CVE-2026-15581

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581

CVE-2026-15581 : A flaw in the TrustyAI Service (TAS) deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API, enabling reading, tampering, or deletion of monitoring data and configurations, and injection of arbitrary data into the service...

CVE-2026-15581 Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

EUVD-2026-55807

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13717

CVE-2026-13717 describes a misconfiguration in the Red Hat OpenShift AI (RHOAI) MaaS Gateway used in a model-serving context. The flaw permits a standard user with low privileges to intercept, read, log, and alter MaaS model traffic, including sensitive data such as access keys, input prompts, an...

CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13717

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13717

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-71576

CVE-2026-71576 affects multicluster-global-hub: the manager component improperly validates the source identity of CloudEvents on Kafka status topics. A remote attacker who compromises a managed hub and obtains its Kafka client certificate can manipulate the self-asserted source identity, enabling...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

CVE-2026-17021

CVE-2026-17021 affects the Salon Booking System for WordPress, up to version 10.30.33. The vulnerability arises because some booking-modification AJAX actions are not properly restricted and ownership of the targeted booking is not verified, enabling unauthenticated users to tamper with the store...

CVE-2026-17021 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

PT-2026-69953

Name of the Vulnerable Software and Affected Versions TrustyAI Service affected versions not specified Description A flaw in the TrustyAI Service TAS deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. This could enable an attacker to...

PT-2026-69950

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI RHOAI MaaS Gateway affected versions not specified Description Improper configuration of the MaaS Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS...

CVE-2026-64676

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-45198

Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory. The GPU thread of control Firmware uses a pointer from non-secure memory belonging to the Rich Execution Environment RE...