What’s Vulnerable › Products
Red Hat OpenShift AI 3.5 vulnerabilities
27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.
Check whether your Red Hat OpenShift AI 3.5 version is affected
Latest Red Hat OpenShift AI 3.5 vulnerabilities
- CVE-2026-114406 — Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns (CVSS 6.8)
- CVE-2026-74860 — Libxml2: double-free/uaf in libxml2 python bindings (CVSS 8.5)
- CVE-2026-86332 — Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user (CVSS 6.5)
- CVE-2026-18982 — Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles (CVSS 8.8)
- CVE-2026-18951 — Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole (CVSS 8.8)
- CVE-2026-18620 — Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy (CVSS 7.1)
- CVE-2026-18618 — Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener (CVSS 7.5)
- CVE-2026-18617 — Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod (CVSS 8.8)
- CVE-2026-18611 — Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials (CVSS 7.5)
- CVE-2026-18608 — Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide (CVSS 8.7)
- CVE-2026-15581 — Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide (CVSS 8.0)
- CVE-2026-15467 — Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override (CVSS 8.1)
- CVE-2026-15588 — Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering (CVSS 5.3)
- CVE-2026-16118 — Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVSS 7.1)
- CVE-2026-58015 — Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVSS 7.5)
- CVE-2026-58014 — Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVSS 8.6)
- CVE-2026-58013 — Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVSS 8.2)
- CVE-2026-58012 — Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVSS 8.2)
- CVE-2026-58011 — Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime (CVSS 7.5)
- CVE-2026-58010 — Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVSS 8.2)
- CVE-2026-55655 — Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions (CVSS 6.1)
- CVE-2026-55653 — Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service (CVSS 6.5)
- CVE-2026-56211 — Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames (CVSS 7.1)
- CVE-2026-56210 — Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id (CVSS 7.1)
- CVE-2026-56209 — Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack (CVSS 7.1)