RHSA-2026:3713

Ray is an AI compute engine.

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default.

LangChain is a framework for building LLM-powered applications.

fontTools is a library for manipulating fonts, written in Python.

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives.

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character se…

vLLM is an inference and serving engine for large language models (LLMs).

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

urllib3 is an HTTP client library for Python.

vLLM is an inference and serving engine for large language models (LLMs).

urllib3 is a user-friendly HTTP client library for Python.

vLLM is an inference and serving engine for large language models (LLMs).

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

KEDA is a Kubernetes-based Event Driven Autoscaling component.

The net/url package does not set a limit on the number of query parameters in a query.

Python-Multipart is a streaming multipart parser for Python.

vLLM is an inference and serving engine for large language models (LLMs).

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

Tornado is a Python web framework and asynchronous networking library.

Tornado is a Python web framework and asynchronous networking library.

urllib3 is a user-friendly HTTP client library for Python.

Glob matches files using patterns the shell uses.

vLLM is an inference and serving engine for large language models (LLMs).

vLLM is an inference and serving engine for large language models (LLMs).

Expr is an expression language and expression evaluation for Go.

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.

runc is a CLI tool for spawning and running containers according to the OCI specification.

containerd is an open-source container runtime.

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory e…

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set.