Known vulnerabilities in Red Hat Enterprise Linux AI (RHEL AI) 3

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-48746	vLLM is an inference and serving engine for large language models (LLMs)	9.1 Critical	Jun 22, 2026
CVE-2026-45833	A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated…	9.4 Critical	Jun 12, 2026
CVE-2026-49121	AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization	9.2 Critical	Jun 1, 2026
CVE-2026-39821	The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label	9.6 Critical	May 22, 2026
CVE-2026-42508	Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation	9.1 Critical	May 22, 2026
CVE-2026-46595	Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…	10.0 Critical	May 22, 2026
CVE-2026-45829	A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an…	10.0 Critical	May 18, 2026
CVE-2026-44484	PyTorch Lightning is a deep learning framework to pretrain and finetune AI models	9.3 Critical	May 14, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-6100	Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a…	9.1 Critical	Apr 13, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2025-69872	DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default	9.8 Critical	Feb 11, 2026
CVE-2026-1615	Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of…	9.8 Critical	Feb 9, 2026
CVE-2026-22778	vLLM is an inference and serving engine for large language models (LLMs)	9.8 Critical	Feb 2, 2026
CVE-2025-61140	The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution	9.8 Critical	Jan 28, 2026
CVE-2025-56005	An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via…	9.8 Critical	Jan 20, 2026

Other Red Hat products