Exploit Intelligence (Redhat) - vulnerabilities (CVEs)

27 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Exploit Intelligence

• CVE-2026-114236 - CVSS 3.3 (low), 2026-10-21: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls…
• CVE-2026-87744 - CVSS 9.1 (critical), 2026-10-12: A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a…
• CVE-2026-94451 - CVSS 6.5 (medium), 2026-10-12: Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly…
• CVE-2026-94449 - CVSS 7.5 (high), 2026-09-21: A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices.…
• CVE-2026-93432 - CVSS 6.1 (medium), 2026-09-18: A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content…
• CVE-2026-87743 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and…
• CVE-2026-87742 - CVSS 7.5 (high), 2026-09-17: A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a…
• CVE-2026-81829 - CVSS 5.3 (medium), 2026-09-17: A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When…
• CVE-2026-48746 - CVSS 9.1 (critical), 2026-06-22: vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust…
• CVE-2026-49468 - CVSS 9.8 (critical), 2026-06-22: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could,…
• CVE-2026-54293 - CVSS 7.5 (high), 2026-06-22: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language…
• CVE-2026-12773 - CVSS 9.8 (critical), 2026-06-21: A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file…
• CVE-2026-48818 - CVSS 7.5 (high), 2026-06-17: Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as…
• CVE-2026-41567 - CVSS 7.5 (high), 2026-06-05: Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to…
• CVE-2026-34993 - CVSS 7.3 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
• CVE-2026-8643 - CVSS 8 (high), 2026-06-01: pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory,…
• CVE-2026-45292 - CVSS 7.5 (high), 2026-05-28: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to…
• CVE-2026-48710 - CVSS 6.5 (medium), 2026-05-26: Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct…
• CVE-2026-44209 - CVSS 7.5 (high), 2026-05-26: Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render…
• CVE-2026-47102 - CVSS 8.8 (high), 2026-05-21: LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating…
• CVE-2026-47101 - CVSS 8.8 (high), 2026-05-21: LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a…
• CVE-2026-42561 - CVSS 7.5 (high), 2026-05-13: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header…
• CVE-2026-44432 - CVSS 8.9 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
• CVE-2026-42338 - CVSS 8.1 (high), 2026-05-12: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not…
• CVE-2026-42271 - CVSS 8.8 (high), 2026-05-08: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to…
• CVE-2026-42203 - CVSS 8.8 (high), 2026-05-08: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test…
• CVE-2026-27459 - CVSS 9.8 (critical), 2026-03-18: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to…