Known vulnerabilities in Red Hat OpenShift AI (RHOAI)

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-45830	A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated…	8.8 High	Jun 12, 2026
CVE-2026-48059	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-48043	Netty is a network application framework for development of protocol servers and clients	5.3 Medium	Jun 12, 2026
CVE-2026-47691	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-45674	Netty is a network application framework for development of protocol servers and clients	8.7 High	Jun 12, 2026
CVE-2026-45416	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-44893	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-44249	Netty is a network application framework for development of protocol servers and clients	8.1 High	Jun 11, 2026
CVE-2026-44486	Axios is a promise based HTTP client for the browser and Node.js	7.5 High	Jun 11, 2026
CVE-2026-44487	Axios is a promise based HTTP client for the browser and Node.js	8.2 High	Jun 11, 2026
CVE-2026-44488	Axios is a promise based HTTP client for the browser and Node.js	7.5 High	Jun 11, 2026
CVE-2026-44496	Axios is a promise based HTTP client for the browser and Node.js	7.5 High	Jun 11, 2026
CVE-2026-44495	Axios is a promise based HTTP client for the browser and Node.js	7.0 High	Jun 11, 2026
CVE-2026-44494	Axios is a promise based HTTP client for the browser and Node.js	8.7 High	Jun 11, 2026
CVE-2026-44492	Axios is a promise based HTTP client for the browser and Node.js	8.6 High	Jun 11, 2026
CVE-2026-11816	Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in…	8.1 High	Jun 11, 2026
CVE-2026-11850	Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read	5.0 Medium	Jun 11, 2026
CVE-2026-5497	vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded…	7.5 High	Jun 11, 2026
CVE-2026-46625	JavaScript Cookie is a JavaScript API for handling cookies, client-side	7.5 High	Jun 10, 2026
CVE-2025-71319	image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser	8.7 High	Jun 9, 2026
CVE-2026-40984	In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-40983	In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-41567	Moby is an open source container framework	7.2 High	Jun 5, 2026
CVE-2026-5241	A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an…	8.0 High	Jun 3, 2026
CVE-2026-4035	A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…	9.1 Critical	Jun 3, 2026

Other Red Hat products