agentprime: red-hat-openshift-ai-rhoai

agentprime: red-hat-openshift-ai-rhoaiEvery new CVE for red-hat-openshift-ai-rhoai.https://agentprime.io/CVE-2026-107912: Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawhttps://agentprime.io/advisories/CVE-2026-107912/https://agentprime.io/advisories/CVE-2026-107912/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:27:11 GMTCVECVE-2026-120194: Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stephttps://agentprime.io/advisories/CVE-2026-120194/https://agentprime.io/advisories/CVE-2026-120194/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 10:11:47 GMTCVECVE-2026-117574: Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorizationhttps://agentprime.io/advisories/CVE-2026-117574/https://agentprime.io/advisories/CVE-2026-117574/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 20:02:14 GMTCVEcriticalCVE-2026-13451: Kserve: kserve: server-side request forgery via malicious storageurihttps://agentprime.io/advisories/CVE-2026-13451/https://agentprime.io/advisories/CVE-2026-13451/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:52:51 GMTCVECVE-2026-114236: Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layershttps://agentprime.io/advisories/CVE-2026-114236/https://agentprime.io/advisories/CVE-2026-114236/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:04:32 GMTCVECVE-2026-17557: Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwardinghttps://agentprime.io/advisories/CVE-2026-17557/https://agentprime.io/advisories/CVE-2026-17557/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 07:59:10 GMTCVECVE-2026-108334: Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway p…https://agentprime.io/advisories/CVE-2026-108334/https://agentprime.io/advisories/CVE-2026-108334/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 18:44:42 GMTCVECVE-2026-102010: Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_ifhttps://agentprime.io/advisories/CVE-2026-102010/https://agentprime.io/advisories/CVE-2026-102010/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 18:54:31 GMTCVECVE-2026-87743: Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityhttps://agentprime.io/advisories/CVE-2026-87743/https://agentprime.io/advisories/CVE-2026-87743/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 09:38:27 GMTCVECVE-2026-92091: Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayhttps://agentprime.io/advisories/CVE-2026-92091/https://agentprime.io/advisories/CVE-2026-92091/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 07:34:08 GMTCVECVE-2026-86332: Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userhttps://agentprime.io/advisories/CVE-2026-86332/https://agentprime.io/advisories/CVE-2026-86332/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Sep 2026 08:39:15 GMTCVECVE-2026-84185: Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationhttps://agentprime.io/advisories/CVE-2026-84185/https://agentprime.io/advisories/CVE-2026-84185/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 20:46:40 GMTCVECVE-2026-18393: Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursorhttps://agentprime.io/advisories/CVE-2026-18393/https://agentprime.io/advisories/CVE-2026-18393/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 09:05:35 GMTCVECVE-2026-80179: Jwcrypto: jwcrypto: denial of service via malformed jwe tokenshttps://agentprime.io/advisories/CVE-2026-80179/https://agentprime.io/advisories/CVE-2026-80179/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 21:14:23 GMTCVECVE-2026-43961: Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionhttps://agentprime.io/advisories/CVE-2026-43961/https://agentprime.io/advisories/CVE-2026-43961/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 14:06:09 GMTCVECVE-2026-18950: Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationhttps://agentprime.io/advisories/CVE-2026-18950/https://agentprime.io/advisories/CVE-2026-18950/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:45:05 GMTCVECVE-2026-18947: Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materializationhttps://agentprime.io/advisories/CVE-2026-18947/https://agentprime.io/advisories/CVE-2026-18947/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:44:51 GMTCVECVE-2026-18942: Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalationhttps://agentprime.io/advisories/CVE-2026-18942/https://agentprime.io/advisories/CVE-2026-18942/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:44:46 GMTCVECVE-2026-18941: Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationhttps://agentprime.io/advisories/CVE-2026-18941/https://agentprime.io/advisories/CVE-2026-18941/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:44:42 GMTCVECVE-2026-14450: Maas-billing: maas api: privilege escalation via forged http headers due to missing authenticationhttps://agentprime.io/advisories/CVE-2026-14450/https://agentprime.io/advisories/CVE-2026-14450/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:44:06 GMTCVEcriticalCVE-2026-13717: Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)https://agentprime.io/advisories/CVE-2026-13717/https://agentprime.io/advisories/CVE-2026-13717/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 20:44:01 GMTCVECVE-2026-23538: Feast: resource exhaustion via websocket endpointhttps://agentprime.io/advisories/CVE-2026-23538/https://agentprime.io/advisories/CVE-2026-23538/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 00:10:50 GMTCVECVE-2026-15063: Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabledhttps://agentprime.io/advisories/CVE-2026-15063/https://agentprime.io/advisories/CVE-2026-15063/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jul 2026 14:58:12 GMTCVECVE-2026-15044: Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apishttps://agentprime.io/advisories/CVE-2026-15044/https://agentprime.io/advisories/CVE-2026-15044/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jul 2026 14:37:22 GMTCVECVE-2026-23537: Feast: unauthenticated arbitrary file writehttps://agentprime.io/advisories/CVE-2026-23537/https://agentprime.io/advisories/CVE-2026-23537/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 13:49:27 GMTCVEcriticalCVE-2026-56211: Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frameshttps://agentprime.io/advisories/CVE-2026-56211/https://agentprime.io/advisories/CVE-2026-56211/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 16:28:33 GMTCVECVE-2026-56210: Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_idhttps://agentprime.io/advisories/CVE-2026-56210/https://agentprime.io/advisories/CVE-2026-56210/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 16:28:33 GMTCVECVE-2026-56209: Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackhttps://agentprime.io/advisories/CVE-2026-56209/https://agentprime.io/advisories/CVE-2026-56209/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 16:28:26 GMTCVECVE-2026-12706: Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()https://agentprime.io/advisories/CVE-2026-12706/https://agentprime.io/advisories/CVE-2026-12706/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 10:55:03 GMTCVECVE-2026-6385: Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parserhttps://agentprime.io/advisories/CVE-2026-6385/https://agentprime.io/advisories/CVE-2026-6385/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Apr 2026 19:18:39 GMTCVECVE-2026-5483: Odh-dashboard: odh dashboard kubernetes service account exposurehttps://agentprime.io/advisories/CVE-2026-5483/https://agentprime.io/advisories/CVE-2026-5483/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:33:25 GMTCVECVE-2025-12805: Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyhttps://agentprime.io/advisories/CVE-2025-12805/https://agentprime.io/advisories/CVE-2025-12805/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Mar 2026 21:48:16 GMTCVECVE-2026-23536: Feast: unauthenticated arbitrary file readhttps://agentprime.io/advisories/CVE-2026-23536/https://agentprime.io/advisories/CVE-2026-23536/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 21:58:47 GMTCVECVE-2025-12103: Openshift-ai: trusty ai grants all authenticated users to list pods in any namespacehttps://agentprime.io/advisories/CVE-2025-12103/https://agentprime.io/advisories/CVE-2025-12103/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 28 Oct 2025 13:31:59 GMTCVECVE-2025-6193: Trustyai-explainability: command injection via lmevaljob crhttps://agentprime.io/advisories/CVE-2025-6193/https://agentprime.io/advisories/CVE-2025-6193/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Jun 2025 15:54:13 GMTCVE