TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
RHSA-2026:34456
RHOAI 3.4.2 - Red Hat OpenShift AI
Released 2026-07-01 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9, registry.redhat.io/rhoai/odh-llama-stack-core-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +33
Fixes 6 records
TI-2026-04577 CVE-2026-5241 · GHSA-fgcw-684q-jj6r
Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
Priority HIGH 76
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization.
TI-2026-02230 CVE-2026-2614 · GHSA-42h5-h8qh-vv9v
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
Priority HIGH 72
A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's file…
TI-2026-25663 CVE-2026-33245 · GHSA-8646-j5j9-6r62
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
Priority LOW 34
React Router is a router for React.
TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8
AIOHTTP Vulnerable to Deserialization of Untrusted Data
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…