OA
Product
Openshift AI
On CISA KEVExploited in the wild
11
CVEs
2
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 3Low 0
Watch
Add Openshift AI to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42271 In wildKEV | 8.8 | May 8 | LiteLLM: Authenticated command execution via MCP stdio test endpoints Affected: 2.25 before 2.25.8; 3.3 before 3.3.4; 3.4 |
| CVE-2024-7557 | 8.8 | Aug 12 | A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace Affected: All versions, or not specified |
| CVE-2025-12805 | 8.1 | Mar 26 | Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy Affected: 2.25 |
| CVE-2026-1462 | 7.8 | Apr 13 | Safe Mode Bypass in keras-team/keras Affected: 2.25 before 2.25.7 |
| CVE-2026-4775 | 7.8 | Mar 24 | Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing Affected: 3.4 before 3.4.3 |
| CVE-2023-54365 | 7.5 | Jun 23 | Traefik - Denial of Service via HTTP/2 Request Handling Affected: All versions, or not specified |
| CVE-2026-46625 | 7.5 | Jun 10 | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection Affected: All versions, or not specified |
Showing 7