Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 228

Export CSV
CVE-2026-18948

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

CVSS 3.1 · 9.9 Critical EPSS 1.1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-14450

Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges. The concrete consequences include the ability to mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate sensitive model access configuration.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-74242

Quay: repository notification uuid idor in quay api

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Quay 3 Openshift Update Service Quay
CVE-2026-16456

Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-3047

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.2 Red Hat Build Of Keycloak 26.2.14 Red Hat Build Of Keycloak 26.4 and 4 more
CVE-2026-5136

Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege escalation, granting the attacker administrator-level access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Theforeman
Products
Red Hat Satellite 6 Enterprise Linux Satellite and 4 more
CVE-2026-13316

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config

A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS/GCP/Azure environment through foreman component.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Theforeman
Products
Red Hat Satellite 6 Satellite Foreman
CVE-2026-0980

Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Logicminds Red Hat Redhat
Products
Rubyipmi Red Hat Satellite 6 Satellite and 3 more