| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Keras has an untrusted deserialization vulnerabilityCVE-2026-1462 · GHSA-4F3F-G24H-FR8MVersion ranges need review. |
kerasRed Hat OpenShift AI (RHOAI)/rhoai/odh-modelmesh-runtime-adapter-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsCVE-2026-44431 · GHSA-QCCP-GFCP-XXVCVersion ranges need review. |
urllib3Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Python-Markdown has an Uncaught ExceptionCVE-2025-69534 · GHSA-5WMX-573V-2QWQVersion ranges need review. |
markdownRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight LoadingCVE-2026-1669 · GHSA-3M4Q-JMJ6-R34QVersion ranges need review. |
kerasRed Hat OpenShift AI (RHOAI)/rhoai/odh-kserve-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpackCVE-2026-24049 · GHSA-8RRH-RW8J-W5FXVersion ranges need review. |
wheelLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
PyPIRed Hat |
High
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Keras is vulnerable to arbitrary local file loading and Server-Side Request ForgeryCVE-2025-12058 · GHSA-MQ84-HJQX-CWF2Version ranges need review. |
kerasRed Hat OpenShift AI (RHOAI)/rhoai/odh-kserve-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.CVE-2025-9905 · GHSA-36RR-WW3J-VRJVVersion ranges need review. |
kerasRed Hat OpenShift AI (RHOAI)/rhoai/odh-modelmesh-runtime-adapter-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| Keras is vulnerable to Deserialization of Untrusted DataCVE-2025-9906 · GHSA-36FQ-JGMW-4R9CVersion ranges need review. |
kerasRed Hat OpenShift AI (RHOAI)/rhoai/odh-modelmesh-runtime-adapter-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Starlette has possible denial-of-service vector when parsing large files in multipart formsCVE-2025-54121 · GHSA-2C2J-9GV5-CJ73Version ranges need review. |
starletteOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| protobuf-python has a potential Denial of Service issueCVE-2025-4565 · GHSA-8QVM-5X2C-J2W7Version ranges need review. |
protobufOpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
