1753 matches found
CVE-2026-18982
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
pt-platform__DVWA
DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...
CVE-2026-18982
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
CVE-2026-18982 Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
EUVD-2026-55822
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
CVE-2026-18982
The CVE concerns RHOAI training-operator. Affected component: training-operator within Kubernetes environments. Privilege escalation arises from aggregating training job permissions onto native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough. A user ...
CVE-2026-18982 Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
CVE-2026-18951 Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole
A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...
CVE-2026-18982
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
CVE-2026-18951
A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...
CVE-2026-18951: Privilege Defined With Unsafe Actions
A flaw was found in the Red Hat OpenShift AI RHOAI overlay for the training operator. The RHOAI overlay incorrectly aggregates trainjobs management permissions into the native Kubernetes edit ClusterRole. This allows any user with edit ClusterRole permissions in a namespace to create, modify, and...
CVE-2026-18982: Execution with Unnecessary Privileges
A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...
PT-2026-69968
Name of the Vulnerable Software and Affected Versions RHOAI training-operator affected versions not specified Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service...
CVE-2026-65541
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...
CVE-2026-18276 Missing Authorization in eScriptorium
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
EUVD-2026-53971
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...
CVE-2026-65541
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...
CVE-2026-65541 WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...