PT-2026-56745

Multiple security vulnerabilities affect the kserve-modelmesh-serving package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: thingsboard, kserve-modelmesh, trino, dependency-track, nextflow, zookeeper, keycloak-config-cli, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, apache-nifi-registry, cassandra-reaper, akhq, cassandra, apache-nifi...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: thingsboard, kserve-modelmesh, trino, dependency-track, nextflow, zookeeper, keycloak-config-cli, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, apache-nifi-registry, cassandra-reaper, akhq, cassandra, apache-nifi...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, ontop, trino, akhq, ontop-fips, knative-kafka-broker-fips, dependency-track, hadoop-fips, nacos, keycloak-config-cli, kayenta,...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, ontop, trino, akhq, ontop-fips, knative-kafka-broker-fips, dependency-track, hadoop-fips, nacos, keycloak-config-cli, kayenta,...

EUVD-2025-31743

Malicious code in bioql PyPI...

CVE-2025-57852

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...

CVE-2025-57852 Openshift-ai: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...

CVE-2025-57852

A CVE is reported for KServe ModelMesh container images: a build-time /etc/passwd file created with group-writable permissions allows a non-root container user, if they are in the root group, to modify /etc/passwd and add a user with any UID (including 0), enabling full container root access. Thi...

CVE-2025-57852

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...

CVE-2025-57852: Incorrect Default Permissions

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...

PT-2025-39995

Name of the Vulnerable Software and Affected Versions KServe ModelMesh container images affected versions not specified Description A container privilege escalation flaw exists due to the /etc/passwd file being created with group-writable permissions during the build process. An attacker with the...

CVE-2025-48924 vulnerabilities

Vulnerabilities for packages: confluent-kafka, sonarqube, spdx-tools-java, wildfly, cassandra-reaper, akhq, debezium-connector-spanner, thingsboard, jenkins, zipkin, apache-nifi-registry, kserve-modelmesh, cassandra, gradle, apicurio-registry, dependency-track, apache-activemq-artemis, nextflow,...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: confluent-kafka, sonarqube, spdx-tools-java, wildfly, cassandra-reaper, akhq, debezium-connector-spanner, thingsboard, jenkins, zipkin, apache-nifi-registry, kserve-modelmesh, cassandra, gradle, apicurio-registry, dependency-track, apache-activemq-artemis, nextflow,...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: keycloak, apache-activemq-artemis, apache-nifi-registry, spark, zaproxy, management-api-for-apache-cassandra-4.1, camunda-zeebe, elasticsearch-fips, hadoop-client-modules, management-api-for-apache-cassandra-4.0, py3-vllm-cuda-12.4, cassandra-reaper, logstash,...

GHSA-6V67-2WR5-GVF4 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, tez, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, ontop, trino, akhq, ontop-fips, dependency-track, hadoop-fips, zookeeper-fips, sonar-scanner-cli, cassandra-fips, sonarqube, thingsboard, sonarqube-10,...

CVE-2024-12801 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, tez, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, ontop, trino, akhq, ontop-fips, dependency-track, hadoop-fips, zookeeper-fips, sonar-scanner-cli, cassandra-fips, sonarqube, thingsboard, sonarqube-10,...

CVE-2024-12798 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, tez, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, ontop, trino, akhq, ontop-fips, dependency-track, hadoop-fips, zookeeper-fips, sonar-scanner-cli, cassandra-fips, sonarqube, thingsboard, sonarqube-10,...

GHSA-735F-PC8J-V9W8 vulnerabilities

Vulnerabilities for packages: emsdk, camunda-zeebe, hadoop-client-modules, tez, confluent-kafka, celeborn, trino, debezium-connector-spanner, opensearch, kube-fluentd-operator, hadoop-fips, hadoop-thirdparty, kafka, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset,...