Known vulnerabilities in Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-41607	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41606	Uncontrolled Recursion vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41605	Integer Overflow or Wraparound vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41604	Out-of-bounds Read vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41603	Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift	Not rated	Apr 28, 2026
CVE-2026-41602	Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue…	Not rated	Apr 28, 2026
CVE-2025-48431	Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings	Not rated	Apr 28, 2026
CVE-2026-41481	LangChain is a framework for building agents and LLM-powered applications	6.5 Medium	Apr 24, 2026
CVE-2026-42039	Axios is a promise based HTTP client for the browser and Node.js	6.9 Medium	Apr 24, 2026
CVE-2026-42041	Axios is a promise based HTTP client for the browser and Node.js	4.8 Medium	Apr 24, 2026
CVE-2026-42043	Axios is a promise based HTTP client for the browser and Node.js	7.2 High	Apr 24, 2026
CVE-2026-42044	Axios is a promise based HTTP client for the browser and Node.js	6.5 Medium	Apr 24, 2026
CVE-2026-42033	Axios is a promise based HTTP client for the browser and Node.js	7.4 High	Apr 24, 2026
CVE-2026-41140	Poetry is a dependency manager for Python	0.6 Low	Apr 24, 2026
CVE-2026-40897	Math.js is an extensive math library for JavaScript and Node.js	8.8 High	Apr 24, 2026
CVE-2026-40886	Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes	7.7 High	Apr 23, 2026
CVE-2026-6844	Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files	5.5 Medium	Apr 22, 2026
CVE-2026-6845	Binutils: binutils: denial of service via crafted elf file	5.0 Medium	Apr 22, 2026
CVE-2026-40542	Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept…	Not rated	Apr 22, 2026
CVE-2026-40938	Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines	7.5 High	Apr 21, 2026
CVE-2026-40895	follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…	6.9 Medium	Apr 21, 2026
CVE-2026-6587	A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3	5.3 Medium	Apr 20, 2026
CVE-2026-41242	protobufjs compiles protobuf definitions into JavaScript (JS) functions	9.4 Critical	Apr 18, 2026
CVE-2026-40192	Pillow is a Python imaging library	8.7 High	Apr 15, 2026
CVE-2026-6385	A flaw was found in FFmpeg	6.5 Medium	Apr 15, 2026

Other Red Hat products