TI-2025-40560 CVE-2025-66034 · GHSA-768j-98cg-p3fv
fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
Priority HIGH 75
fontTools is a library for manipulating fonts, written in Python.
RHSA-2026:2106
RHOAI 2.25.2 - Red Hat OpenShift AI
Released 2026-02-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
Fixes 15 records
TI-2025-41020 CVE-2025-66626 · GHSA-xrqc-7xgx-c9vh
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Priority HIGH 70
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.
TI-2026-19377 CVE-2026-24049 · GHSA-8rrh-rw8j-w5fx
wheel Allows Arbitrary File Permission Modification via Path Traversal
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
TI-2025-42006 CVE-2025-68476 · GHSA-c4p6-qg4m-9jmr
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
Priority MEDIUM 43
KEDA is a Kubernetes-based Event Driven Autoscaling component.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-41422 CVE-2025-67726 · GHSA-jhmp-mqwm-3gq8
Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
TI-2025-41421 CVE-2025-67725 · GHSA-c98p-7wgm-6p64
Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-41736 CVE-2025-68156 · GHSA-cfpf-hrx2-8rv6
Expr has Denial of Service via Unbounded Recursion in Builtin Functions
Priority LOW 39
Expr is an expression language and expression evaluation for Go.
TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw
Fulcio allocates excessive memory during token parsing
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2025-11729 CVE-2025-12805 · GHSA-cq3g-qvxc-ghr5
Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy
Priority LOW 37
A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator.
TI-2025-32917 CVE-2025-52881 · GHSA-cgrx-mc8f-2prm
runc: LSM labels can be bypassed with malicious config using dummy procfs files
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.