LiteLLM: Authenticated command execution via MCP stdio test endpoints

Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles

Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation

Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources

Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components

JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

protobufjs: Code injection through bytes field defaults in generated toObject code

jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials

Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

fast-uri vulnerable to host confusion via failed IDN canonicalization

Docling: Unsafe Zip Extraction in EasyOCR Model Download

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection