TI-2026-30582 CVE-2026-42271 · GHSA-v4p8-mg3p-g94g
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Priority CRITICAL 97KEV
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.
Red Hat
Records7413All Threatist records
Exploited (KEV)98In CISA KEV
CVSS critical792CVSS 9.0–10.0
CVSS high2681CVSS 7.0–8.9
Exploited now
Red Hat records in CISA KEVTI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability TI-2015-04610 ISC BIND Data Processing Errors Vulnerability TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability TI-2015-02874 Red Hat Libuser Race Condition Vulnerability TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Openshift Ai · all components
TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
TI-2026-01159 CVE-2026-1462 · GHSA-4f3f-g24h-fr8m
Safe Mode Bypass in keras-team/keras
Priority HIGH 73
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`.
TI-2026-34281 CVE-2026-46625 · GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
TI-2026-28834 CVE-2026-39979
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
Priority HIGH 70
jq is a command-line JSON processor.
TI-2026-41777 CVE-2026-58016 · GHSA-8rpw-4xx7-27w7
Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
Priority MEDIUM 46
A flaw was found in GLib.
TI-2023-30638 CVE-2023-54365 · GHSA-7v4p-328v-8v5g
Traefik - Denial of Service via HTTP/2 Request Handling
Priority MEDIUM 44
Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapi…
TI-2026-04802 CVE-2026-5483 · GHSA-w59f-v72r-w493
Odh-dashboard: odh dashboard kubernetes service account exposure
Priority MEDIUM 43
A flaw was found in odh-dashboard in Red Hat Openshift AI.
TI-2024-07004 CVE-2024-7557 · GHSA-rrc7-8w2h-xw89
Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai
Priority MEDIUM 42
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace.
TI-2026-04164 CVE-2026-4775 · GHSA-cm99-m826-vgg7
Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing
Priority LOW 37
A flaw was found in the libtiff library.
TI-2025-11729 CVE-2025-12805 · GHSA-cq3g-qvxc-ghr5
Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy
Priority LOW 37
A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator.
TI-2026-12765 CVE-2026-15154 · GHSA-jm96-7wvj-j3r9
Regular expression denial of service in guardrails-detectors
Priority LOW 29
A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI.