RHSA-2026:10184

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

Netty is an asynchronous, event-driven network application framework.

PyJWT is a JSON Web Token implementation in Python.

pyasn1 is a generic ASN.1 library for Python.

Koa is middleware for Node.js using ES2017 async functions.

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader.

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths.

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing.

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.

A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

vLLM is an inference and serving engine for large language models (LLMs).

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format.

urllib3 is an HTTP client library for Python.

Netty is an asynchronous, event-driven network application framework.

urllib3 is a user-friendly HTTP client library for Python.

Black is the uncompromising Python code formatter.

Pillow is a Python imaging library.

vLLM is an inference and serving engine for large language models (LLMs).

SimpleEval is a library for adding evaluatable expressions into python projects.

Tornado is a Python web framework and asynchronous networking library.

Istio is an open platform to connect, manage, and secure microservices.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

The net/url package does not set a limit on the number of query parameters in a query.

Python-Multipart is a streaming multipart parser for Python.

pypdf is a free and open-source pure-python PDF library.

multipart is a fast multipart/form-data parser for python.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applie…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versions from 1.98.0 up to (but not including) 1.131.0 allows an unauthenticated remo…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

urllib3 is a user-friendly HTTP client library for Python.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

pypdf is a free and open-source pure-python PDF library.

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

Fastify is a fast and low overhead web framework, for Node.js.

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with…

vLLM is an inference and serving engine for large language models (LLMs).

TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.

A flaw was found in Red Hat Openshift AI Service.