RH
Product
Red Hat OpenShift AI 2.16
13
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 2Low 1
Watch
Add Red Hat OpenShift AI 2.16 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5483 | 9.9 | Apr 10 | Odh-dashboard: odh dashboard kubernetes service account exposure Affected: All versions, or not specified |
| CVE-2025-10725 | 9.9 | Sep 30 | Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin Affected: All versions, or not specified |
| CVE-2026-2229 | 7.5 | Mar 12 | undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation Affected: All versions, or not specified |
| CVE-2026-1528 | 7.5 | Mar 12 | undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client Affected: All versions, or not specified |
| CVE-2026-1526 | 7.5 | Mar 12 | undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression Affected: All versions, or not specified |
| CVE-2026-32141 | 7.5 | Mar 12 | flatted: Unbounded recursion DoS in parse() revive phase Affected: All versions, or not specified |
| CVE-2026-29074 | 7.5 | Mar 6 | SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) Affected: All versions, or not specified |
| CVE-2026-25639 | 7.5 | Feb 9 | Axios affected by Denial of Service via __proto__ Key in mergeConfig Affected: All versions, or not specified |
| CVE-2026-25223 | 7.5 | Feb 3 | Fastify's Content-Type header tab character allows body validation bypass Affected: All versions, or not specified |
| CVE-2024-10963 | 7.4 | Nov 7 | Pam: improper hostname interpretation in pam_access leads to access control bypass Affected: All versions, or not specified |
| CVE-2025-57852 | 6.4 | Sep 30 | Openshift-ai: privilege escalation via excessive /etc/passwd permissions Affected: All versions, or not specified |
| CVE-2025-6193 | 5.9 | Jun 20 | Trustyai-explainability: command injection via lmevaljob cr Affected: All versions, or not specified |
| CVE-2025-69873 | 2.9 | Feb 11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled Affected: All versions, or not specified |
Showing 13
