affected products named by the advisory: Red Hat OpenShift AI 3.4; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-66805] stored DOM XSS via unescaped pod logs in document.write
stored DOM XSS via unescaped pod logs in document.write. Red Hat rates this important (CVSS 8). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:54432 with package multicluster-engine/console-mce-rhel9:1787079359, rhacm2/console-rhel9:1787339248, multicluster-engine/console-mce-rhel9:1787264250, rhacm2/console-rhel9:1787339213.
High [CVE-2026-69112] Path Traversal and Denial of Service via weight_map
Path Traversal and Denial of Service via weight_map. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22. Affected products named by the advisory: Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-18621] V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening
V1 Argo template path accepts arbitrary Workflow spec, bypassing all v2 security hardening. Red Hat rates this important (CVSS 7.6). Weakness: CWE-266. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-ml-pipelines-api-server-v2-rhel9:1784924951, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1787173417, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1785189934, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1785187920. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-18620] User-controlled ServiceAccount for workflow pods without authorization check — confused deputy
User-controlled ServiceAccount for workflow pods without authorization check — confused deputy. Red Hat rates this moderate (CVSS 7.1). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-ml-pipelines-api-server-v2-rhel9:1784924951, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1787173417, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1785189934, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1785187920. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-18618] Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener
Bundled gRPC 1.46.3 (2022) with published HTTP/2 DoS CVEs — directly reachable on listener. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-mlmd-grpc-server-rhel9:1785260280, rhoai/odh-mlmd-grpc-server-rhel9:1785262015, rhoai/odh-mlmd-grpc-server-rhel9:1785269945. Affected products named by the advisory: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.4.
High [CVE-2026-18617] MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod
MySQL DSN parameter injection via CustomExtraParams enables LOCAL INFILE file exfiltration from operator pod. Red Hat rates this important (CVSS 8.8). Weakness: CWE-915. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785189332, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1784833428, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1787002057, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785187936. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-18611] Cryptographically weak secret generation (math/rand) for DB and S3 credentials
Cryptographically weak secret generation (math/rand) for DB and S3 credentials. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-338. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785189332, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1784833428, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1787002057, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785187936. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-18608] Operator ClusterRole grants pods/exec:*, kubeflow.org */*, and ClusterRole/Binding CRUD cluster-wide
Operator ClusterRole grants pods/exec:*, kubeflow.org */*, and ClusterRole/Binding CRUD cluster-wide. Red Hat rates this important (CVSS 8.7). Weakness: CWE-250. Red Hat lists fixing advisory RHSA-2026:53262 with package rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785189332, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1784833428, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1787002057, rhoai/odh-data-science-pipelines-operator-controller-rhel9:1785187936. Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.4.
High [CVE-2026-72718] Arbitrary command execution via malicious Git configuration in `goose review`
Arbitrary command execution via malicious Git configuration in `goose review`. Red Hat rates this important (CVSS 7.3). Weakness: CWE-78. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose.
High [CVE-2026-71576] Manager trusts self-asserted evt.Source for leaf-hub identity in all status handlers
Manager trusts self-asserted evt. Source() for leaf-hub identity in all status handlers. Red Hat rates this important (CVSS 8.5). Weakness: CWE-345.
High [CVE-2026-68415] clear mode callbacks after failed mode setup
clear mode callbacks after failed mode setup. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825.
High [CVE-2026-68409] defer link RX stats percpu free to RCU
defer link RX stats percpu free to RCU. Red Hat rates this important (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat package: kernel.
High [CVE-2026-68404] use wiphy work for socket owner autodisconnect
use wiphy work for socket owner autodisconnect. Red Hat rates this moderate (CVSS 7). Weakness: CWE-367. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: kernel-rt.
High [CVE-2026-68402] Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames
Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames. Red Hat rates this moderate (CVSS 7). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-68401] Fix out-of-bound writes in ffa_setup_and_transmit
Fix out-of-bound writes in ffa_setup_and_transmit(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat package: kernel.
High [CVE-2026-68399] Fix UAF in sock clone early bailouts
Fix UAF in sock clone early bailouts. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26; Red Hat package: kernel-rt.